When trying to add new credentials in the Symantec ATP APP for Splunk add on gets an error " Failed to authenticate host using provide credentials" when trying to configure the Symantec Email Security.cloud Configuration.
1) Verify you can login to https://clients.messagelabs.com with the new username and password
2) Verify the new login has the appropriate permission assigned (View Statistics)
3) Verify you are able to log into https://datafeedapi.symanteccloud.com
If you have verified all the above and still receiving the error message the passsword.conf may be corrupted, modify or deleted then you will want to uninstall the Symantec ATP add on APP from Splunk and reinstall the APP again then apply your credentials for the Symantec Email Security.cloud.