How to fetch HTTP Headers in HTTP Event Collector

hmvs — Wed, 12 May 2021 04:33:21 GMT

Hi Team,

I am trying to integrate Shodan notification (Webhook) with Splunk.

I have configured HTTP Even Collector in Splunk Enterprise with a Unique Index name.

I am using query string authentication mechanism as I wanted to use the splunk URI as Webhook in shodan settings so splunk will get data in.

curl -k https://127.0.0.1:8088/services/collector/raw?token=5a144245-e893-4c08-8bde-94c36c0376f5 -d "JSON_DATA_HERE" -H "X-Content-Type: CustomjsonPayload"

when I am sending curl request for testing POST JSON data, I am able to get data in Events (Search query "index=hec")

Now when I was reading the shodan API documents, they have mentioned that every POST request will be having some unique HTTP Headers regarding each notification generated.

I do not have control on Shodan POST Request (as it is generated by their servers).

So I wanted to capture ( HTTP Headers + POST Data ) both as well in the Splunk Events.

Link for reference:
https://help.shodan.io/developer-fundamentals/monitor-webhooks
Snippet from above Shodan link:

================================

Receiving the data

You've got your web service up and running, you've registered and enabled your webhook, and now it's time to actually process the incoming data that Monitor will send. The webhook notification does a POST request to your URL where:

The body of the POST request contains a JSON-encoded banner
The header of the POST request contains information about the alert

............

The headers contain metadata about the alert to help you understand which alert was responsible for generating the notification. Specifically, the following headers are available in the POST request:

SHODAN-ALERT-ID: unique ID for the alert
SHODAN-ALERT-NAME: name for the alert
SHODAN-ALERT-TRIGGER: trigger that caused the notification to get sent
SHODAN-SIGNATURE-SHA1: SHA1 signature encoded using your API key to validate the notification's origin

================================

So I wanted to capture HTTP Headers as well in the Splunk Events. How could I do it.

Or if there is any other way for getting data from Webhooks, please let me know.

Thanks in advance.

topic How to fetch HTTP Headers in HTTP Event Collector in Getting Data In

How to fetch HTTP Headers in HTTP Event Collector