Getting Data In

How to send json data via HEC

timyong80
Explorer

I am using a Python script to send data to Splunk via HEC. There's no problem when curling a simple "Hello World".
However, I would like to curl search results (json format) obtained via a Python script. Here's how the snippet of the Python script to get the results in json format.

alt text

The results look like this:

{'_id': {'$oid': '5ec4f96e67ac75656af5ea5b'}, 'created_at': '2020-05-10T09:33:33.490855', 'appid_caller': 'fg67k78k-7f44-5c90-a1b6-42gf5jjjj00a', 'input': {'target_host': 'portal-azure.cloud.io',
'target_port': 443}, 'output': {'result': False, 'info': 'Application has failed security checks. Drill down the results [array] to find information.', 'results': [{'category': 'hosting', 'result': False, 'title': 'Insecure use of shared hosting subdomain', 'description': "The application uses shared hosting parent domain. Recommended to use (e.g.: *.abc.com, *.abc.cloud, etc).", 'cwe': 348, 'checks': []}]}}

Question is: how do I curl the results (server_info) using HEC? I'm getting an error 400. I'm guessing the problem lies with the 'data' variable where it may not be defined properly. Also, I've tried the endpoints; services/collector and services/collector/event but none worked. When using services/collector/raw endpoint, I did get a response code 200 which indicated successful but jargon data was displayed in Splunk. Below is the post script used.

splunk_headers = {'Authorization': 'Splunk f5t34545-xxxxxc-xxxx-xxxx-xxxx-xxxxxxxx'}
data = {"sourcetype": "server","event": server_info}
response = requests.post('https://server03.na.abc.com:8088/services/collector/event', headers=splunk_headers, data=data, verify=False)

Thank you.

0 Karma

anthonymelita
Contributor

Try setting Content-Type 'application/json' in the headers. This is an example I'm doing using Python requests module.

requests.post("https://hec-server:8088/services/collector", headers={'Authorization': 'Splunk xxxxxxxxxxxxxxxx','Content-Type': 'application/json'}, data=json.dumps({'event': dictVar}), verify="False")

0 Karma

timyong80
Explorer

Thanks. I tried using your script but it didnt work. The error message was "Could not find a suitable TLS CA certificate bundle, invalid path: False"

Is dictVar the variable that you have defined for the json results? If so, I replaced it with mine which is server_info.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...