Hello all,
I am trying to create a python script that pulls down information from a notable event in Enterprise Security. Then, passes that information (IP addresses, MD5s, and files) to third party APIs (such as VirusTotal or Palo Alto Wildfire) and references the hosts in an EDR tool (Crowd Strike or Carbon Black) collecting relevant information and sending that information back to the notable in Splunk.
I have most everything figured out except for putting the information back in Splunk. The closest thing I could find to what I want to do is adding a comment with the information:
url2 = 'https://SomeSplunkDomain.com:8089/services_update'
urgency = None
status = None
owner = None
event_id #taken from a dict
comment #taken from a dict
data = {
'ruleUIDs': [event_id],
'urgency': [urgency],
'status': [status],
'newOwner': [owner],
'comment': [comment]
}
notableUpdate = requests.post(url2, data=data, verify=False, auth=(someUsername, somePassword))
response2 = notableUpdate.json()
print(response2)
However, I could see a couple of issues arising from this and I am hoping someone knows a better way to add information to notable events. I don’t want to create another notable by adding the information to another correlation search.
Thank you in advance!
... View more