Troubleshooting
Problem
Changes made to IBM X-Force subscriptions might affect QRadar SOAR Threat Sources and the X-Force Collections for SOAR application.
Symptom
The error Invalid Credentials might be returned when trying to enable the IBM X-Force Exchange Threat Source in QRadar SOAR.
Furthermore, an error might be returned when using the X-Force Collections for SOAR application.
403 Client Error: Forbidden for url: https://api.xforce.ibmcloud.com
Cause
Previously free API keys with restricted access to the X-Force APIs could be be used. IBM X-Force have recently changed their subscriptions removing access to their API for freemium API keys.
https://www.ibm.com/docs/en/announcements/x-force-threat-intelligence-2024-plg-tiers
https://www.ibm.com/products/xforce-threat-intelligence/pricing
https://exchange.xforce.ibmcloud.com/faq
Diagnosing The Problem
You can test you API key and the access it has using curl.
curl -u <API KEY>:<API PASSWORD> GET https://api.xforce.ibmcloud.com/url/<REPLACE URL>
Your API key does not have access to the X-Force API if this error is returned.
{"error":"You currently have a Freemium tier subscription with limited access to the X-Force Exchange portal. For API access and to learn more about our premium subscriptions, please visit our <a href='https://www.ibm.com/products/xforce-exchange/editions' target='_blank'>digital marketing page</a> where you can sign up for a 30-day Standard tier trial."}
If your API key has access to the X-Force API you will receive a response with information on the URL you searched for.
Resolving The Problem
Purchase a subscription that allows access to the IBM X-Force API.
If you need more details get in touch with IBM X-Force directly.
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSA230","label":"IBM Security QRadar SOAR"},"ARM Category":[{"code":"a8m0z0000001hW8AAI","label":"Resilient Core-\u003EThreat Services"}],"ARM Case Number":"TS016034971","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"},{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSEGM63","label":"IBM Security QRadar SOAR on Cloud"},"ARM Category":[{"code":"a8m0z0000001hW8AAI","label":"Resilient Core-\u003EThreat Services"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]
Was this topic helpful?
Document Information
Modified date:
25 April 2024
UID
ibm17149465