Security Analytics REST API template

[KeithDixon]

One interesting apsect of managing a Security Analytics instance I'm sure most of you all have shared the pain of is Windows event source management. And if any of you are like me, you have a level of impatience that is monumental. I tend to let my impatience feed into some innovation and innovation not shared is a waste.

Through the beauty of Excel concatentation formulas in the right spot, I give you my REST API template (v1).

Sheet details

Enter appropriate data here

• Column A - HTTP/HTTPS
  • Is your log collector using encryption or not?
• Column B - Log collector
  • Enter your log collector address or IP address here
• Column C - Event source category
  • Enter your event source category name here (If you don't have it handy.... just wait.... I got a column for that)
• Column D - Event source address
  • Enter the IP address of the desired server
• Column E
  • It's hidden.
  • Formula magic goes on here and it's not really needed to enter data (that comes from column D)

Get your formulated data here

• Column G - General event source category query
  • Once you have the above columns populated accordingly, this column will create the general query to get the event source categories
• Column H - Query if event source is there
  • This will tell you if the desired event source is there
• Column I - Delete event source
  • Just like it says
  • If the above values are correct, the result will show "Success"
  • If it's not correct, it could show a value like this:
    • caught exception while deleting windows type configuration: The node "x_x_x_x" is not a child of /logcollection/windows/eventsources/$event_source_category

Instructions

1. Authenticate to your log collector via REST API first
   1. Bash script - curl -k -u admin:$password "$value_from_formulated_data"
   2. Web browser - Open up tab to https://$log_collector_address:50101 and authenticate
      
2. Populate column A through D accordingly (if you don't know the value for column C, populate as much as possible and get the resulting value from column G and use that to start to form your query. Take that data and populate column C accordingly)
3. Copy the contents of column G into script or browser window to obtain your event source categories
4. Or, copy the contents of column H (query) or column I (delete) as needed

I do plan on sharing (once all is said and done) some Python scripts I've been working on to obtain desired data (logstats, Warehouse connector behind numbers all in one shot, decoder stats, Broker/Concentrators consumption status in one shot, etc)

Update

Due to some quick testing and formula sanitization from my original copy, there was a small typo in two formulas. v2 is working better. I even attached my query template.

Query template

1. Populate IP's in column A
2. Take the value generated in column E, paste into a notepad window trim away excess unneeded. (I've noticed you can query in Investigation a maximum 50 IP's in one big query)
   

[Anonymous]

Thanks for your work, but why not just click the export button?

[KeithDixon]

Well.......

My use case was as follows:

I have over 500 Windows servers configured in two seperate log collectors. There are times where Windows servers are getting decommissioned. Unless they're cleaned up from the log collector, it's just going to go into an eternal state of fail.

Since you can only see 50 per page and there is no search, sorting through 10 pages to find the specific IP adress to delete makes absolutely no sense to me.

Exporting the whole list just to edit one or two IP addresses out to reimport in doesn't make sense to me as well as there appears to be an initial discovery period once you've deleted all sources (at least in my environment) that collection doesn't happen for a time.

This sheet is an interim until I can get my super duper Python script created and tested properly.