APIs

Has anyone been able to Ingest Proofpoint CASB and TAP ATO (Account Takeover) logs into Stream? I do not see a collector available for these. Proofpoint sent me some API specs for their endpoint but I’m stuck.Proofpoint CASB and TAP ATOAPI GuideVersion 4.04(US)December 2023This document describes the API methods provided by the Proofpoint CASB platform for retrieving various data entities. The guide includes details on how to use the Proofpoint CASB APIs to retrieve system events and their corresponding alerts.https://proofpoint.my.salesforce.com/sfc/p/#3000000006Bs/a/Uy000000gPbV/QnJwgeOF_q4XsxQYmHUkAl_HzPSl08BxnGpQsEVVS8o

How can I get a list of users that includes their sso/mfa status?

How can I use a Cribl endpoint to retrieve a list of API Credentials created? I’m looking for a programmatic way to do this, not looking at a list via the interface. /system/secrets and /system/keys don’t seem to be the right endpoints. 

Hi,I'm working on code that uses an API key to access my data in Cribl. I started by creating API credentials (client_id and client_secret) and built a simple script to obtain an access token, which I plan to use for querying logs.Here’s the code I wrote:import requestsclient_id = 'XXX'client_secret = 'XXX'auth_url = 'https://XXX.cribl.cloud/api/v1/auth/token'payload = {'grant_type': 'client_credentials','client_id': client_id,'client_secret': client_secret,'audience': 'https://api.cribl.cloud'}headers = {'Content-Type': 'application/json'}response = requests.post(auth_url, data=payload, headers=headers)When I run this, I receive a 200 response, but the content is not in JSON format. Instead, the content is:you need to enable JavaScript to run this app.It seems to be returning the web application HTML rather than a JSON response with an access token. My goal is to use this token in a query to fetch logs.Could you please help me understand why the token request is returning HTML instead

Hey allI am using a REST API to collect logs using GCP OAuth token. As the authorization token expires every hour, is there any way I can automate refreshing the access tokens in Cribl