Splunk SOAR (f.k.a. Phantom)

Phantom Splunk App - "post data" action API error

jamescannalte
Engager

I'm attempting to use the "post data" action of the Splunk app in Phantom.

I'm fairly certain that I've correctly configured an asset for the app to use because the "Test Connectivity" button works and other actions on the Splunk app, such as "get host events" work fine and succeed.

Whenever I try to run the post data action however, the action fails with Message: "Splunk server returned error from API call"

Is there any way to get more detailed of an error message, i.e. what error the API call returned? Are there logs I can look at somewhere?

Thanks for any help / suggestions.

Labels (2)
Tags (1)
0 Karma
1 Solution

jamescannalte
Engager

Update to this:

I enabled Trace logging in Phantom (Administration > System Health > Debugging), then examined the logs in /var/log/phantom that changed after running the playbook with the post data action.

From that I found a log message in the file spawn.log which gave the response to the POST api call. This told me that the post data action is using the "receivers/simple" endpoint behind the scenes. The response (from the log file) indicated a 403 was being thrown ("insufficient permission to access this resource"), which appears to be an issue that can be resolved by adding a capability to a config file (see links below).

https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/RESTREF/RESTinput#receivers.2Fsimple
https://answers.splunk.com/answers/338746/posting-to-a-receiver-using-rest-api-giving-insuff.html#an...

View solution in original post

0 Karma

jamescannalte
Engager

Update to this:

I enabled Trace logging in Phantom (Administration > System Health > Debugging), then examined the logs in /var/log/phantom that changed after running the playbook with the post data action.

From that I found a log message in the file spawn.log which gave the response to the POST api call. This told me that the post data action is using the "receivers/simple" endpoint behind the scenes. The response (from the log file) indicated a 403 was being thrown ("insufficient permission to access this resource"), which appears to be an issue that can be resolved by adding a capability to a config file (see links below).

https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/RESTREF/RESTinput#receivers.2Fsimple
https://answers.splunk.com/answers/338746/posting-to-a-receiver-using-rest-api-giving-insuff.html#an...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...