Skip to content

Commit 5fb663f

Browse files
lingy1028lingy1028
authored
Merge pull request #8 from splunk/add-webex-security-audit-events-input
added Webex Security Audit Events Input
2 parents 258f921 + 51ee941 commit 5fb663f

10 files changed

+494
-5
lines changed

‎README.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ Here are the endpoints and their mapping soucetypes.
1010
| Webex Admin Audit Events | [Admin Audit Events](https://developer.webex.com/docs/api/v1/admin-audit-events) | cisco:webex:admin:audit:events |
1111
| Webex Meeting Qualities | [Meeting Qualities](https://developer.webex.com/docs/api/v1/meeting-qualities/get-meeting-qualities) | cisco:webex:meeting:qualities |
1212
| Webex Detailed Call History | [Detailed Call History](https://developer.webex.com/docs/api/v1/reports-detailed-call-history/get-detailed-call-history) | cisco:webex:call:detailed_history |
13+
| Webex Security Audit Events | [Security Audit Events](https://developer.webex.com/admin/docs/api/v1/security-audit-events/list-security-audit-events) | cisco:webex:security:audit:events |
1314

1415
## Getting Started
1516
### Installation Instructions
@@ -191,6 +192,32 @@ The input uses checkpointing to avoid ingesting duplicate data. After the initia
191192
- **Locations** (_optional_): Enter up to 10 locations separated by a comma.
192193
- Click on the `Add` green button on the bottom right of the pop-up box.
193194

195+
196+
**Webex Security Audit Events Input**
197+
198+
The **Webex Security Audit Events** input is used to fetch the data from [Security Audit Events](https://developer.webex.com/admin/docs/api/v1/security-audit-events/list-security-audit-events) endpoint. It allows users to retrieve user sign-in and sign-out data.
199+
200+
**Prerequisites**: This input is only available to customers with **Pro Pack** for Control Hub. To use this input, you must make sure you have **Pro Pack** for Webex Contol Hub, and then follow these two steps to enable this feature.
201+
1. Sign in to Control Hub, then under **Management** > **Organization Settings**.
202+
2. In the **User authentication data** section, toggle **Allow user authentication data** on.
203+
204+
The `Start Time` is required. Set the starting date and time to fetch admin audit events. The Start time is inclusive and should be in the format YYYY-MM-DDTHH:MM:SS.SSSZ (example:2023-01-01T00:00:00.000Z). If you leave the `End Time` blank, Start Time **MUST** be within one year from the current time.
205+
206+
The `End Time` is optional. If you set it to be a specific date, only logs within the time range from Start Date to End Date will be ingested. The format should be YYYY-MM-DDTHH:MM:SS.SSSZ (example:2023-02-01T00:00:00.000Z).
207+
208+
The input uses checkpointing to avoid ingesting duplicate data. After the initial run, the script will save the latest audit event created time as the checkpoint, and will be used as the `Start Time` (advancing by one millisecond) for the next run.
209+
210+
- Click on the `Inputs` button on the top left corner.
211+
- Click on `Create New Input` button on the top right corner.
212+
- Enter the following details in the pop-up box:
213+
- **Name** (_required_): Unique name for the data input.
214+
- **Interval** (_required_): Time interval of input in seconds.
215+
- **Index** (_required_): Index for storing data.
216+
- **Global Account** (_required_): Select the account created during Configuration.
217+
- **Start Time** (_required_): Start date and time (inclusive) in the format YYYY-MM-DDTHH:MM:SS.SSSZ, `example:2023-01-01T00:00:00.000Z`. If you leave the `End Time` blank, Start Time **MUST** be within one year from the current time.
218+
- **End Time** (_optional_): End date and time in the format YYYY-MM-DDTHH:MM:SS.SSSZ.(Optional), `example:2023-02-01T00:00:00.000Z`. End Time must be after the Start Time.
219+
- Click on the `Add` green button on the bottom right of the pop-up box.
220+
194221
## Versions Supported
195222

196223
- Tested for installation and basic ingestion on Splunk 9.X and 8.2 for **CentOS** system.

