Splunk Enterprise Security

How to connect the SEP api using python?

SumukhVenugopal
New Member

Hi 
I am trying to connect the SEP api via python and my code is as follows - 


# encoding = utf-8

import os
import sys
import time
import datetime
import json
import requests

import base64

'''
IMPORTANT
Edit only the validate_input and collect_events functions.
Do not edit any other part in this file.
This file is generated only once when creating the modular input.
'''
'''
# For advanced users, if you want to create single instance mod input, uncomment this method.
def use_single_instance_mode():
return True
'''

def validate_input(helper, definition):
"""Implement your own validation logic to validate the input stanza configurations"""
# This example accesses the modular input variable
# text = definition.parameters.get('text', None)
# text_1 = definition.parameters.get('text_1', None)
pass

def collect_events(helper, ew):

 opt_clientid = helper.get_arg('clientid')
 opt_clientsecret = helper.get_arg('clientsecret')
 opt_customerid = helper.get_arg('customerid')
 opt_domainid = helper.get_arg('domainid')
 opt_apihost = helper.get_arg('apihost')
 
 tokenUrl = "https://" + opt_apihost + "/v1/oauth2/tokens"
 post = []
files = []

s = requests.Session()
e = (opt_clientid + ':' + opt_clientsecret)
en = e.encode('utf-8')
en64 = base64.urlsafe_b64encode(en)
s.headers.update({ 'Accept': 'application/json' })
s.headers.update({ 'Authorization': 'Basic ' + str(en64.decode()) })
s.headers.update({ 'Content-Type': 'application/x-www-form-urlencoded' })
s.headers.update({ 'Host': opt_apihost })

f = s.post(tokenUrl, data=post, files=files, verify=False)


r = json.loads(f.text)
access_token = r['access_token']

url = "https://" + opt_apihost + "/v1/devices"
parameters = {"authorization":access_token}
final_result = []
# The following examples send rest requests to some endpoint.
response = helper.send_http_request(url, 'GET', parameters=None, payload=None,headers=parameters, cookies=None, verify=True, cert=None,timeout=None, use_proxy=True)
# get the response headers
#r_headers = response.headers
# get the response body as text
#r_text = response.text
# get response body as json. If the body text is not a json string, raise a ValueError
r_json = response.json()
for devices in r_json["devices"]:
state = helper.get_check_point(str(devices["id"]))
if state is None:
final_result.append(devices)
helper.save_check_point(str(devices["id"]), "Indexed")
event = helper.new_event(json.dumps(final_result), time=None, host=None, index=None, source=None, sourcetype=None, done=True, unbroken=False)
ew.write_event(event)

The test code works fine, but

1. The events are being indexed, each value is not appearing as a seperate entity but is rather grouped 

2. The data is not being updated in the interval mentioned in the beginning 

 

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...