I am trying to integrate Shodan notification (Webhook) with Splunk.
I have configured HTTP Even Collector in Splunk Enterprise with a Unique Index name.
I am using query string authentication mechanism as I wanted to use the splunk URI as Webhook in shodan settings so splunk will get data in.
curl -k https://127.0.0.1:8088/services/collector/raw?token=5a144245-e893-4c08-8bde-94c36c0376f5 -d "JSON_DATA_HERE" -H "X-Content-Type: CustomjsonPayload"
when I am sending curl request for testing POST JSON data, I am able to get data in Events (Search query "index=hec")
Now when I was reading the shodan API documents, they have mentioned that every POST request will be having some unique HTTP Headers regarding each notification generated.
I do not have control on Shodan POST Request (as it is generated by their servers).So I wanted to capture ( HTTP Headers + POST Data ) both as well in the Splunk Events.
Link for reference:https://help.shodan.io/developer-fundamentals/monitor-webhooksSnippet from above Shodan link:
Receiving the data
You've got your web service up and running, you've registered and enabled your webhook, and now it's time to actually process the incoming data that Monitor will send. The webhook notification does a POST request to your URL where:
The headers contain metadata about the alert to help you understand which alert was responsible for generating the notification. Specifically, the following headers are available in the POST request:
So I wanted to capture HTTP Headers as well in the Splunk Events. How could I do it.
Or if there is any other way for getting data from Webhooks, please let me know.
Thanks in advance.