BX Add-on for Adaptive Shield
Overview
Details
New Features:
Adaptive Shield API Integration:
This add-on provides seamless integration with the Adaptive Shield API to collect security data, account information, integrations, and alerts.
Users can configure the add-on with their API Key and Account ID to pull data from multiple endpoints, including:
https://api.adaptive-shield.com/api/v1/accounts
https://api.adaptive-shield.com/api/v1/accounts/{accountId}/integrations
https://api.adaptive-shield.com/api/v1/accounts/{accountId}/alerts
https://api.adaptive-shield.com/api/v1/accounts/{accountId}/security_checks
Pagination Handling:
The add-on now supports proper pagination for APIs that return results in pages, ensuring that all data is collected across multiple requests.
Custom Inputs:
The add-on offers multiple input types to fetch data from different API endpoints:
Accounts
Security Checks
Integrations
Alerts
Improvements:
Robust Error Handling:
Implemented retry logic to handle transient errors and API timeouts, ensuring smoother data collection without interruptions.
Optimized API Request Logic:
Improved request handling to allow users to pull large datasets using the limit and offset parameters for each request.
Users can configure limit and offset values in the data inputs for more controlled data retrieval.
Authorization with API Token:
The add-on uses the Authorization: Token {api_key} header format for secure access to the Adaptive Shield API.
Configuration:
Global Settings:
Users can configure the API Key and Account ID in the Splunk UI under the add-on’s global configuration page.
Splunk Props and Transforms:
Included props.conf and transforms.conf files to ensure proper field extractions and normalization of the API data.
Bug Fixes:
Fixed issues related to API pagination where only the first 100 results were being pulled.
Resolved authentication issues by correctly passing the API Key via the Authorization: Token {api_key} header.
Corrected data parsing errors for nested JSON structures by updating props.conf and transforms.conf to handle complex data models.
Compatibility:
Splunk onprem and cloud
Splunk Version: 8.x, 9.x
Adaptive Shield API: Compatible with Adaptive Shield API v1.0.0
Known Issues:
No known issues as of this release.
Note: This add-on is not mapped to CIM
Release Notes
Version 1.0.6
New Features:
Adaptive Shield API Integration:
This add-on provides seamless integration with the Adaptive Shield API to collect security data, account information, integrations, and alerts.
Users can configure the add-on with their API Key and Account ID to pull data from multiple endpoints, including:
https://api.adaptive-shield.com/api/v1/accounts
https://api.adaptive-shield.com/api/v1/accounts/{accountId}/integrations
https://api.adaptive-shield.com/api/v1/accounts/{accountId}/alerts
https://api.adaptive-shield.com/api/v1/accounts/{accountId}/security_checks
Pagination Handling:
The add-on now supports proper pagination for APIs that return results in pages, ensuring that all data is collected across multiple requests.
Custom Inputs:
The add-on offers multiple input types to fetch data from different API endpoints:
Accounts
Security Checks
Integrations
Alerts
Improvements:
Robust Error Handling:
Implemented retry logic to handle transient errors and API timeouts, ensuring smoother data collection without interruptions.
Optimized API Request Logic:
Improved request handling to allow users to pull large datasets using the limit and offset parameters for each request.
Users can configure limit and offset values in the data inputs for more controlled data retrieval.
Authorization with API Token:
The add-on uses the Authorization: Token {api_key} header format for secure access to the Adaptive Shield API.
Configuration:
Global Settings:
Users can configure the API Key and Account ID in the Splunk UI under the add-on’s global configuration page.
Splunk Props and Transforms:
Included props.conf and transforms.conf files to ensure proper field extractions and normalization of the API data.
Bug Fixes:
Fixed issues related to API pagination where only the first 100 results were being pulled.
Resolved authentication issues by correctly passing the API Key via the Authorization: Token {api_key} header.
Corrected data parsing errors for nested JSON structures by updating props.conf and transforms.conf to handle complex data models.
Compatibility:
Splunk onprem and cloud
Splunk Version: 8.x, 9.x
Adaptive Shield API: Compatible with Adaptive Shield API v1.0.0
Known Issues:
No known issues as of this release.
Note: This add-on is not mapped to CIM