### ITOA Interface ### # # CRUD APIs and related APIs (like refresh) for ITOA interface # [script:itoa_interface_service_capability] # Path like /itoa_interface//... match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/(entity|service|kpi|kpi_template|entity_relationship|entity_relationship_rule|entity_filter_rule|entity_type|drift_detection_template)/? handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json capability.get = read_itsi_service capability.post = write_itsi_service capability.put = write_itsi_service capability.delete = delete_itsi_service passHttpHeaders = true passPayload = true python.version = python3 [script:itoa_interface_sandbox_capability] # Path like /itoa_interface//... match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/(sandbox)/? handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json capability.get = read_itsi_sandbox capability.post = write_itsi_sandbox capability.put = write_itsi_sandbox capability.delete = delete_itsi_sandbox passHttpHeaders = true passPayload = true python.version = python3 [script:itoa_interface_sandbox_service_capability] # Path like /itoa_interface//... match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/(sandbox_service)/? handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json capability.get = read_itsi_sandbox_service capability.post = write_itsi_sandbox_service capability.put = write_itsi_sandbox_service capability.delete = delete_itsi_sandbox_service passHttpHeaders = true passPayload = true python.version = python3 [script:itoa_interface_sandbox_sync_log_capability] # Path like /itoa_interface//... match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/(sandbox_sync_log)/? handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json capability.get = read_itsi_sandbox_sync_log capability.post = write_itsi_sandbox_sync_log capability.put = write_itsi_sandbox_sync_log capability.delete = delete_itsi_sandbox_sync_log passHttpHeaders = true passPayload = true python.version = python3 [script:itoa_interface_helper_sandbox_service_capability] # Path like /itoa_interface/load_csv/... match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/(get_sandbox_service_trees)/? handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json capability.get = read_itsi_sandbox_service capability.post = write_itsi_sandbox_service capability.put = write_itsi_sandbox_service capability.delete = delete_itsi_sandbox_service passHttpHeaders = true passPayload = true python.version = python3 [script:itoa_interface_helper_sandbox_service_template_capability] # Path like /itoa_interface/load_csv/... match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/(get_linked_sandbox_services_for_template)/? handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json capability.get = read_itsi_sandbox_service capability.post = write_itsi_sandbox_service capability.put = write_itsi_sandbox_service capability.delete = delete_itsi_sandbox_service passHttpHeaders = true passPayload = true python.version = python3 [script:itoa_interface_team_capability] # Path like /itoa_interface/vLatest//... match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/(team)/? handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json capability.get = read_itsi_team capability.post = write_itsi_team capability.put = write_itsi_team capability.delete = delete_itsi_team passHttpHeaders = true passPayload = true python.version = python3 [script:itoa_interface_kpi_base_search_capability] # Path like /itoa_interface/vLatest//... match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/(kpi_base_search)/? handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json capability.get = read_itsi_kpi_base_search capability.post = write_itsi_kpi_base_search capability.put = write_itsi_kpi_base_search capability.delete = delete_itsi_kpi_base_search passHttpHeaders = true passPayload = true python.version = python3 [script:itoa_interface_kpi_threshold_template_capability] # Path like /itoa_interface/vLatest//... match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/(kpi_threshold_template)/? handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json capability.get = read_itsi_kpi_threshold_template capability.post = write_itsi_kpi_threshold_template capability.put = write_itsi_kpi_threshold_template capability.delete = delete_itsi_kpi_threshold_template passHttpHeaders = true passPayload = true python.version = python3 [script:itoa_interface_base_service_template_capability] # Path like /itoa_interface/vLatest//... match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/(base_service_template)/? handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json capability.get = read_itsi_base_service_template capability.post = write_itsi_base_service_template capability.put = write_itsi_base_service_template capability.delete = delete_itsi_base_service_template passHttpHeaders = true passPayload = true python.version = python3 [script:itoa_interface_temporary_kpi_capability] # Path like /itoa_interface//... match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/temporary_kpi/? handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json capability.get = read_itsi_temporary_kpi capability.post = write_itsi_temporary_kpi capability.put = write_itsi_temporary_kpi capability.delete = delete_itsi_temporary_kpi passHttpHeaders = true passPayload = true python.version = python3 [script:itoa_interface_private_capability] # Path like /itoa_interface//... # meaning user without read/write/delete permissions is allowed to