Cribl
Cribl is an observability pipeline platform that optimizes data routing and processing across diverse environments.
Cribl is a powerful observability pipeline that enables users to collect, reduce, and route data from any source to any destination. The Cribl connector for Swimlane Turbine allows users to seamlessly integrate Cribl's capabilities into their security automation workflows. With this integration, users can efficiently manage datasets, logs, notifications, and more, enhancing their ability to analyze and respond to security events. The connector empowers Swimlane Turbine end-users to automate data retrieval and processing tasks, streamlining security operations and improving response times.
Prerequisites
Before you can use the Cribl connector for Turbine, you'll need access to the Cribl API. This requires the following:
- OAuth 2.0 Client Credentials authentication using the following parameters:
- URL: The endpoint for accessing Cribl Cloud services.
- Client ID: The unique identifier for your application.
- Client Secret: The secret key associated with your client ID.
- Token URL: The URL used to obtain the OAuth token.
- Audience: The intended audience for the token.
- HTTP Basic authentication using the following parameters:
- URL: The endpoint for accessing Cribl OnPrem services.
- Username: Your Cribl OnPrem account username.
- Password: Your Cribl OnPrem account password.
Asset Setup
This Connector supports the below authentication options:
- OAuth2 Client Credentials Authentication for Cribl Cloud. To set up the asset, you need the following inputs:
- URL
- Client ID
- Client Secret
- Audience
- Token URL
- OAuth2 Password Authentication for Cribl OnPrem. If you're using SSO/OpenID Connect Authentication, you must toggle Allow local auth on, because you'll need to be a Local user when you authenticate via the API. To set up the asset, you need the following inputs:
- URL
- Username
- Password
Capabilities
This Connector provides the following capabilities:
- Evaluate Expression
- Get Dataset By ID
- Get Datasets
- Get Job Result
- Get Log By ID
- Get Logs
- Get Lookup File By ID
- Get Lookups
- Get Message By ID
- Get Messages
- Get Notification By ID
- Get Notification Targets
- Get Processes
- Get Role By ID
- Get Roles ... and so on
API Documentation Link
Additional Documentation
Configurations
HTTP Basic Authentication
Authenticates Cribl OnPrem using username and password.
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
username | Username | string | Required |
password | Password | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Oauth 2.0 Client Credentials
Authenticates Cribl Cloud using oauth 2.0 client credentials
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
token_url | ο»Ώ | string | Required |
client_id | The client ID | string | Required |
client_secret | The client secret. | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
audience | Audience | string | Required |
Actions
Evaluate Expression
Return a list of ExprLibEntry objects in Cribl for evaluating expressions.
Endpoint
- URL: /lib/expression
- Method: POST
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
items | array | Output field: items |
items.context | object | Output field: items.context |
items.context.additionalProp1 | object | Output field: items.context.additionalProp1 |
items.evalType | string | Type of the resource |
items.expr | string | Output field: items.expr |
items.id | string | Unique identifier |
items.pack | string | Output field: items.pack |
items.result | object | Result of the operation |
items.result.additionalProp1 | object | Result of the operation |
items.unprotected | boolean | Output field: items.unprotected |
Output Example
{"count":123,"items":[{"context":{},"evalType":"string","expr":"string","id":"12345678-1234-1234-1234-123456789abc","pack":"string","result":{},"unprotected":true}]}
Get Dataset By ID
Retrieve a dataset from Cribl using its unique ID provided as a path parameter.
Endpoint
- URL: /search/datasets/{{id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Unique ID |
Input Example
{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
items | array | Output field: items |
Output Example
{"count":123,"items":["string"]}
Get Datasets
Get a list of Dataset objects from Cribl for further analysis and processing.
Endpoint
- URL: /search/datasets
- Method: GET
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
items | array | Output field: items |
Output Example
{"count":123,"items":["string"]}
Get Job Result
Get results for a discover job in Cribl using the instance ID as a path parameter.
Endpoint
- URL: /jobs/{{id}}/results
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Job instance id |
Input Example
{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
string | string | Output field: string |
Output Example
{"string":"string"}
Get Log By ID
Get the contents of a log file in Cribl using the specified ID as a path parameter.
Endpoint
- URL: /system/logs/{{id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Log ID |
parameters.limit | number | Optional | Maximum number of log lines to retrieve starting from offset. |
parameters.endOffset | number | Optional | In the current log file to fetch the log events upto. |
parameters.et | number | Optional | Epoch timestamp of the earliest event (includes rolled files present on disk) |
parameters.lt | number | Optional | Epoch timestamp of the latest event (includes rolled files present on disk) |
parameters.filter | string | Optional | Filter |
Input Example
{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"parameters":{"limit":123,"endOffset":123,"et":123,"lt":123,"filter":"string"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
items | array | Output field: items |
items.additionalProp1 | object | Output field: items.additionalProp1 |
Output Example
{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}
Get Logs
Get a list of log files from Cribl for analysis and monitoring.
Endpoint
- URL: /system/logs
- Method: GET
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
items | array | Output field: items |
items.id | string | Unique identifier |
items.path | string | Output field: items.path |
Output Example
{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}
Get Lookup File By ID
Retrieve a lookup file from Cribl using its unique ID provided as a path parameter.
Endpoint
- URL: /system/lookups/{{id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Unique ID |
Input Example
{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
items | array | Output field: items |
items.fileInfo | object | Output field: items.fileInfo |
items.fileInfo.filename | string | Name of the resource |
items.id | string | Unique identifier |
items.description | string | Output field: items.description |
items.tags | string | Output field: items.tags |
items.size | number | Output field: items.size |
items.content | string | Response content |
Output Example
{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{},{}]}}
Get Lookups
Get a list of LookupFile objects from Cribl for further analysis and processing.
Endpoint
- URL: /system/lookups
- Method: GET
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
items | array | Output field: items |
items.fileInfo | object | Output field: items.fileInfo |
items.fileInfo.filename | string | Name of the resource |
items.id | string | Unique identifier |
items.description | string | Output field: items.description |
items.tags | string | Output field: items.tags |
items.size | number | Output field: items.size |
items.content | string | Response content |
Output Example
{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{},{}]}}
Get Message By ID
Retrieve a BulletinMessage from Cribl using the specified ID as a path parameter.
Endpoint
- URL: /system/message/{{id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Unique ID |
Input Example
{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
items | array | Output field: items |
items.id | string | Unique identifier |
items.severity | string | Output field: items.severity |
items.title | string | Output field: items.title |
items.text | string | Output field: items.text |
items.time | number | Time value |
items.group | string | Output field: items.group |
items.metadata | array | Response data |
Output Example
{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}
Get Messages
Get a list of BulletinMessage objects from Cribl.
Endpoint
- URL: /system/messages
- Method: GET
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
items | array | Output field: items |
items.id | string | Unique identifier |
items.severity | string | Output field: items.severity |
items.title | string | Output field: items.title |
items.text | string | Output field: items.text |
items.time | number | Time value |
items.group | string | Output field: items.group |
items.metadata | array | Response data |
Output Example
{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}
Get Notification By ID
Retrieve a notification target in Cribl by specifying the unique ID as a path parameter.
Endpoint
- URL: /notification-targets/{{id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Unique ID |
Input Example
{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
items | array | Output field: items |
items.id | string | Unique identifier |
items.type | string | Type of the resource |
items.systemFields | array | Output field: items.systemFields |
Output Example
{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}
Get Notification Targets
Get a list of NotificationTarget objects in Cribl to manage and configure notification endpoints effectively.
Endpoint
- URL: /notification-targets
- Method: GET
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
items | array | Output field: items |
items.id | string | Unique identifier |
items.type | string | Type of the resource |
items.systemFields | array | Output field: items.systemFields |
Output Example
{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}
Get Processes
Get a list of processes under management in Cribl.
Endpoint
- URL: /system/processes
- Method: GET
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
items | array | Output field: items |
items.env | object | Output field: items.env |
items.env.additionalProp1 | object | Output field: items.env.additionalProp1 |
items.id | string | Unique identifier |
items.pid | number | Unique identifier |
items.restartOnExit | boolean | Output field: items.restartOnExit |
items.restarts | number | Output field: items.restarts |
items.startTime | number | Time value |
items.type | string | Type of the resource |
Output Example
{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}
Get Role By ID
Retrieve a specific role in Cribl using the role ID as a path parameter.
Endpoint
- URL: /system/roles/{{id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Unique ID |
Input Example
{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
items | array | Output field: items |
items.description | string | Output field: items.description |
items.id | string | Unique identifier |
items.policy | array | Output field: items.policy |
items.tags | array | Output field: items.tags |
items.title | string | Output field: items.title |
Output Example
{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}
Get Roles
Get a list of Role objects in Cribl to manage user permissions and access levels.
Endpoint
- URL: /system/roles
- Method: GET
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
items | array | Output field: items |
items.description | string | Output field: items.description |
items.id | string | Unique identifier |
items.policy | array | Output field: items.policy |
items.tags | array | Output field: items.tags |
items.title | string | Output field: items.title |
Output Example
{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}
Get Sample By ID
Retrieve a data sample from Cribl using the specified ID as a path parameter.
Endpoint
- URL: /system/samples/{{id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Unique ID |
Input Example
{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
items | array | Output field: items |
items.id | string | Unique identifier |
items.sampleName | string | Name of the resource |
items.pipelineId | string | Unique identifier |
items.description | string | Output field: items.description |
items.ttl | number | Output field: items.ttl |
items.tags | string | Output field: items.tags |
items.additionalProp1 | object | Output field: items.additionalProp1 |
Output Example
{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}
Get Samples
Get a list of DataSample objects from Cribl for analysis and processing.
Endpoint
- URL: /system/samples
- Method: GET
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
items | array | Output field: items |
items.sampleName | string | Name of the resource |
items.created | number | Output field: items.created |
items.isTemplate | boolean | Output field: items.isTemplate |
items.size | number | Output field: items.size |
items.numEvents | number | Output field: items.numEvents |
items.id | string | Unique identifier |
items.modified | number | Output field: items.modified |
items.tsTemplateField | string | Output field: items.tsTemplateField |
count | number | Count value |
Output Example
{"status_code":200,"response_headers":{"Strict-Transport-Security":"max-age=31536000; includeSubDomains","x-cribl-api-cache-control":"max-age=300","content-type":"application/json; charset=utf-8","content-length":"3401","date":"Thu, 19 Oct 2023 11:12:35 GMT","connection":"keep-alive","keep-alive":"timeout=5"},"reason":"OK","json_body":{"items":[{"sampleName":"weblog.log","created":1574797148907,"isTemplate":true,"size":44018,"numEvents":100,"id":"weblog","modified":1697029993349},{"sampleName":"...
Get Saved Job By ID
Retrieve a saved job from Cribl using its unique ID provided as a path parameter.
Endpoint
- URL: /lib/jobs/{{id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Unique ID |
Input Example
{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
items | array | Output field: items |
items.id | string | Unique identifier |
items.type | string | Type of the resource |
items.ttl | string | Output field: items.ttl |
items.removeFields | array | Output field: items.removeFields |
items.resumeOnBoot | boolean | Output field: items.resumeOnBoot |
items.environment | string | Output field: items.environment |
items.schedule | object | Output field: items.schedule |
items.schedule.enabled | boolean | Output field: items.schedule.enabled |
items.schedule.cronSchedule | string | Output field: items.schedule.cronSchedule |
items.schedule.maxConcurrentRuns | number | Output field: items.schedule.maxConcurrentRuns |
items.schedule.skippable | boolean | Output field: items.schedule.skippable |
items.schedule.resumeMissed | string | Output field: items.schedule.resumeMissed |
items.schedule.run | object | Output field: items.schedule.run |
items.streamtags | array | Output field: items.streamtags |
items.workerAffinity | boolean | Output field: items.workerAffinity |
items.collector | object | Output field: items.collector |
items.collector.type | string | Type of the resource |
items.collector.conf | object | Output field: items.collector.conf |
items.collector.destructive | boolean | Output field: items.collector.destructive |
items.input | object | Input data for the action |
items.input.type | string | Input data for the action |
Output Example
{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}
Get Saved Jobs
Get a list of SavedJob objects in Cribl.
Endpoint
- URL: /lib/jobs
- Method: GET
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
items | array | Output field: items |
items.id | string | Unique identifier |
items.type | string | Type of the resource |
items.ttl | string | Output field: items.ttl |
items.removeFields | array | Output field: items.removeFields |
items.resumeOnBoot | boolean | Output field: items.resumeOnBoot |
items.environment | string | Output field: items.environment |
items.schedule | object | Output field: items.schedule |
items.schedule.enabled | boolean | Output field: items.schedule.enabled |
items.schedule.cronSchedule | string | Output field: items.schedule.cronSchedule |
items.schedule.maxConcurrentRuns | number | Output field: items.schedule.maxConcurrentRuns |
items.schedule.skippable | boolean | Output field: items.schedule.skippable |
items.schedule.resumeMissed | string | Output field: items.schedule.resumeMissed |
items.schedule.run | object | Output field: items.schedule.run |
items.streamtags | array | Output field: items.streamtags |
items.workerAffinity | boolean | Output field: items.workerAffinity |
items.collector | object | Output field: items.collector |
items.collector.type | string | Type of the resource |
items.collector.conf | object | Output field: items.collector.conf |
items.collector.destructive | boolean | Output field: items.collector.destructive |
items.input | object | Input data for the action |
items.input.type | string | Input data for the action |
Output Example
{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}
Get Saved Queries
Get a list of SavedQuery objects from Cribl for further analysis and processing.
Endpoint
- URL: /search/saved
- Method: GET
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
items | array | Output field: items |
items.chartConfig | object | Output field: items.chartConfig |
items.chartConfig.axis | object | Output field: items.chartConfig.axis |
items.chartConfig.axis.xAxis | string | Output field: items.chartConfig.axis.xAxis |
items.chartConfig.axis.yAxis | array | Output field: items.chartConfig.axis.yAxis |
items.chartConfig.color | string | Output field: items.chartConfig.color |
items.chartConfig.colorPalette | number | Output field: items.chartConfig.colorPalette |
items.chartConfig.colorPaletteReversed | boolean | Output field: items.chartConfig.colorPaletteReversed |
items.chartConfig.data | object | Response data |
items.chartConfig.data.connectNulls | string | Response data |
items.chartConfig.data.stack | boolean | Response data |
items.chartConfig.decimals | number | Output field: items.chartConfig.decimals |
items.chartConfig.label | string | Output field: items.chartConfig.label |
items.chartConfig.legend | object | Output field: items.chartConfig.legend |
items.chartConfig.legend.position | string | Output field: items.chartConfig.legend.position |
items.chartConfig.legend.truncate | boolean | Output field: items.chartConfig.legend.truncate |
items.chartConfig.prefix | string | Output field: items.chartConfig.prefix |
items.chartConfig.series | array | Output field: items.chartConfig.series |
items.chartConfig.series.color | string | Output field: items.chartConfig.series.color |
items.chartConfig.series.name | string | Name of the resource |
items.chartConfig.series.type | object | Type of the resource |
items.chartConfig.series.yAxisField | string | Output field: items.chartConfig.series.yAxisField |
Output Example
{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}
Get Saved Query By ID
Retrieve a saved query from Cribl using the specified ID as a path parameter.
Endpoint
- URL: /search/saved/{{id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Unique ID |
Input Example
{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
items | array | Output field: items |
items.chartConfig | object | Output field: items.chartConfig |
items.chartConfig.axis | object | Output field: items.chartConfig.axis |
items.chartConfig.axis.xAxis | string | Output field: items.chartConfig.axis.xAxis |
items.chartConfig.axis.yAxis | array | Output field: items.chartConfig.axis.yAxis |
items.chartConfig.color | string | Output field: items.chartConfig.color |
items.chartConfig.colorPalette | number | Output field: items.chartConfig.colorPalette |
items.chartConfig.colorPaletteReversed | boolean | Output field: items.chartConfig.colorPaletteReversed |
items.chartConfig.data | object | Response data |
items.chartConfig.data.connectNulls | string | Response data |
items.chartConfig.data.stack | boolean | Response data |
items.chartConfig.decimals | number | Output field: items.chartConfig.decimals |
items.chartConfig.label | string | Output field: items.chartConfig.label |
items.chartConfig.legend | object | Output field: items.chartConfig.legend |
items.chartConfig.legend.position | string | Output field: items.chartConfig.legend.position |
items.chartConfig.legend.truncate | boolean | Output field: items.chartConfig.legend.truncate |
items.chartConfig.prefix | string | Output field: items.chartConfig.prefix |
items.chartConfig.series | array | Output field: items.chartConfig.series |
items.chartConfig.series.color | string | Output field: items.chartConfig.series.color |
items.chartConfig.series.name | string | Name of the resource |
items.chartConfig.series.type | object | Type of the resource |
items.chartConfig.series.yAxisField | string | Output field: items.chartConfig.series.yAxisField |
Output Example
{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}
Get Search Job By ID
Retrieve a specific search job in Cribl using its unique ID provided as a path parameter.
Endpoint
- URL: /search/jobs/{{id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Unique ID |
Input Example
{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
items | array | Output field: items |
items.chartConfig | object | Output field: items.chartConfig |
items.chartConfig.axis | object | Output field: items.chartConfig.axis |
items.chartConfig.axis.xAxis | string | Output field: items.chartConfig.axis.xAxis |
items.chartConfig.axis.yAxis | array | Output field: items.chartConfig.axis.yAxis |
items.chartConfig.color | string | Output field: items.chartConfig.color |
items.chartConfig.colorPalette | number | Output field: items.chartConfig.colorPalette |
items.chartConfig.colorPaletteReversed | boolean | Output field: items.chartConfig.colorPaletteReversed |
items.chartConfig.data | object | Response data |
items.chartConfig.data.connectNulls | string | Response data |
items.chartConfig.data.stack | boolean | Response data |
items.chartConfig.decimals | number | Output field: items.chartConfig.decimals |
items.chartConfig.label | string | Output field: items.chartConfig.label |
items.chartConfig.legend | object | Output field: items.chartConfig.legend |
items.chartConfig.legend.position | string | Output field: items.chartConfig.legend.position |
items.chartConfig.legend.truncate | boolean | Output field: items.chartConfig.legend.truncate |
items.chartConfig.prefix | string | Output field: items.chartConfig.prefix |
items.chartConfig.series | array | Output field: items.chartConfig.series |
items.chartConfig.series.color | string | Output field: items.chartConfig.series.color |
items.chartConfig.series.name | string | Name of the resource |
items.chartConfig.series.type | object | Type of the resource |
items.chartConfig.series.yAxisField | string | Output field: items.chartConfig.series.yAxisField |
Output Example
{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}
Get Search Jobs
Get a list of SearchJob objects from Cribl to review and manage ongoing search operations.
Endpoint
- URL: /search/jobs
- Method: GET
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
items | array | Output field: items |
items.chartConfig | object | Output field: items.chartConfig |
items.chartConfig.axis | object | Output field: items.chartConfig.axis |
items.chartConfig.axis.xAxis | string | Output field: items.chartConfig.axis.xAxis |
items.chartConfig.axis.yAxis | array | Output field: items.chartConfig.axis.yAxis |
items.chartConfig.color | string | Output field: items.chartConfig.color |
items.chartConfig.colorPalette | number | Output field: items.chartConfig.colorPalette |
items.chartConfig.colorPaletteReversed | boolean | Output field: items.chartConfig.colorPaletteReversed |
items.chartConfig.data | object | Response data |
items.chartConfig.data.connectNulls | string | Response data |
items.chartConfig.data.stack | boolean | Response data |
items.chartConfig.decimals | number | Output field: items.chartConfig.decimals |
items.chartConfig.label | string | Output field: items.chartConfig.label |
items.chartConfig.legend | object | Output field: items.chartConfig.legend |
items.chartConfig.legend.position | string | Output field: items.chartConfig.legend.position |
items.chartConfig.legend.truncate | boolean | Output field: items.chartConfig.legend.truncate |
items.chartConfig.prefix | string | Output field: items.chartConfig.prefix |
items.chartConfig.series | array | Output field: items.chartConfig.series |
items.chartConfig.series.color | string | Output field: items.chartConfig.series.color |
items.chartConfig.series.name | string | Name of the resource |
items.chartConfig.series.type | object | Type of the resource |
items.chartConfig.series.yAxisField | string | Output field: items.chartConfig.series.yAxisField |
Output Example
{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}
Get Secret By ID
Retrieve a RestSecret from Cribl using the specified ID as a path parameter.
Endpoint
- URL: /system/secrets/{{id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Unique ID |
Input Example
{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
items | array | Output field: items |
items.apiKey | string | Output field: items.apiKey |
items.description | string | Output field: items.description |
items.id | string | Unique identifier |
items.password | string | Output field: items.password |
items.secretKey | string | Output field: items.secretKey |
items.secretType | string | Type of the resource |
items.tags | string | Output field: items.tags |
items.username | string | Name of the resource |
items.value | string | Value for the parameter |
Output Example
{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}
Get Secrets
Get a list of RestSecret objects from Cribl for secure data handling and management.
Endpoint
- URL: /system/secrets
- Method: GET
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
items | array | Output field: items |
items.apiKey | string | Output field: items.apiKey |
items.description | string | Output field: items.description |
items.id | string | Unique identifier |
items.password | string | Output field: items.password |
items.secretKey | string | Output field: items.secretKey |
items.secretType | string | Type of the resource |
items.tags | string | Output field: items.tags |
items.username | string | Name of the resource |
items.value | string | Value for the parameter |
Output Example
{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}
Get User By ID
Retrieve user details from Cribl using a unique user ID as a path parameter.
Endpoint
- URL: /system/users/{{id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Unique ID |
Input Example
{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
items | array | Output field: items |
items.currentPassword | string | Output field: items.currentPassword |
items.disabled | boolean | Output field: items.disabled |
items.email | string | Output field: items.email |
items.first | string | Output field: items.first |
items.id | string | Unique identifier |
items.last | string | Output field: items.last |
items.password | string | Output field: items.password |
items.roles | array | Output field: items.roles |
items.username | string | Name of the resource |
Output Example
{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}
Get Users
Get a list of User objects from Cribl.
Endpoint
- URL: /system/users
- Method: GET
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
count | number | Count value |
items | array | Output field: items |
items.currentPassword | string | Output field: items.currentPassword |
items.disabled | boolean | Output field: items.disabled |
items.email | string | Output field: items.email |
items.first | string | Output field: items.first |
items.id | string | Unique identifier |
items.last | string | Output field: items.last |
items.password | string | Output field: items.password |
items.roles | array | Output field: items.roles |
items.username | string | Name of the resource |
Output Example
{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}
Response Headers
Header | Description | Example |
|---|---|---|
Cache-Control | Directives for caching mechanisms | no-cache, no-store, private, max-age=0, must-revalidate |
connection | HTTP response header: connection | keep-alive |
content-length | The length of the response body in bytes | 3401 |
Content-Type | The media type of the resource | application/json;charset=UTF-8 |
date | The date and time at which the message was originated | Thu, 19 Oct 2023 11:12:35 GMT |
keep-alive | HTTP response header: keep-alive | timeout=5 |
Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=31536000 |
Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked |
X-Content-Type-Options | HTTP response header: X-Content-Type-Options | nosniff |
x-cribl-api-cache-control | HTTP response header: x-cribl-api-cache-control | max-age=300 |
X-Frame-Options | HTTP response header: X-Frame-Options | SAMEORIGIN |