How to get REST API to asset information and associated vulnerabilities?

[RaviThummala]

HI, We are analyzing the Splunk product to get the Assets ( Hosts, servers, network devices etc) , Asset information like name, network interface and associated vulnerability details. We need to fetch these details with REST API.

We explored all the REST API, we didn’t succeed, kindly let us know the possible ways to get Asset and associated vulnerability details using API.

[richgalloway]

What exactly are you trying to get out of Splunk?  The term "Assets" is fairly broad so it will help to know precisely what you need.  Are you storing asset, network interface, and vulnerability info in Splunk?

I suspect the data you seek will not be available from a dedicated REST API endpoint.  Instead, you'll need to use the API or SDK to launch a search and export the results.

[RaviThummala]

I am trying to get endpoints details  and associated vulnerability details. here endpoints are like (Desktop/laptop/server).  I am not ingesting any vulnerability data to Splunk, assuming if data ingested from different sources. I hope Splunk will analyze ingested data and generate vulnerability/threats.

I am exploring the API or other way to get asset information and associated vulnerability/threat information.

,

[starcher]

Splunk is a general data search tool. You would have to ingest such information and execute searches against it. You can use the Splunk API to execute searches from outside of Splunk.

https://docs.splunk.com/Documentation/Splunk/9.0.2/RESTREF/RESTprolog

However if you are looking for "give me recent vulns api" endpoint that is something for Vuln management consoles that go with your scanning tool. You should look there.   My personal opinion is also Splunk is a horrible place for vulnerability data. Splunk is a time series data system which does not lend itself to what a vulnerable console system does.  Yes you can hammer it in but trying to recreate such a product in Splunk is painful.