How to connect Splunk API with Trend Micro Apex One aaS?

avoelk — Fri, 12 Nov 2021 09:14:44 GMT

Hello!

I try onboarding several Trend Micro Cloud Applications like Apex One as a Service but it just doesn't work.

On the Apex One Cloud Platform I can get the URL, Application ID and API Key necessary to connect.

but it doesn't seem to work. I get the following errors in the apex_one_as_a_service_api.log :

2021-11-12 09:56:08,859 DEBUG pid=105063 tid=MainThread file=connectionpool.py:_make_request:437 | https://xj7qb2.manage.trendmicro.com:443 "GET /WebApp/api/v1/Logs/officescan_virus?output_format=CEF&page_token=0&since_time=1636707248 HTTP/1.1" 404 1245

and:

2021-11-12 10:00:08,804 ERROR pid=122037 tid=MainThread file=base_modinput.py:log_error:309 | Get error when collecting events. Traceback (most recent call last): File "/opt/splunk/etc/apps/Apex-One-as-a-Service/bin/apex_one_as_a_service/aob_py3/modinput_wrapper/base_modinput.py", line 128, in stream_events self.collect_events(ew) File "/opt/splunk/etc/apps/Apex-One-as-a-Service/bin/apex_one_as_a_service_api.py", line 64, in collect_events input_module.collect_events(self, ew) File "/opt/splunk/etc/apps/Apex-One-as-a-Service/bin/input_module_apex_one_as_a_service_api.py", line 91, in collect_events r_json = response.json() File "/opt/splunk/etc/apps/Apex-One-as-a-Service/bin/apex_one_as_a_service/aob_py3/requests/models.py", line 897, in json return complexjson.loads(self.text, **kwargs) File "/opt/splunk/lib/python3.7/json/__init__.py", line 348, in loads return _default_decoder.decode(s) File "/opt/splunk/lib/python3.7/json/decoder.py", line 337, in decode obj, end = self.raw_decode(s, idx=_w(s, 0).end()) File "/opt/splunk/lib/python3.7/json/decoder.py", line 355, in raw_decode raise JSONDecodeError("Expecting value", s, err.value) from None json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

splunkd.log itself says the same:

11-12-2021 10:02:08.931 +0100 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/Apex-One-as-a-Service/bin/apex_one_as_a_service_api.py" ERRORExpecting value: line 1 column 1 (char 0)

I'm trying to use the following app for it:

https://splunkbase.splunk.com/app/5431/

What is wrong? does anyone know how to make this work?

PS: I'm sorry I can't use the "insert code" function here since it throws errors when I try.

topic How to connect Splunk API with Trend Micro Apex One aaS? in Getting Data In

How to connect Splunk API with Trend Micro Apex One aaS?