‎globalConfig.json‎

Lines changed: 93 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"meta": {
33
"name": "ta_cisco_webex_add_on_for_splunk",
44
"displayName": "Cisco Webex Add-on for Splunk",
5-
"version": "1.0.11",
5+
"version": "1.1.0",
66
"restRoot": "ta_cisco_webex_add_on_for_splunk",
77
"schemaVersion": "0.0.9",
88
"supportedThemes": [
@@ -752,6 +752,98 @@
752752
]
753753
}
754754
]
755+
},
756+
{
757+
"template": "input_with_helper",
758+
"name": "webex_security_audit_events",
759+
"title": "Webex Security Audit Events",
760+
"entity": [
761+
{
762+
"field": "name",
763+
"label": "Name",
764+
"type": "text",
765+
"help": "Enter a unique name for the data input",
766+
"required": true,
767+
"validators": [
768+
{
769+
"type": "regex",
770+
"pattern": "^[a-zA-Z]\\w*$",
771+
"errorMsg": "Input Name must start with a letter and followed by alphabetic letters, digits or underscores."
772+
},
773+
{
774+
"type": "string",
775+
"minLength": 1,
776+
"maxLength": 100,
777+
"errorMsg": "Length of input name should be between 1 and 100"
778+
}
779+
]
780+
},
781+
{
782+
"type": "interval",
783+
"field": "interval",
784+
"label": "Interval",
785+
"help": "Time interval of input in seconds",
786+
"required": true
787+
},
788+
{
789+
"field": "index",
790+
"label": "Index",
791+
"type": "singleSelect",
792+
"defaultValue": "default",
793+
"options": {
794+
"endpointUrl": "data/indexes",
795+
"createSearchChoice": true,
796+
"denyList": "^_.*$"
797+
},
798+
"required": true,
799+
"validators": [
800+
{
801+
"type": "string",
802+
"minLength": 1,
803+
"maxLength": 80,
804+
"errorMsg": "Length of index name should be between 1 and 80."
805+
}
806+
]
807+
},
808+
{
809+
"field": "global_account",
810+
"label": "Global Account",
811+
"help": "",
812+
"required": true,
813+
"type": "singleSelect",
814+
"options": {
815+
"referenceName": "account"
816+
}
817+
},
818+
{
819+
"field": "start_time",
820+
"label": "Start Time",
821+
"help": "List events which occurred after a specific date and time. Start date and time MUST be in the format YYYY-MM-DDTHH:MM:SS.SSSZ.",
822+
"required": true,
823+
"type": "text",
824+
"validators": [
825+
{
826+
"type": "regex",
827+
"pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}.\\d{3}Z$",
828+
"errorMsg": "Start time must be in the format YYYY-MM-DDTHH:MM:SSZ (example:2023-01-01T00:00:00.000Z)"
829+
}
830+
]
831+
},
832+
{
833+
"field": "end_time",
834+
"label": "End Time",
835+
"help": "List events which occurred before a specific date and time. End date and time MUST be in the format YYYY-MM-DDTHH:MM:SS.SSSZ.(Optional). End Time must be after the Start Time.",
836+
"required": false,
837+
"type": "text",
838+
"validators": [
839+
{
840+
"type": "regex",
841+
"pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}.\\d{3}Z$",
842+
"errorMsg": "End time must be in the format YYYY-MM-DDTHH:MM:SS.SSSZ (example:2033-01-01T00:00:00.000Z)"
843+
}
844+
]
845+
}
846+
]
755847
}
756848
]
757849
}

‎package/README.md‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ Here are the endpoints and their mapping soucetypes.
99
| Webex Meetings Summary Report | [Meeting Attendee Reports](https://developer.webex.com/docs/api/v1/meetings-summary-report/list-meeting-attendee-reports) | cisco:webex:meeting:attendee:reports |
1010
| Webex Admin Audit Events | [Admin Audit Events](https://developer.webex.com/docs/api/v1/admin-audit-events) | cisco:webex:admin:audit:events |
1111
| Webex Meeting Qualities | [Meeting Qualities](https://developer.webex.com/docs/api/v1/meeting-qualities/get-meeting-qualities) | cisco:webex:meeting:qualities |
12+
| Webex Detailed Call History | [Detailed Call History](https://developer.webex.com/docs/api/v1/reports-detailed-call-history/get-detailed-call-history) | cisco:webex:call:detailed_history |
13+
| Webex Security Audit Events | [Security Audit Events](https://developer.webex.com/admin/docs/api/v1/security-audit-events/list-security-audit-events) | cisco:webex:security:audit:events |
1214

1315
## Getting Started
1416
### Installation Instructions
@@ -46,6 +48,7 @@ Please follow the following steps to create a dedicated Webex integration for th
4648
- `meeting:admin_config_read`
4749
- `spark-admin:people_read`
4850
- `analytics:read_all`
51+
- `spark-admin:calling_cdr_read`
4952

5053
3. Click **Add Integration** on the bottom of the page, your `Client ID` and `Client Secret` are ready to use.
5154

@@ -164,6 +167,57 @@ The input uses checkpointing to avoid ingesting duplicate data. After the initia
164167
- **End Time** (_optional_): End date and time in the format YYYY-MM-DDTHH:MM:SSZ.(Optional), `example:2023-02-01T00:00:00Z`. Leave it blank if an ongoing ingestion mode is needed.
165168
- Click on the `Add` green button on the bottom right of the pop-up box.
166169

