Sumo Logic integration error: This operation is not allowed for your account type

[FabioPiluso]

Hi all,

the integration with Sumo Logic failed to work and now I get the error:

2022-04-22 12:41:51.3031 error Could not fetch incidents from SumoLogic instance : SumoLogic_instance_1 [error 'Script failed to run: Status: 403
ID: WOXBU-A2PLF-BUHRT
Code: forbidden
Message: This operation is not allowed for your account type. at doReq (script:26:27(109)) (2603)'] (source: /builds/GOPATH/src/code.pan.run/xsoar/server/jobs/siemIncidentsFetch/siemIncidents.go:52)

I'm using the Free Edition version 6.6.0

Sumo Logic version 1.1.1 2791426

Do you know what this new error could be due to?

Thank you

Fabio

[cstone]

This looks like an account permissions issue. according to the api docs, you need to add the access key you are using to the allowlist to resolve this.

https://help.sumologic.com/Manage/Security/Access-Keys

[FabioPiluso · Accepted solution]

Hello,

maybe I understood why:

after the initial trial period, during which we used the Sumo Logic Enterprise trial, we activated the Essentials version which does not accept search API requests

https://help.sumologic.com/APIs/Troubleshooting-APIs/API-403-Error-This-operation-is-not-allowed-for...

Anyway thank you very much for the suggestion thanks to which now I understand what happens

Regads

Fabio