About tisme

tisme · ‎12-07-2020

Thank you! Apologies, I meant to update I worked it out. Here is the below syntax I used for powershell to build the JSON and POST. $text = 'item=[{"'+ $IOCType + '":"' + $IOCInput + '","description":"' + $Description + '","threat_key":"<Company>_ThreatIntel"}]' Try {Invoke-WebRequest -Method Post -Uri $URL -Timeout 3600 -Credential $credentials -ContentType application/x-www-form-urlencoded -Body $text -ErrorAction Stop} Catch {PopUpBox -MessageBody "Could not post $IOC to Threat Intel Collection, exiting now" -MessageTitle "Sorry"; Exit} } If you are doing running via powershell, you'll have to add a function to specify TLS certificate as powershell defaults to something else.

tisme · ‎12-02-2020

Hi, I'm trying to integrate an API feed into our threat intelligence collections via powershell, however I can't seem to get the syntax correctly to update records. I know the API and authentication is working as GET and DELETE requests are successful, but when attempting to execute a PUT request i receive the error "item argument missing". I've tested below successfully, however I'd like to run this via powershell to encrypt credentials during authentication. curl -k -u admin:changeme https://localhost:8089/services/data/threat_intel/item/ip_intel/e83fa2c5036d4c85bd5669a48ca134c5 -d item='{"ip":"0.0.0.0"}' -X PUT I've attempted several different JSON formats, hoping the one below would work: { "item": { "ip": "0.0.0.0" } } Or even item='[{"ip":"0.0.0.0"}]' from the initial curl format, however it won't seem to work. I am still receiving the following error Invoke-WebRequest : {"status": false, "message": "item argument missing."}. Any suggestions?

Posts	2
Solutions	1
Karma Given	1
Karma Received	0
Member Since	‎08-19-2020

Online Status	Offline
Date Last Visited	‎12-08-2020 01:25 AM

Splunk API threat intelligence integration - Item ...

Re: Splunk API threat intelligence integration - I...

Splunk API threat intelligence integration - Item ...