Troubleshooting integrations

Check your authentication credentials for the third-party service and try again. If the API requires a secret, make sure you've created it correctly and given it the correct permissions.

For example you see this error if the MS Graph API returns the error code 401.

Check all the credentials and permissions you provided when adding the integration and make sure they're correct.

If you don't have any network issues in your environment, or with your internet connection, this can mean problems with the third-party service. Check that the service is available.

Requests from Sophos have been throttled by the third-party service. The following are some examples of why throttling happens, taken from the MS Graph Security integration:

• Microsoft has throttled your connection (Microsoft error code 429 - Client application has been throttled and should not attempt to repeat the request until an amount of time has elapsed.).

• Microsoft has throttled your connection for exceeding the maximum bandwidth cap (Microsoft error 509 - Your app can retry the request again after more time has elapsed).

There's a problem with reaching the third-party service. Try again later.

There's an internal problem, please try again later.

The credentials for the integration have expired. For example, an API token that has been created in the third-party product may only be valid for 30 days.

The certificate used to set up a custom domain for an integration isn't valid. You need to create a new certificate or use a different one.

The domain for the third-party service is wrong or couldn't be reached. Check the domain and try again.

There's an error with the configuration that doesn't fall into any specific category. You need to review the whole configuration to find the issue.

When you create the application secret for a Cylance integration, you must select the access privilege for Detection.

For more information read the Generate an application secret section of the Cylance help page. See Blackberry CylanceOPTICS.

The integration doesn't have sufficient permissions to get logs from the Duo API. Make sure you've set Permission in Duo to Grant read log.

For more information read the Get details from Duo section of the Duo help page. See Cisco Duo.

The hostname is invalid. Make sure you've entered a hostname in the form: api-xxxxxxxx.duosecurity.com. You must not use https://.

For more information read the Add an integration section of the Duo help page. See Cisco Duo.

You can see this error if there are connection issues, but also if the base URL entered is invalid. This can happen if the base URL you entered doesn't have a publicly resolvable DNS record. The integration only works if the base URL is publicly resolvable.

This error can occur if you entered a base URL that is invalid or private, i.e. isn't publicly resolvable. The integration doesn't work unless the base URL is publicly resolvable.

A self-signed certificate is being used, or some parts of the chain are missing or incomplete. Check that the certificate is valid and isn't self-signed.

The integration doesn't have the required permissions to get data from Mimecast. Check that you've correctly created the Mimecast service user with the following permissions:

• Monitoring | URL Protection | Read
• Monitoring | Impersonation Protection | Read
• Monitoring | Impersonation Protection | Read

For more information read the Create service user section in the Mimecast help page. See Mimecast Email Security, Cloud Gateway.

The credentials used for the Mimecast API have expired. Make sure the Mimecast service user you created has Authentication Cache TTL set to Never Expire as described in the Create service user section in the Mimecast help page. See Mimecast Email Security, Cloud Gateway.

If all the other credentials you've provided are correct, this can mean the application ID is incorrect. Check that it's valid.

The certificate for the Okta base URL is invalid. Check that it's valid.

Currently we support VMware ESXi 6.7 Update 3 or later and Microsoft Hyper-V 6.0.6001.18016 (Windows Server 2016) or later. We will add more platforms in the future.

The integration can't connect to the relevant third-party product or service. Make sure there are no network issues preventing connection.

There can be many reasons for this. The best approach is to go through the documentation for the integration and check that you've set up everything on the third-party to allow the log collector to connect.

The virtual machine hosting the appliance may be under-powered. Check the sizing guide for the ESXi server and change the settings of the VM. See Sophos NDR appliance size guide.