cancel
Showing results for 
Search instead for 
Did you mean: 
cancel

Why do I get no AMP results in CTR with read-only API key and "Act in the name of the Active User" enabled for my module?

243
Views
0
Helpful
0
Comments
Question

When I run a search in AMP4E console, I get results showing that a file was encountered recently by a number of hosts in my environment. When I do the same search in Cisco Threat Response (CTR), no targets are returned, and I get the error message:

 

"There was a client error in the AMP module: API client does not have write access [403]"

AMP error - API key.png

Why is this and how can I fix it?

Answer

This condition is likely due to the combination of an AMP API key that is set as read-only, combined with setting the AMP module in CTR as "Act in the Name of the Active User". When CTR calls AMP for results, a dynamic API key is created using your native credentials, which lacks the privileges to find hosts in the AMP environment.

act in the name of the active user.png

Workaround

You can either:

1. Disable the setting "Act in the Name of the Active User", and you should see all the hosts you're expecting in your query, or

2. Change your AMP API key to read/write.