Splunk SOAR

Phantom Splunk App - "post data" action API error

jamescannalte
Engager

I'm attempting to use the "post data" action of the Splunk app in Phantom.

I'm fairly certain that I've correctly configured an asset for the app to use because the "Test Connectivity" button works and other actions on the Splunk app, such as "get host events" work fine and succeed.

Whenever I try to run the post data action however, the action fails with Message: "Splunk server returned error from API call"

Is there any way to get more detailed of an error message, i.e. what error the API call returned? Are there logs I can look at somewhere?

Thanks for any help / suggestions.

Labels (2)
Tags (1)
0 Karma
1 Solution

jamescannalte
Engager

Update to this:

I enabled Trace logging in Phantom (Administration > System Health > Debugging), then examined the logs in /var/log/phantom that changed after running the playbook with the post data action.

From that I found a log message in the file spawn.log which gave the response to the POST api call. This told me that the post data action is using the "receivers/simple" endpoint behind the scenes. The response (from the log file) indicated a 403 was being thrown ("insufficient permission to access this resource"), which appears to be an issue that can be resolved by adding a capability to a config file (see links below).

https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/RESTREF/RESTinput#receivers.2Fsimple
https://answers.splunk.com/answers/338746/posting-to-a-receiver-using-rest-api-giving-insuff.html#an...

View solution in original post

0 Karma

jamescannalte
Engager

Update to this:

I enabled Trace logging in Phantom (Administration > System Health > Debugging), then examined the logs in /var/log/phantom that changed after running the playbook with the post data action.

From that I found a log message in the file spawn.log which gave the response to the POST api call. This told me that the post data action is using the "receivers/simple" endpoint behind the scenes. The response (from the log file) indicated a 403 was being thrown ("insufficient permission to access this resource"), which appears to be an issue that can be resolved by adding a capability to a config file (see links below).

https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/RESTREF/RESTinput#receivers.2Fsimple
https://answers.splunk.com/answers/338746/posting-to-a-receiver-using-rest-api-giving-insuff.html#an...

0 Karma
Get Updates on the Splunk Community!

Splunk is Nurturing Tomorrow’s Cybersecurity Leaders Today

Meet Carol Wright. She leads the Splunk Academic Alliance program at Splunk. The Splunk Academic Alliance ...

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Welcome to the second segment of our guide. In Part 1, we covered the essentials of getting started with ITSI ...

Part 1: A Guide to Maximizing Splunk IT Service Intelligence

As modern IT environments continue to grow in complexity and speed, the ability to efficiently manage and ...