All Apps and Add-ons

mfa is it possible with just api key,mfa enabled on all accounts

awayne1
New Member

I am have working on getting the github addon to work but having some difficulty

I am able to write a script against our github with my api key but I have not been successful in implementing the addon in splunk.

we have mfa enabled on ALL accounts including mine but I can write scripts,So is it not possible at all to get this plugin to work with mfa enabled on all accounts?

The details section is unclear if there is a way to get the addon to work bc of the mention of API key

Like I can script a script with an API key on an account that has MFA enabled and get data

0 Karma

awayne1
New Member

We are using github.com no internal instance

0 Karma

edavison
Explorer

I'll need a little more detail on whether you're accessing GitHub.com or an internal GitHub Enterprise server. If this is an internal server, there are some configurations that admins can enable that could prevent the app from working.

The app will function with MFA accounts as long as the API token is created with the proper permissions and has permissions to the orgs/repos it is being configured to access. All that is required is to use the token as the password.

Check the internal logs for errors from the inputs and you may consider enabling debug logging in the app to see more detail. If that isn't useful for identifying the issue, post back some of the logs output.

0 Karma

datamine
Loves-to-Learn Lots

hi @edavison

how do these python programs are called?

in inputs.conf i see the stanza name same as python program. Am i right?

[github_api_repos_stats]
start_by_shell = false
sourcetype = github:repos:stats
interval = 86400
disabled = 0

[github_api_repos_commits]
start_by_shell = false
sourcetype = github:repos:commits
interval = 3600
disabled = 0

[github_api_repos_issues]
start_by_shell = false
sourcetype = github:repos:issues
interval = 86400
disabled = 0

Thanks,
Devon

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...