Phantom Splunk App - "post data" action API error

jamescannalte — Sun, 07 Jun 2020 17:45:13 GMT

I'm attempting to use the "post data" action of the Splunk app in Phantom.

I'm fairly certain that I've correctly configured an asset for the app to use because the "Test Connectivity" button works and other actions on the Splunk app, such as "get host events" work fine and succeed.

Whenever I try to run the post data action however, the action fails with Message: "Splunk server returned error from API call"

Is there any way to get more detailed of an error message, i.e. what error the API call returned? Are there logs I can look at somewhere?

Thanks for any help / suggestions.

Re: Phantom Splunk App - "post data" action API error

jamescannalte — Fri, 14 Jun 2019 15:35:50 GMT

Update to this:

I enabled Trace logging in Phantom (Administration > System Health > Debugging), then examined the logs in /var/log/phantom that changed after running the playbook with the post data action.

From that I found a log message in the file spawn.log which gave the response to the POST api call. This told me that the post data action is using the "receivers/simple" endpoint behind the scenes. The response (from the log file) indicated a 403 was being thrown ("insufficient permission to access this resource"), which appears to be an issue that can be resolved by adding a capability to a config file (see links below).

https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/RESTREF/RESTinput#receivers.2Fsimple
https://answers.splunk.com/answers/338746/posting-to-a-receiver-using-rest-api-giving-insuff.html#answer-338819

topic Re: Phantom Splunk App - "post data" action API error in Splunk SOAR

Phantom Splunk App - "post data" action API error

Re: Phantom Splunk App - "post data" action API error