topic Re: REST API to get asset information and associated vulnerabilities in Splunk Enterprise

How to get REST API to asset information and associated vulnerabilities?

RaviThummala — Mon, 12 Dec 2022 15:11:14 GMT

HI, We are analyzing the Splunk product to get the Assets ( Hosts, servers, network devices etc) , Asset information like name, network interface and associated vulnerability details. We need to fetch these details with REST API.

We explored all the REST API, we didn’t succeed, kindly let us know the possible ways to get Asset and associated vulnerability details using API.

Re: REST API to get asset information and associated vulnerabilities

richgalloway — Fri, 09 Dec 2022 19:06:44 GMT

What exactly are you trying to get out of Splunk? The term "Assets" is fairly broad so it will help to know precisely what you need. Are you storing asset, network interface, and vulnerability info in Splunk?

I suspect the data you seek will not be available from a dedicated REST API endpoint. Instead, you'll need to use the API or SDK to launch a search and export the results.

Re: REST API to get asset information and associated vulnerabilities

RaviThummala — Mon, 12 Dec 2022 13:14:22 GMT

I am trying to get endpoints details and associated vulnerability details. here endpoints are like (Desktop/laptop/server). I am not ingesting any vulnerability data to Splunk, assuming if data ingested from different sources. I hope Splunk will analyze ingested data and generate vulnerability/threats.

I am exploring the API or other way to get asset information and associated vulnerability/threat information.

Re: REST API to get asset information and associated vulnerabilities

starcher — Mon, 12 Dec 2022 13:50:26 GMT

Splunk is a general data search tool. You would have to ingest such information and execute searches against it. You can use the Splunk API to execute searches from outside of Splunk.

https://docs.splunk.com/Documentation/Splunk/9.0.2/RESTREF/RESTprolog

However if you are looking for "give me recent vulns api" endpoint that is something for Vuln management consoles that go with your scanning tool. You should look there. My personal opinion is also Splunk is a horrible place for vulnerability data. Splunk is a time series data system which does not lend itself to what a vulnerable console system does. Yes you can hammer it in but trying to recreate such a product in Splunk is painful.