Developers

Want to bring your existing Cribl configs into Terraform? This new workflow lets you export your current setup and turn it into reusable, version-controlled IaC. https://docs.cribl.io/cribl-as-code/terraform-migrate-resources/Highlights:• Export existing configs directly to Terraform• Make your Cribl environments repeatable and auditablePerfect for anyone looking to standardize and scale their deployments

Hey folks! I’ve been tinkering away and ended up building a couple of Ansible Collections for Cribl - mostly focused on Stream and Edge. Since everything is generated from the OpenAPI spec, you’ll also find modules for Lake and Search in there. Those aren’t fully battle-tested yet, but they’re along for the ride. The collections include both declarative/idempotent modules and more imperative ones, depending on how hands-on you want to be. They also support both on-prem username/password auth and client-ID/secret for Cribl Cloud. If you want to poke around, try things out, or throw tomatoes at my code, the repo’s here:AlexAsplund/ansible-collections-criblCurious to hear what people think or how you might want to use it next.

Has anyone been able to Ingest Proofpoint CASB and TAP ATO (Account Takeover) logs into Stream? I do not see a collector available for these. Proofpoint sent me some API specs for their endpoint but I’m stuck.Proofpoint CASB and TAP ATOAPI GuideVersion 4.04(US)December 2023This document describes the API methods provided by the Proofpoint CASB platform for retrieving various data entities. The guide includes details on how to use the Proofpoint CASB APIs to retrieve system events and their corresponding alerts.https://proofpoint.my.salesforce.com/sfc/p/#3000000006Bs/a/Uy000000gPbV/QnJwgeOF_q4XsxQYmHUkAl_HzPSl08BxnGpQsEVVS8o

I am running Cribl version 4.12 and I am trying to collect Qualys detection logs using “qualys-detections” script by Jon Rust but it does not seems to be working.My Qualys login is working on EU1 platform "https://qualysapi.qualys.eu", the required python3 and env are set Here is the “qualys-detections” script --------------------------------------------------------------------------------------------- #!/usr/bin/python3import sysimport requestsimport reimport osfrom pprint import pprintfrom time import timefrom datetime import datetimedebug = Trueaction = ''APIURL = "https://qualysapi.qualys.eu"try:    API_USER = os.environ['CRIBL_username']    API_PWD = os.environ['CRIBL_password']    EARLIEST = os.environ['CRIBL_earliest']    MAX_RUN_COUNT = int(os.environ['CRIBL_max'])except:    print("CRIBL_username, CRIBL_password, CRIBL_max and CRIBL_earliest must be defined environment vars")    sys.exit(1)################################# if the collect arg var exists, we already disco'dif 'CR

cisco_asa_cleanup pack is not working for me, now sure how to make it work , need help in utilizing it, sample logsOct 1 03:23:58 asa_server_ip %ASA-6-302014: Teardown TCP connection 39876417 for VTI-Murex-abc:xx.xx.xx.xx/443 to inside:xx.xx.xx.xx/44714 duration 0:00:00 bytes 9514 TCP FINs from inside 0 0Oct 2 06:51:58 asa_server_ip %ASA-6-302013: Built inbound TCP connection 39876427 for VTI-Murex-abc:xx.xx.xx.xx/34664 (x.x.x.x/34664) to inside:xx.xx.xx.xx/443 (x.x.x.x/443) -1 -1Oct 3 04:54:58 xx.xx.xx.xx %ASA-6-302013: Built outbound TCP connection 39876426 for VTI-Murex-abc:x.x.x.x/443 (xx.xx.xx.xx443) to inside:x.x.x.x./14326 (xx.xxx.xx.xx/14326) 1 5Oct 5 01:54:58 xx.xx.xx.xx %ASA-6-302020: Built inbound ICMP connection for faddr xx.xx.xx.xx/54615 gaddr x.x.x.x/0 laddr x.xx.x.xx/0 type 8 code 0 Internal-Data0/-1:RX[-1]Oct 15 07:54:58 xx.xx.xx.xx%ASA-6-106015: Deny TCP (no connection) from x.x.x.x/38492 to xxx.xx.xx.x/6425 flags ACK  on interface VTI-Murex-abc  

Previews of our new Terraform provider and SDKs are ready for you to explore!Check out the details on the Cribl as Code page.Kick the tires and tell us what you think!

Clone the repository here:https://github.com/criblio/terraform-provider-criblioAnyone using it yet?  Let us know how it’s going. 

How can I get a list of users that includes their sso/mfa status?

How can I use a Cribl endpoint to retrieve a list of API Credentials created? I’m looking for a programmatic way to do this, not looking at a list via the interface. /system/secrets and /system/keys don’t seem to be the right endpoints. 

Hi,I'm working on code that uses an API key to access my data in Cribl. I started by creating API credentials (client_id and client_secret) and built a simple script to obtain an access token, which I plan to use for querying logs.Here’s the code I wrote:import requestsclient_id = 'XXX'client_secret = 'XXX'auth_url = 'https://XXX.cribl.cloud/api/v1/auth/token'payload = {'grant_type': 'client_credentials','client_id': client_id,'client_secret': client_secret,'audience': 'https://api.cribl.cloud'}headers = {'Content-Type': 'application/json'}response = requests.post(auth_url, data=payload, headers=headers)When I run this, I receive a 200 response, but the content is not in JSON format. Instead, the content is:you need to enable JavaScript to run this app.It seems to be returning the web application HTML rather than a JSON response with an access token. My goal is to use this token in a query to fetch logs.Could you please help me understand why the token request is returning HTML instead

Are you ready to publish a Pack? Check out the recently updated publication standards to make sure everything goes smooth and easy. 

The team at  CINQ has open-sourced their new utility tool:More details

Hey allI am using a REST API to collect logs using GCP OAuth token. As the authorization token expires every hour, is there any way I can automate refreshing the access tokens in Cribl

Hello,Is is possible to import a packs directly from my own git via rest api? I want to automate it. Documentation examples is only for .cribl format https://docs.cribl.io/stream/packs#install-via-api

Hello everyone,I’m looking for more Packs to work with into Cribl stream.I know the Pack Dispencary and Packs from Github. Are there more usefull sites to look through?Or are any more Packs planned for e.x. reducing logs for Checkpoint.Thank you and best regards