Connectors

Every connection has a Check (or Validate) button that signs in again and shows the error.

Connector	Error	Fix
Any	certificate verify failed / x509	The service uses a certificate the appliance does not trust (often a lab or internal CA). Turn off Verify TLS certificate for a lab, or use a trusted certificate
Any	timeout / connection refused	The appliance cannot reach the service. Check DNS, proxies and firewalls from the appliance: curl -v <url>
LevelBlue	401 / invalid_client	The API client ID or secret is wrong, or the client was deleted in USM Anywhere
LevelBlue	Healthy, but no cases	No alarms above the severity floor since the connection was made, or polling is off. Poll now shows how many alerts it pulled
Elastic	403 / security_exception	The API key cannot read the alert indices. Give it read on .alerts-security*
AWS	AccessDenied on a question	The key lacks that permission. Garrison only needs read access; add the permission or accept the limit
AWS	Cost questions fail	Add ce:GetCostAndUsage to the key’s policy
FortiGate	401	The REST API token is wrong, or the appliance’s address is not in the API admin’s trusted hosts
FortiGate	Block is proposed but fails	The API admin is read-only. Give it write access to firewall addresses and policy, or keep it read-only and make blocks by hand

A SIEM that fails repeatedly opens a connector health case, so a broken connection is never silent.