All Apps and Add-ons

Is there a way to get this addon to connect to https://reports.office365.com through a http proxy?

xvieni
Engager

I am setting this addon up on a heavy forwarder (6.5), running on a debian linux. I am required to access the "internet" through a http proxy, without authentication and without inspection.
I cant find anywhere to configure the settings for the proxy server.

And since this is a O365 URL, the number of IP addresses returned when querying it is far to many to be manageable in a "through firewall" opening directly without a proxy server.

Did anyone get this to work through a http proxy, where the Splunk installation is not on a windows box?
(I noticed in the script "socks.py" that it imports the global proxy settings if the OS in "NT something")

0 Karma

jconger
Splunk Employee
Splunk Employee

Proxy support will be available in the next release. In the meantime, you can edit input_module_ms_o365_message_trace.py. Around line 57, you will see the following:

helper.log_debug("Endpoint URL: %s" % microsoft_trace_url)
r = requests.get(microsoft_trace_url, auth=requests.auth.HTTPBasicAuth(global_microsoft_office_365_username, global_microsoft_office_365_password))

The add-on uses the Python requests library which supports proxy servers. Make the following modifications:

helper.log_debug("Endpoint URL: %s" % microsoft_trace_url)
proxies = {
    'http': 'http://proxy_server_address:proxy_server_port',
    'https': 'http://proxy_server_address:proxy_server_port',
}
r = requests.get(microsoft_trace_url, proxies=proxies, auth=requests.auth.HTTPBasicAuth(global_microsoft_office_365_username, global_microsoft_office_365_password ))
0 Karma

faisal_saifi
New Member

Hi Jconger,
i have added following
proxies = {
'http': 'http://1.2.3.4:8080',
'https': 'http://1.2.3.4:8080',
}
But getting following error after restarting the splunk service.
"unable to initialise modular input'ms_o365_message_trace' defined inside the app 'TA-MS_o365_reporting' :introspecting scheme=ms_o365_message_trace : script running failed (exited with code 1)"

0 Karma

jconger
Splunk Employee
Splunk Employee

Check out the _internal index to get some more detail. The following search should help:

index=_internal source=*trace* error
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...