API Key Based - Scan Log Export

Indusface WAS facilitates effortless transmission of scan logs to third-party applications like SIEM and 3rd party databases, allowing thorough analysis.

AppTrana WAS facilitates Scan Log configuration in two methods:

AWS Access ARN Based: This method allows customers to securely access scan logs by integrating Indusface AWS3 with their AWS S3 using Amazon Resource Name (ARN). Click here to get configuration details.

API Key Based: Alternatively, customers can opt for the API Key Based configuration. It offers simplicity and flexibility, eliminating the need for complex authentication like ARN.

API Key-Based Configuration

This method enables customers to retrieve scan logs by calling an API with key-based authentication, and the keys can be generated within the platform.

These keys serve as authentication credentials, enabling secure communication between Indusface WAS and the third-party platforms.

Follow these steps to create a set of API keys:

Navigate to Scan Log Config.

Click API Key Based.

Click on Generate Key.

Only the primary user has the authority to create the key, a measure taken for security purposes.

A prompt will appear requesting a name for the API key. Provide a name and click Generate.

A confirmation message will appear indicating the successful creation of the API key.

Upon successful generation, two keys will be provided: an Access Key and a Secret Key. Ensure to securely copy and store these keys.

There's a restriction of one key per account. If an additional key is needed, the existing one must be deleted before a new key can be generated.

For further information about the API, navigate to the "API Details" tab.

Customers will need to input the API key details (such as Access Key and Secret Key[GC1] ) into their tool settings to access logs from the Indusface S3 bucket.

Use case 1: Get Specific Date Logs

Purpose: To fetch the scan logs for a specific date.

Method: GET

URL: http://was.indusface.com/client/v1/fetch-s3-logs

Params:

date	Add date in the params section and add date value
Date format	Use the following date format to retrieve the logs: YYYY-MM-DD

Header parameters

Header Parameter	Description
accessKey	Use the Access Key value provided in the API Key Based table.
secretKey	Use the Secret Key value provided in the API Key Based table.

Possible Response 1: Logs fetched successfully for the requested date

{ 

  "status": "OK", 

  "result": { 

    "success": "Data fetched successfully.", 

    "data": [ 

      { 

        "ScanlogId": "12832867", 

        "ServicType": "AA", 

        "ServiceId": 78346, 

        "URL": "https://reports.example.com/as/aa/fail", 

        "ApplicationName": "", 

        "SealStatus": "PASS", 

        "TotalFoundVulnerabilities": 1, 

        "ScanStatus": "Scan Success Time Over", 

        "ScanDate": "2024-08-02", 

        "groups": [], 

        "Vulnerabilities": [ 

          { 

            "UniqueAlertId": 3332161, 

            "Title": "Insecure Content Security Policy (CSP)/X-Frame-Options", 

            "Severity": "Medium", 

            "CVSS_Score": "6.1", 

            "OpenStatus": "NEW", 

            "FoundOn": "https://reports.example.com/", 

            "FoundDate": "2024-08-02" 

          }, 

          { 

            "UniqueAlertId": 3332131, 

            "Title": "Possible Sensitive Directories/Files Detected", 

            "Severity": "Medium", 

            "CVSS_Score": "5.3", 

            "OpenStatus": "OPEN", 

            "FoundOn": "https://reports.example.com/web.config", 

            "FoundDate": "2024-08-02" 

          } 

        ] 

      } 

    ] 

  } 

}

Possible Response 2: Scan Error


{
    "status": "OK",
    "result": {
        "success": "Data fetched successfully.",
        "data": [
            {
                "ScanlogId": "12833389",
                "ServicType": "AA",
                "ServiceId": 77170,
                "URL": "http://reports.example.info",
                "ApplicationName": "Asset 001",
                "SealStatus": "FAIL",
                "TotalFoundVulnerabilities": 0,
                "ScanStatus": "Scan Error",
                "ScanDate": "2024-08-20",
                "groups": [
                    "AAR"
                ],
                "Vulnerabilities": []
            }
        ]
    }
}

Possible Response 3: No logs found for the requested date


{
    "status": "OK",
    "result": {
        "error": "No data logs found.",
        "data": []
    }
}

Use Case 2: Get Specific Date Range Logs