170+
171+
**Webex Detailed Call History**
172+
173+
The **Webex Detailed Call History** input is used to fetch the data from [Webex Detailed Call History](https://developer.webex.com/docs/api/v1/reports-detailed-call-history/get-detailed-call-history) endpoint. It allows users to retrieve detailed data from calls. Only organization administrators can retrieve the data and it requires the administrator role "Webex Calling Detailed Call History API access" to be enabled.
174+
175+
The `Start Time` is required. Set the starting date and time to fetch the calls data. The Start time is inclusive and should be in the format YYYY-MM-DDTHH:MM:SSZ (example:2023-01-01T00:00:00Z). The Start Time **MUST** must be between 5 minutes ago and 48 hours ago, more than that is not possible.
176+
177+
The `End Time` is optional. If you set it to be a specific date, only data within the time range from Start time to End time will be ingested. The format should be YYYY-MM-DDTHH:MM:SSZ (example:2023-02-01T00:00:00Z). Leave it blank if an ongoing ingestion mode is needed. The End Time **MUST** be later than the Start Time but no later than 48 hours.
178+
179+
The `Locations` field is also optional. You can include up to 10 comma-separed locations, and each location name should the same as shown in the Control Hub.
180+
181+
The input uses checkpointing to avoid ingesting duplicate data. After the initial run, the script will save the latest call start time as the checkpoint, and will be used as the `Start Time` (advancing by one millisecond) for the next run.
182+
183+
- Click on the `Inputs` button on the top left corner.
184+
- Click on `Create New Input` button on the top right corner.
185+
- Enter the following details in the pop-up box:
186+
- **Name** (_required_): Unique name for the data input.
187+
- **Interval** (_required_): Time interval of input in seconds.
188+
- **Index** (_required_): Index for storing data.
189+
- **Global Account** (_required_): Select the account created during Configuration.
190+
- **Start Time** (_required_): Start date and time (inclusive) in the format YYYY-MM-DDTHH:MM:SSZ, `example:2023-01-01T00:00:00Z`. The Start Time **MUST** must be between 5 minutes ago and 48 hours ago.
191+
- **End Time** (_optional_): End date and time in the format YYYY-MM-DDTHH:MM:SSZ, `example:2023-02-01T00:00:00Z`. Leave it blank if an ongoing ingestion mode is needed. The End Time **MUST** be later than the Start Time but no later than 48 hours.
192+
- **Locations** (_optional_): Enter up to 10 locations separated by a comma.
193+
- Click on the `Add` green button on the bottom right of the pop-up box.
194+
195+
196+
**Webex Security Audit Events Input**
197+
198+
The **Webex Security Audit Events** input is used to fetch the data from [Security Audit Events](https://developer.webex.com/admin/docs/api/v1/security-audit-events/list-security-audit-events) endpoint. It allows users to retrieve user sign-in and sign-out data.
199+
200+
**Prerequisites**: This input is only available to customers with **Pro Pack** for Control Hub. To use this input, you must make sure you have **Pro Pack** for Webex Contol Hub, and then follow these two steps to enable this feature.
201+
1. Sign in to Control Hub, then under **Management** > **Organization Settings**.
202+
2. In the **User authentication data** section, toggle **Allow user authentication data** on.
203+
204+
The `Start Time` is required. Set the starting date and time to fetch admin audit events. The Start time is inclusive and should be in the format YYYY-MM-DDTHH:MM:SS.SSSZ (example:2023-01-01T00:00:00.000Z). If you leave the `End Time` blank, Start Time **MUST** be within one year from the current time.
205+
206+
The `End Time` is optional. If you set it to be a specific date, only logs within the time range from Start Date to End Date will be ingested. The format should be YYYY-MM-DDTHH:MM:SS.SSSZ (example:2023-02-01T00:00:00.000Z).
207+
208+
The input uses checkpointing to avoid ingesting duplicate data. After the initial run, the script will save the latest audit event created time as the checkpoint, and will be used as the `Start Time` (advancing by one millisecond) for the next run.
209+
210+
- Click on the `Inputs` button on the top left corner.
211+
- Click on `Create New Input` button on the top right corner.
212+
- Enter the following details in the pop-up box:
213+
- **Name** (_required_): Unique name for the data input.
214+
- **Interval** (_required_): Time interval of input in seconds.
215+
- **Index** (_required_): Index for storing data.
216+
- **Global Account** (_required_): Select the account created during Configuration.
217+
- **Start Time** (_required_): Start date and time (inclusive) in the format YYYY-MM-DDTHH:MM:SS.SSSZ, `example:2023-01-01T00:00:00.000Z`. If you leave the `End Time` blank, Start Time **MUST** be within one year from the current time.
218+
- **End Time** (_optional_): End date and time in the format YYYY-MM-DDTHH:MM:SS.SSSZ.(Optional), `example:2023-02-01T00:00:00.000Z`. End Time must be after the Start Time.
219+
- Click on the `Add` green button on the bottom right of the pop-up box.
220+
167221
## Versions Supported
168222

169223
- Tested for installation and basic ingestion on Splunk 9.X and 8.2 for **CentOS** system.

‎package/app.manifest‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
"id": {
66
"group": null,
77
"name": "ta_cisco_webex_add_on_for_splunk",
8-
"version": "1.0.11"
8+
"version": "1.1.0"
99
},
1010
"author": [
1111
{

0 commit comments

Comments
 (0)