Getting Data In

How to connect Splunk API with Trend Micro Apex One aaS?



I try onboarding several Trend Micro Cloud Applications like Apex One as a Service but it just doesn't work. 

On the Apex One Cloud Platform I can get the URL, Application ID and API Key necessary to connect. 


but it doesn't seem to work. I get the following errors in the apex_one_as_a_service_api.log : 

2021-11-12 09:56:08,859 DEBUG pid=105063 tid=MainThread | "GET /WebApp/api/v1/Logs/officescan_virus?output_format=CEF&page_token=0&since_time=1636707248 HTTP/1.1" 404 1245



2021-11-12 10:00:08,804 ERROR pid=122037 tid=MainThread | Get error when collecting events. Traceback (most recent call last): File "/opt/splunk/etc/apps/Apex-One-as-a-Service/bin/apex_one_as_a_service/aob_py3/modinput_wrapper/", line 128, in stream_events self.collect_events(ew) File "/opt/splunk/etc/apps/Apex-One-as-a-Service/bin/", line 64, in collect_events input_module.collect_events(self, ew) File "/opt/splunk/etc/apps/Apex-One-as-a-Service/bin/", line 91, in collect_events r_json = response.json() File "/opt/splunk/etc/apps/Apex-One-as-a-Service/bin/apex_one_as_a_service/aob_py3/requests/", line 897, in json return complexjson.loads(self.text, **kwargs) File "/opt/splunk/lib/python3.7/json/", line 348, in loads return _default_decoder.decode(s) File "/opt/splunk/lib/python3.7/json/", line 337, in decode obj, end = self.raw_decode(s, idx=_w(s, 0).end()) File "/opt/splunk/lib/python3.7/json/", line 355, in raw_decode raise JSONDecodeError("Expecting value", s, err.value) from None json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0) 


splunkd.log itself says the same: 

11-12-2021 10:02:08.931 +0100 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/Apex-One-as-a-Service/bin/" ERRORExpecting value: line 1 column 1 (char 0)


I'm trying to use the following app for it:


What is wrong? does anyone know how to make this work? 

PS: I'm sorry I can't use the "insert code" function here since it throws errors when I try. 


Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...