topic Re: Integration HTTP https://splunkbase.splunk.com/app/5904 in Splunk SOAR

Integration HTTP https://splunkbase.splunk.com/app/5904

marq198 — Wed, 20 Mar 2024 12:59:39 GMT

Hi,

I ran the HTTP splunk integrations with https://splunkbase.splunk.com/app/5904
I have a problem sending a put request to splunk ES according to the
https://docs.splunk.com/Documentation/ES/latest/API/NotableEventAPIreference#.2Fservices.2Fnotable_update

I don't know what the body and header should look like, the connection works for me because it returns that I have access, Status Code: 400 Data from server: \"ValueError: One of comment, newOwner, status, urgency, disposition is required".
\
Anyone encountered this probleme ?

Re: Integration HTTP https://splunkbase.splunk.com/app/5904

phanTom — Wed, 20 Mar 2024 12:40:28 GMT

@marq198 you know the Splunk app has an "update_notable" action?

You say you don't know what the header or body should look like? I would ask shy you're trying this without that information, it's kind of important 😁.

See if you can use the Splunk app otherwise I would recommend reading up on how to interact with the Splunk API and then you should be able to make it work: https://docs.splunk.com/Documentation/Splunk/9.2.0/RESTTUT/RESTTutorialIntro

Re: Integration HTTP https://splunkbase.splunk.com/app/5904

marq198 — Wed, 20 Mar 2024 13:36:26 GMT

I know how the header and body should look like, while in this integration it does not work, did you use it ?

according to the SOAR integration documentation, it can be delivered in json format so it provides such a format

body:

{"ruleUIDs":"xxx","newOwner":"xxx","comment": "test","status":"5","disposition":"disposition:2"}