Topic
  • 3 replies
  • Latest Post - ‏2015-11-11T00:19:00Z by lin-zhao
lin-zhao
lin-zhao
28 Posts

Pinned topic too many failed login attempts failure from API

‏2015-11-09T19:11:07Z |

We have been relying on the Ariel API to get logs from QRadar. Starting from 7.2.5 we've seen occational "too many failed login attempts" from the queries, even though the save password and username is used. Is there a  cap per minute login introduced in the recent version? 

 

We've been using simple authentication in every query to Ariel. Should we switch to using the SEC cookie? The SEC cookie didn't work in a previous version and we were advised in this forum to always submit the username/password. I wonder if this has changed.

  • lin-zhao
    lin-zhao
    28 Posts
    ACCEPTED ANSWER

    Re: too many failed login attempts failure from API

    ‏2015-11-11T00:19:00Z  

    NVM this issue. There's a bug in my code that might have caused this.

  • KateM (IBM)
    KateM (IBM)
    43 Posts

    Re: too many failed login attempts failure from API

    ‏2015-11-10T21:38:52Z  

    Hi lin-zhao

     

    Making API calls with valid credentials (either user name and password or an authorized service token) shouldn't result in failed login errors.  I will take look into this issue to see if there might be an underlying issue there.  Are you getting successful responses to your API requests?

     

    Kate

  • lin-zhao
    lin-zhao
    28 Posts

    Re: too many failed login attempts failure from API

    ‏2015-11-10T23:41:18Z  

    Yes I do get successful responses, vast majority of the time. Then all of a sudden the account gets locked out. I can't reliably reproduce it but it happens once or twice a day when I do development work on our test host. Let me know if you need additional data. logs etc.

  • lin-zhao
    lin-zhao
    28 Posts

    Re: too many failed login attempts failure from API

    ‏2015-11-11T00:19:00Z  

    NVM this issue. There's a bug in my code that might have caused this.