Info needed: Latest Webhook update

[Former Community Member]

Hi Team,

Could anyone please provide the detailed documentation of the latest update Webhook integration.

When I attempt to push "hello world" string to chronicle Via webhook it is throwing me 404 error. I used curl in Linux for the same. 

$curl https://**-chronicle.googleapis.com/v1alpha/projects/*******/locations/**/instances/*****-***-****-******-******/feeds/*****-***-****-******-******/:importPushLogs?key=*****************&secret=************************************* -X POST --data "hello world"

The same url format I tried to configure a cribl webhoon destination. Please find the below snip.

Could anyone please let me know what am I doing wrong here?

Thank you in advance.

Thanks,

[Former Community Member]

Hi @mikewilusz ,

Could you please help me here?

Thanks,
Aravind

[jkephsecru]

Hi Aravind,

It appears you have an extra / in the URL which is not supposed to be there, please retry with the format as;

*/feeds/*****-***-****-******-******:importPushLogs

-------------------------------------------------------v This needs to be deleted
*/feeds/*****-***-****-******-******/:importPushL

EXAMPLE CURL

#curl "https://eu-chronicle.googleapis.com/v1alpha/projects/123456789/locations/eu/instances/123456-1234-12..." -d "TESTDATA"

Data pushed via webhook

[Former Community Member]

Hi @jkephsecru,

Thank you for the revert.

Also we need to add those api key and secret key right?
The key is obtained from google console and the feed's secret key. in the below format right?
https://**-chronicle.googleapis.com/v1alpha/projects/*******/locations/**/instances/*****-***-****-******-******/feeds/*****-***-****-******-******:importPushLogs?key=*****************&secret=*************************************

Please correct me if I'm wrong.

Thanks,
Aravind S

[Former Community Member]

Hi @jkephsecru,

Please find the below snip. It is again throwing 404 error.

Thanks,
Aravind

[jkephsecru]

Hi @ara,

Try to capture the whole URL into quotes "https://URL...?..."

Yes, API key is generated in the project (restricted to Chronicle API), the Secret can be captured from the feed UI when creating the feed.

[Former Community Member]

Thank you @jkephsecru it is working,
Now if we want to integrate the webook to cribl can i use the same format or with the quotes?

[jkephsecru · Accepted solution]

Yes that should work with the URL in that format, currently the same is required for Auth0 until custom headers can be set. Please be aware that the URL and it's keys will be viewable in certain logs (exposing your keys). Where possible, set custom headers for the secret and api key.

On a seperate note- I have found in testing that data can still be submitted & ingested without the secret key (I'm not sure if this is supposed to happen).

[Former Community Member]

Hi @jkephsecru,
It Worked.