create private objects and read/write/delete them match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/(deep_dive|glass_table|home_view|event_management_state)/? handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json passHttpHeaders = true passPayload = true python.version = python3 [script:itoa_interface_no_capability_checks] # Path like /itoa_interface//... match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/saved_page/? handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json passHttpHeaders = true passPayload = true python.version = python3 [script:itoa_interface_content_packs_authorship] match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/content_pack_authorship/(content_pack|files)/? handler = content_pack_authorship_interface_splunkd.ContentPackAuthorshipInterfaceSplunkd scripttype = persist script = content_pack_authorship_interface_splunkd.py output_modes = json passHttpHeaders = true passPayload = true python.version = python3 [script:itoa_interface_content_packs] match = /itoa_interface/content_pack handler = itsi_content_packs_interface_splunkd.ContentPacksInterface scripttype = persist script = itsi_content_packs_interface_splunkd.py output_modes = json passHttpHeaders = true passPayload = true python.version = python3 [script:itoa_interface_modular_inputs] match = /itoa_interface/modular_inputs handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json capability.post = admin_all_objects passHttpHeaders = true passPayload = true python.version = python3 [script:itoa_interface_entity_retirement] # Path like /itoa_interface/entity/retire match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/entity/(retire|restore|bulk_delete_retired_entities) handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json passHttpHeaders = true passPayload = true python.version = python3 [script:itoa_interface_refresh_queue_job] # Path like /itoa_interface/refresh_queue_job/... match = /itoa_interface/refresh_queue_job/? handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json capability.get = read_itsi_refresh_queue_job capability.post = write_itsi_refresh_queue_job capability.put = write_itsi_refresh_queue_job capability.delete = delete_itsi_refresh_queue_job passHttpHeaders = true passPayload = true python.version = python3 # # Permissions API for Interactable object types in ITOA interface # [script:itoa_interface_rbac_capability] # Path like /itoa_interface//[/]perms/ match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/(home_view|glass_table|deep_dive)/.*/*perms/? handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json capability = configure_perms passPayload = true python.version = python3 # # Helper APIs for ITOA interface needing capability checks # [script:itoa_interface_helper_service_capability] # Path like /itoa_interface/load_csv/... match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/(load_csv|generate_entity_filter|get_kpi_searches|get_search_clause|preview_merge|get_alias_list|get_backfill_search|get_entity_filter|get_service_trees|get_dependent_kpis)/? handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json capability.get = read_itsi_service capability.post = write_itsi_service capability.put = write_itsi_service capability.delete = delete_itsi_service passPayload = true python.version = python3 [script:itoa_interface_helper_gt_capability] # Path like /itoa_interface/load_csv/... match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/(get_kpi_searches_gt)/? handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json capability.get = read_itsi_glass_table capability.post = write_itsi_glass_table capability.put = write_itsi_glass_table capability.delete = delete_itsi_glass_table passPayload = true python.version = python3 # # Other ITOA interface APIs # [script:itoa_interface_generic_no_capability_checks] # Path like /itoa_interface/get_supported_object_types/ match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/get_supported_object_types/? handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json passPayload = true python.version = python3 # Shifting Time policy API [script:itoa_interface_shift_time_offset] match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/(shift_time_offset)/? handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json capability.get = read_itsi_service capability.post = write_itsi_service capability.put = write_itsi_service capability.delete = delete_itsi_service passPayload = true python.version = python3 # Drift detection API [script:itoa_interface_drift_detection] match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/get_drift_kpis/? handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json capability.get = read_itsi_service capability.post = write_itsi_service capability.put = write_itsi_service capability.delete = delete_itsi_service passPayload = true python.version = python3 ### Maintenance Services Interface ### # # CRUD APIs and related APIs (like count) for maintenance services interface # [script:maintenance_services_interface_maintenance_calendar_capability] # Path like /maintenance_services_interface//... match = /maintenance_services_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/maintenance_calendar/? handler = maintenance_services_interface_splunkd.MaintenanceServicesInterfaceSplunkd scripttype = persist script = maintenance_services_interface_splunkd.py output_modes = json capability.get = read_maintenance_calendar capability.post = write_maintenance_calendar capability.put = write_maintenance_calendar capability.delete = delete_maintenance_calendar passPayload = true python.version = python3 # # Other maintenance services interface APIs # [script:maintenance_services_interface_generic_no_capability_checks] # Path like /maintenance_services_interface/get_supported_object_types/ match = /maintenance_services_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/get_supported_object_types/? handler = maintenance_services_interface_splunkd.MaintenanceServicesInterfaceSplunkd scripttype = persist script = maintenance_services_interface_splunkd.py output_modes = json passPayload = true python.version = python3 ### Backup/Restore Interface ### # # CRUD APIs and related APIs (like count) for backup restore interface # [script:backup_restore_interface_backup_restore_capability] # Path like /backup_restore_interface//... match = /backup_restore_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/(backup_restore)/? handler = backup_restore_interface_splunkd.BackupRestoreInterfaceSplunkd scripttype = persist script = backup_restore_interface_splunkd.py output_modes = json capability.get = read_itsi_backup_restore capability.post = write_itsi_backup_restore capability.put = write_itsi_backup_restore capability.delete = delete_itsi_backup_restore passPayload = true python.version = python3 [script:backup_restore_interface_file_upload_download] # Path like /backup_restore_interface/files/.zip match = /backup_restore_interface/(files)/? handler = backup_restore_interface_splunkd.BackupRestoreInterfaceSplunkd scripttype = persist script = backup_restore_interface_splunkd.py output_modes = json capability.get = read_itsi_backup_restore capability.post = write_itsi_backup_restore capability.put = write_itsi_backup_restore capability.delete = delete_itsi_backup_restore passPayload = base64 passHttpHeaders = true python.version = python3 [script:backup_restore_interface_migration] # Path like /backup_restore_interface/migration match = /backup_restore_interface/migration/? handler = backup_restore_interface_splunkd.BackupRestoreInterfaceSplunkd scripttype = persist script = backup_restore_interface_splunkd.py output_modes = json capability.get = read_itsi_backup_restore capability.post = write_itsi_backup_restore capability.put = write_itsi_backup_restore capability.delete = delete_itsi_backup_restore passPayload = base64 passHttpHeaders = true python.version = python3 ### Event Management Interface ### # # CRUD APIs and related APIs (like count) for event management interface # [script:event_management_interface_notable_event_capability] # Path like /event_management_interface//... match = /event_management_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/(notable_event|notable_event_tag|notable_event_comment)/? handler = event_management_interface_splunkd.EventManagementInterfaceSplunkd scripttype = persist script = event_management_interface_splunkd.py output_modes = json capability.get = read_notable_event capability.post = write_notable_event capability.put = write_notable_event capability.delete = delete_notable_event passPayload = true python.version = python3 [script:event_management_interface_notable_event_aggregation_policy_capability] # Path like /event_management_interface//... match = /event_management_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/notable_event_aggregation_policy/? handler = event_management_interface_splunkd.EventManagementInterfaceSplunkd scripttype = persist script = event_management_interface_splunkd.py output_modes = json capability.get = read_itsi_notable_aggregation_policy capability.post = write_itsi_notable_aggregation_policy capability.put = write_itsi_notable_aggregation_policy capability.delete = delete_itsi_notable_aggregation_policy passPayload = true python.version = python3 # # Permissions API for notable events aggregation policy in event management interface # [script:_notable_event_aggregation_policy_rbac_capability] # Path like /event_management_interface//]perms/ match = /event_management_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/notable_event_aggregation_policy/.*/*perms/? handler = event_management_interface_splunkd.EventManagementInterfaceSplunkd scripttype = persist script = event_management_interface_splunkd.py output_modes = json capability.get = read_itsi_notable_aggregation_policy capability.post = configure_perms capability.put = configure_perms capability.delete = configure_perms passPayload = true python.version = python3 [script:event_management_interface_correlation_search_capability] # Path like /event_management_interface//... match = /event_management_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/correlation_search/? handler = event_management_interface_splunkd.EventManagementInterfaceSplunkd scripttype = persist script = event_management_interface_splunkd.py output_modes = json capability.get = read_itsi_correlation_search capability.post = write_itsi_correlation_search capability.put = write_itsi_correlation_search capability.delete = delete_itsi_correlation_search passPayload = true python.version = python3 # # Permissions API for correlation search in event management interface # [script:_correlation_search_rbac_capability] # Path like /event_management_interface//]perms/ match = /event_management_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/correlation_search/.