Skip to content

Add support for Splunk authentication tokens to third party REST API#1147

Merged
leehinman merged 3 commits intoelastic:masterfrom
leehinman:apache_splunk_token_auth
Jun 29, 2021
Merged

Add support for Splunk authentication tokens to third party REST API#1147
leehinman merged 3 commits intoelastic:masterfrom
leehinman:apache_splunk_token_auth

Conversation

@leehinman
Copy link
Copy Markdown
Contributor

@leehinman leehinman commented Jun 17, 2021

What does this PR do?

Adds support for Splunk Authentication tokens to third party
REST API source.

  • apache
  • aws
  • system
  • windows
  • winlog
  • zeek

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
    - [ ] If I'm introducing a new feature, I have modified the Kibana version constraint in my package's manifest.yml file to point to the latest Elastic stack release (e.g. ^7.13.0).

How to test this PR locally

https://docs.splunk.com/Documentation/Splunk/8.2.0/Security/CreateAuthTokens
https://docs.splunk.com/Documentation/Splunk/8.2.0/RESTUM/RESTusing

Need to make tokens then try configuring tokens and ingesting data

Related issues

Screenshots

Screen Shot 2021-06-23 at 14 34 17

@elasticmachine
Copy link
Copy Markdown

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Jun 17, 2021

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: Pull request #1147 updated

  • Start Time: 2021-06-29T12:58:20.628+0000

  • Duration: 57 min 6 sec

  • Commit: a9e3ae4

Test stats 🧪

Test Results
Failed 0
Passed 914
Skipped 0
Total 914

Trends 🧪

Image of Build Times

Image of Tests

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In my opinion I would go an even simpler route and only specify in the token that it "Cannot be used with username and password".

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, that's better. If this looks good I'll update all the other third party screens to match.

Copy link
Copy Markdown
Member

@andrewkroh andrewkroh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 🚢

@leehinman leehinman changed the title Add support for Splunk authentication tokens to Apache Add support for Splunk authentication tokens to third party REST API Jun 25, 2021
@leehinman leehinman force-pushed the apache_splunk_token_auth branch 3 times, most recently from 3ad0fa7 to ab39923 Compare June 29, 2021 03:24
@leehinman leehinman force-pushed the apache_splunk_token_auth branch from ab39923 to a9e3ae4 Compare June 29, 2021 12:58
@leehinman leehinman merged commit 3543c85 into elastic:master Jun 29, 2021
@leehinman leehinman deleted the apache_splunk_token_auth branch September 28, 2021 20:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants