Table of Contents

How to Connect Your SIEM to AppTrana

Author Updated by Author

This document will provide information about how to use Indusface SIEM service.

To enable our SIEM service, please contact Support.

Connector Registration

To use SIEM service, customer must register to the connector in Apptrana portal.

Click User Profile drop-down and click Manage API Key option.

Click here for more steps on connector registration.

After successful registration of the connector, copy API Id, Key and Redirection URL from the portal.

Authorization Code

Client must get authorisation code to get the access token.

Follow these details to get authorisation code:

Endpoint : https://tas.indusface.com/wafportal/rest/siem/v1/authorize

Method: GET

Header: "Content-Type":"application/json"

Query param: client_id (use API ID from Apptrana portal)

Authorisation code will be sent back in the query string of the pre-configured redirection URL.

Generate Token

To access SIEM API, client must get authenticated through clientKey, clientSecret and authorisation code(use copied API ID and Key generated at portal).

On successful authentication, sever will issue access token which is valid for 24 hours. Client must use this token for subsequent request.

The API details for the same are:

Endpoint: https://tas.indusface.com/wafportal/rest/siem/v1/getAuthToken

Method: POST

Header: “Content-Type”:” application/x-www-form-urlencoded”

Authentication: Client Id, Client secret and authorisation code should be passed in body( parameter name should be client_id,client_secret and code).

Success Response:

Status Code: 200

{"access_token":"{token}","token_type":"Bearer","expires_in":86400}

Error Response:

Status Code: 401 Unauthorised

{"errorMessages":["Unauthorised"]}

Get Attack Details

Client can retrieve attack details from the time SIEM service is enabled in portal and details are available up to 30 days. The following parameters are supported.

Time range:  This is a mandatory field. Specify startTime and endTime in milliseconds (UTC) and maximum time range allowed is 5 mins.

eventType: It is either Log or Block. When not specified, it will respond to both Log and Block.

access_token: It is mandatory while requesting and should be passed in Authorisation header.

websiteName: Name of the website for which details should be retrieved. If website is not specified, API will respond with all the websites. It is recommended to specify the website name.

API details for the same are as follows:

Endpoint: https://tas.indusface.com/wafportal/rest/siem/v1/getAttackInfo

Header: "Content-Type":"application/json" and "Authorisation" : " Bearer {access_token}"

Request Body without website:

{

"startTime":"1547190000000",

"endTime":"1547186100000",

"websiteName":"www.abc.com"

}

Success Response:

Status Code: 200

{

   "successMessage":"Success",

   "data":[

      {

         "websiteName":" www.abc.com ",

         "attacks":[

            {

               "attackerIP":"52.66.186.232",

               "attackerGeo":"IN",

               "severity":2,

               "eventType":"Log",

               "attackTime":"2019-01-11T05:54:02.091Z",

               "attackUri":"/rm/email/send",

               "target":null,

               "attackData":"curl/7.29.0",

               "ipReputation":"UNK",

               "category":"Bot Attacks",

               "ruleId":"40",

               "requestId":"XDgvJ11cQNtD@oi4vIg3fwAACDg",

               "ruleName":"Request Indicates an automated program explored the site",

               "tagName":"WEB_ATTACK/AUTOMATION/SECURITY_SCANNER",

               "hostName":" www.abc.com ",

               "statusCode":200,

               "requestHeader":"\"Host\":\" www.abc.com \" , \"User-Agent\":\"curl/7.29.0\",\"Accept\":\"*/*\",\"Accept-Language\":\"-\",\"Accept-Encoding\":\"-\",\"Connection\":\"-\",\"Cookie\":\"-\"",

               "responseHeader":"\"Cache-Control\":\"-\",\"Connection\":\"-\",\"Content-Type\":\"-\",\"Content-Length\":\"0\",\"Date\":\"-\",\"Keep-Alive\":\"-\",\"Server\":\"-\"",

               "tlsVersion":"TLSv1.2",

               "requestProtocol":"HTTP/1.1"

            }

         ]

      }

   ]

} 

Sample Curl request

curl --header "Content-Type: application/json" --header "Authorisation: Bearer {access_token}"  --request POST --data "{ \"startTime\":\"1547185800000\",\"endTime\":\"1547186100000\"}" https://tas.indusface.com/wafportal/rest/siem/v1/getAttackInfo

Error Response

Status code: 400 on bad request

Status code: 401 on unauthorised access

Status code: 500 on server error

How did we do?

Detect

Indusface Partner APIs

Contact

This site is protected by hCaptcha and its Privacy Policy and Terms of Service apply.