Cannot export data after creating custom Splunk App Add-on

[revin]

Hi,

I got 1 question:

Since I cannot find the Autobahn Security (World most impactful web vulnerability scan engine) app in Splunkbase, I create custom Splunk app add-on for API integration. We have a plan to integrate our API engine and have the data exported to splunk for our client that uses splunk. 

We want to see the data vulnerability point, create an add-on to Splunk base, but it's hard to display in Splunk. How to push the data from the our software, integrated to Splunk?

[gcusello · Accepted solution]

Hi @revin,

this isn't a question for Splunkers but for Autobahn Security people.

In Splunk you have many methods to ingest data, the main (but not the only) are:

• reading a file,
• from syslog,
• from a scripted input using API.

So the real question is: : which are the methods to extract logs from this technology?

Knowing ths you can choose the method you like.

If possible, monitor a file using a Universal Forwarder is prefereable, but I don't know if it's possible to install a UF on Autobahn Security, otherwise, as you said, you could create a script that calls via API the Autobahn Security server and extract data sending them to Splunk.

When you fould the method to extract data from Autobahn Security, you can store them in an index (called e.g. Autobahn_Security) and then search them in Splunk using a very easy search:

index=Autobahn_Security
| table *

 The scipt and the input that call it must be in the Technical Add_On.

Here you can find infos about scripted inputs https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptSetup and in google you can find also many training videos.

Ciao.

Giuseppe

[gcusello]

Hi @revin,

happy splunking!

Ciao.

Giuseppe

P.S.: karma Points are appreciated 😉