topic Re: How to solve security issue when using Rest API to connect to splunk? in Splunk Dev

How to solve security issue when using Rest API to connect to splunk?

shai — Tue, 27 Aug 2024 15:51:52 GMT

I develop an app on a private Splunk Enterprise server and have a piece of code that accesses the rest api:

# Use Splunk REST API to get all input parameters splunkd_uri = os.environ.get("SPLUNKD_URI", "https://127.0.0.1:8089") endpoint = f"{splunkd_uri}/servicesNS/nobody/{app_name}/data/inputs/{app_name}" headers = { 'Authorization': f'Splunk {session_key}' } response = requests.get(endpoint, headers=headers, verify=False, timeout=30)

Everything works locally but when I run app-inspect before submitting to splunkcloud I get:

FAILURE: If you are using requests.get to talk to your own infra
with non-public PKI, make sure you bundle your own CA certs as part
of your app and pass the path into requests.get as an arg. File:
bin\utils\splunk_rest.py Line Number: 19

I am trying to understand how to solve this issue, because if I put a CA that matches the server I am working on, it will not satisfy the splunkcloud server that my clients will use.

I think I am misunderstanding a core piece around how to utilize Rest API pragmatically.

What is the correct way to go about this?
Can it work both for Splunk enterprise and on Splunk Cloud?

any clue or tip may help
Thanks

Re: How to solve security issue when using Rest API to connect to splunk?

tej57 — Thu, 29 Aug 2024 07:40:24 GMT

Hello @shai,

In this scenario, you'll need to combine your certs along with SplunkCloud certificates. Just append the CA file to include self signed certificate and SplunkCloud rootCA and use the same for communication. This chain will help you communicate with both Splunk Enterprise On-Prem and SplunkCloud environment.

Thanks,
Tejas.

---

The above solution helps, an upvote is appreciated.!!

Re: How to solve security issue when using Rest API to connect to splunk?

shai — Sun, 08 Sep 2024 13:41:16 GMT

Thank you for the kind reply!
Where can I find SplunkCloud rootCA ?

Re: How to solve security issue when using Rest API to connect to splunk?

tej57 — Tue, 10 Sep 2024 06:51:08 GMT

Hello @shai,

You can find the SplunkCloud root CA from the Universal Forwarder package present on your SplunkCloud search head. It gives you a forwarder package with preconfigured outputs to forward the data to SplunkCloud indexers. Within the same app, you can find the certificates that you need to append your self signed ones with. The package name should go something like this - 100_<<stack_name>>_splunkcloud

Thanks,
Tejas.