ForwardAuditLogsToSplunkHEC

This Automation script uses the XSOAR API to get the audit logs and pushes them to Splunk HEC. Dependencies: SlunkPy and Core REST API integrations.

python · Forward XSOAR Audit Logs to Splunk HEC

Details

ID	`ForwardAuditLogsToSplunkHEC`
Language	python
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	Utility

README

This Automation script uses the XSOAR API to get the audit logs and pushes them to Splunk HEC. Dependencies: SlunkPy and Core REST API integrations

Script Data

Name	Description
Script Type	python3
Tags	Utility

Inputs

Argument Name	Description
timeframe	timeframe to fetch in hours

Outputs

There are no outputs for this script.

Troubleshooting

Multi-tenant environments should be configured with the Cortex Rest API instance when using this
automation. Make sure the Use tenant parameter (in the Cortex Rest API integration) is checked
to ensure that API calls are made to the current tenant instead of the master tenant.

Source

ForwardAuditLogsToSplunkHEC.py ForwardAuditLogsToSplunkHEC_test.py ForwardAuditLogsToSplunkHEC.yml

Download History Raw

args:
- default: true
  defaultValue: "1"
  description: timeframe to fetch in hours.
  name: timeframe
comment: 'This Automation script uses the XSOAR API to get the audit logs and pushes them to Splunk HEC. Dependencies: SlunkPy and Core REST API integrations.'
commonfields:
  id: ForwardAuditLogsToSplunkHEC
  version: -1
dependson:
  must: []
dockerimage: demisto/python3:3.12.13.10116658
enabled: true
name: ForwardAuditLogsToSplunkHEC
runas: DBotWeakRole
script: ''
scripttarget: 0
subtype: python3
tags:
- Utility
type: python
fromversion: 6.0.0
tests:
- No tests