Symantec WSS Splunk App - Production Installation and Architecture Guide.pdf on page 9 indicates that to take advantage of proxy authentication, that certain variables need to be configured in
$SPLUNK_HOME$/etc/apps/TA-SymantecWebSecurityService/bin/scwss-poll.py
e.g.
PROXY_FLAG=True
PROXY_USERNAME=...
PROXY_PASSWORD=...
However, the code in scwss-poll.py does not appear to handle these variables, and also does not make a URL request with proxy details.
This is how it is configured:
url = "%s://%s/reportpod/logs/sync?apiUsername=%s&apiPassword=%s&startDate=%s&endDate=%s&token=%s" % (
protocol, self.host, self.apiusername, self.apikey, startime, endtime, token)
request = urllib2.Request(url)
try:
response = urllib2.urlopen(request)
return response
So I was unable to get proxy authentication working. However, I found that the below code modification works by doing the following:
url = "%s://%s/reportpod/logs/sync?apiUsername=%s&apiPassword=%s&startDate=%s&endDate=%s&token=%s" % (
protocol, self.host, self.apiusername, self.apikey, startime, endtime, token)
#### My EDIT
proxy = urllib2.ProxyHandler({'http': 'http://<username>:<password>@<myproxy>:<proxy_port>','https': 'https://<username>:<password>@myproxy:<proxy_port>'})
auth = urllib2.HTTPBasicAuthHandler()
opener = urllib2.build_opener(proxy, auth, urllib2.HTTPHandler)
urllib2.install_opener(opener)
#######
##request = urllib2.Request(url)
try:
response = urllib2.urlopen(url)
return response
Should this code and/or documentation be updated to reflect this. I am using Version 1.0.1 of the add-on.
... View more
