ForwardAuditLogsToSplunkHEC

This Automation script uses the XSOAR API to get the audit logs and pushes them to Splunk HEC. Dependencies: SlunkPy and Core REST API integrations.

python · Forward XSOAR Audit Logs to Splunk HEC

Details

ID	`ForwardAuditLogsToSplunkHEC`
Language	python
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	Utility

README

This Automation script uses the XSOAR API to get the audit logs and pushes them to Splunk HEC. Dependencies: SlunkPy and Core REST API integrations

Script Data

Name	Description
Script Type	python3
Tags	Utility

Inputs

Argument Name	Description
timeframe	timeframe to fetch in hours

Outputs

There are no outputs for this script.

Troubleshooting

Multi-tenant environments should be configured with the Cortex Rest API instance when using this
automation. Make sure the Use tenant parameter (in the Cortex Rest API integration) is checked
to ensure that API calls are made to the current tenant instead of the master tenant.

Source

ForwardAuditLogsToSplunkHEC.py ForwardAuditLogsToSplunkHEC_test.py ForwardAuditLogsToSplunkHEC.yml

Download History Raw

import demistomock as demisto
import ForwardAuditLogsToSplunkHEC
import pytest
from CommonServerPython import *


def execute_command_side_effect(command: str, args: Dict):
    if command == "splunk-submit-event-hec":
        return [{"Contents": {"response": ["result1"]}}]
    if command == "core-api-post":
        if args["uri"] == "/settings/audits":
            return [{"Contents": {"response": {"total": 2, "audits": ["audit1", "audit2"]}}, "Type": entryTypes["note"]}]
        return [{"Contents": {"response": {"total": 2, "reply": {"data": ["audit1", "audit2"]}}}, "Type": entryTypes["note"]}]
    return None


@pytest.mark.parametrize(
    "xsoar_version, expected_uri",
    [({"version": "6.10"}, "/settings/audits"), ({"version": "8.1"}, "/public_api/v1/audits/management_logs")],
)
def test_forward_audit_logs_to_splunk_main_flow(mocker, xsoar_version, expected_uri):
    """
    Given:
        - xsoar version
    When:
        - Calling main flow
    Then:
        - make sure the correct uri is called for each xsoar version
    """
    mocker.patch.object(demisto, "args", return_value={"timeframe": "3"})
    execute_command_mocker = mocker.patch.object(demisto, "executeCommand", side_effect=execute_command_side_effect)
    mocker.patch.object(ForwardAuditLogsToSplunkHEC, "get_demisto_version", return_value=xsoar_version)
    return_results_mocker = mocker.patch.object(ForwardAuditLogsToSplunkHEC, "return_results")
    ForwardAuditLogsToSplunkHEC.main()
    assert return_results_mocker.called
    assert execute_command_mocker.call_args_list[0][0][1]["uri"] == expected_uri