All Apps and Add-ons

Is there a way to get this addon to connect to https://reports.office365.com through a http proxy?

xvieni
Engager

I am setting this addon up on a heavy forwarder (6.5), running on a debian linux. I am required to access the "internet" through a http proxy, without authentication and without inspection.
I cant find anywhere to configure the settings for the proxy server.

And since this is a O365 URL, the number of IP addresses returned when querying it is far to many to be manageable in a "through firewall" opening directly without a proxy server.

Did anyone get this to work through a http proxy, where the Splunk installation is not on a windows box?
(I noticed in the script "socks.py" that it imports the global proxy settings if the OS in "NT something")

0 Karma

jconger
Splunk Employee
Splunk Employee

Proxy support will be available in the next release. In the meantime, you can edit input_module_ms_o365_message_trace.py. Around line 57, you will see the following:

helper.log_debug("Endpoint URL: %s" % microsoft_trace_url)
r = requests.get(microsoft_trace_url, auth=requests.auth.HTTPBasicAuth(global_microsoft_office_365_username, global_microsoft_office_365_password))

The add-on uses the Python requests library which supports proxy servers. Make the following modifications:

helper.log_debug("Endpoint URL: %s" % microsoft_trace_url)
proxies = {
    'http': 'http://proxy_server_address:proxy_server_port',
    'https': 'http://proxy_server_address:proxy_server_port',
}
r = requests.get(microsoft_trace_url, proxies=proxies, auth=requests.auth.HTTPBasicAuth(global_microsoft_office_365_username, global_microsoft_office_365_password ))
0 Karma

faisal_saifi
New Member

Hi Jconger,
i have added following
proxies = {
'http': 'http://1.2.3.4:8080',
'https': 'http://1.2.3.4:8080',
}
But getting following error after restarting the splunk service.
"unable to initialise modular input'ms_o365_message_trace' defined inside the app 'TA-MS_o365_reporting' :introspecting scheme=ms_o365_message_trace : script running failed (exited with code 1)"

0 Karma

jconger
Splunk Employee
Splunk Employee

Check out the _internal index to get some more detail. The following search should help:

index=_internal source=*trace* error
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...