*/*perms/? handler = event_management_interface_splunkd.EventManagementInterfaceSplunkd scripttype = persist script = event_management_interface_splunkd.py output_modes = json capability = configure_perms passPayload = true python.version = python3 # # Other event management interface methods # [script:event_management_interface_notable_event_action_capability] # Path like /event_management_interface//... match = /event_management_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/(notable_event_group|notable_event_actions|notable_event_group_action)/? handler = event_management_interface_splunkd.EventManagementInterfaceSplunkd scripttype = persist script = event_management_interface_splunkd.py output_modes = json capability.get = read_notable_event_action capability.post = execute_notable_event_action capability.put = execute_notable_event_action capability.delete = execute_notable_event_action passPayload = true python.version = python3 [script:event_management_interface_methods_notable_event_capability] # Path like /event_management_interface/ticketing/... match = /event_management_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/ticketing/? handler = event_management_interface_splunkd.EventManagementInterfaceSplunkd scripttype = persist script = event_management_interface_splunkd.py output_modes = json capability.get = read_notable_event_action capability.post = write_notable_event capability.put = write_notable_event capability.delete = delete_notable_event passPayload = true python.version = python3 [script:event_management_interface_no_capability_checks] # Path like /event_management_interface/notable_event_configuration/... match = /event_management_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/notable_event_configuration/? handler = event_management_interface_splunkd.EventManagementInterfaceSplunkd scripttype = persist script = event_management_interface_splunkd.py output_modes = json passPayload = true python.version = python3 [script:check_remote_notable_event_actions] # Path like /event_management_interface/check_remote_notable_event_actions/... match = /event_management_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/check_remote_notable_event_actions/? handler = event_management_interface_splunkd.EventManagementInterfaceSplunkd scripttype = persist script = event_management_interface_splunkd.py output_modes = json passPayload = true python.version = python3 [script:notable_event_ace_interface_splunkd] match = /ace_interface/? handler = notable_event_ace_interface_splunkd.NotableEventAceInterfaceSplunkd scripttype = persist script = notable_event_ace_interface_splunkd.py output_modes = json passHttpHeaders = true passPayload = true python.version = python3 [script:event_management_interface_email_template_capability] match = /event_management_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/notable_event_email_template/? handler = event_management_interface_splunkd.EventManagementInterfaceSplunkd scripttype = persist script = event_management_interface_splunkd.py output_modes = json capability.get = read_itsi_notable_event_email_template capability.post = write_itsi_notable_event_email_template capability.put = write_itsi_notable_event_email_template capability.delete = delete_itsi_notable_event_email_template passPayload = true python.version = python3 [script: event_management_interface_file_export] match = /event_management_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/episode_export/? handler = event_management_interface_splunkd.EventManagementInterfaceSplunkd scripttype = persist script = event_management_interface_splunkd.py output_modes = json capability.get = read_itsi_event_management_export capability.post = write_itsi_event_management_export capability.put = write_itsi_event_management_export capability.delete = delete_itsi_event_management_export passPayload = true passHttpHeaders = true python.version = python3 ### Other Interfaces [script:backfill_services] match = /backfill_services/? handler = backfill_services.backfill_services python.version = python3 [script:health_services] match = /health_services/? handler = health_services.health_services python.version = python3 [script:itoa_csv_interface] match = /itoa_csv_interface/? handler = itoa_csv_interface.ItoaCSVInterfaceSplunkd scripttype = persist script = itoa_csv_interface.py output_modes = json passHttpHeaders = true passPayload = true python.version = python3 [script:deep_dive_services] match = /deep_dive_services/? handler = deep_dive_services.deep_dive_services python.version = python3 [validation: savedsearches] action.itsi_event_generator.param.owner = validate( isstr('action.event_generator.param.owner'), "'action.event_generator.param.owner' must be a valid string value") action.itsi_event_generator.param.status = validate( isint('action.event_generator.param.status'), "'action.event_generator.param.status' must be a int value") action.itsi_event_generator.param.severity = validate( isint('action.event_generator.param.severity'), "'action.event_generator.param.severity' must be a int value") [script:itsi_module_interface] match = /itsi_module_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/? handler = itsi_module_interface_splunkd.ItsiModuleInterfaceSplunkd scripttype = persist script = itsi_module_interface_splunkd.py output_modes = json passHttpHeaders = true capability.get = read_module_interface capability.post = write_module_interface capability.put = write_module_interface capability.delete = delete_module_interface passPayload = true python.version = python3 # Endpoint for converting GT to UDF [script:gt_transformer] match = /gt_transformer script = gt_transformer.py scripttype = persist handler = gt_transformer.GTTransformer requireAuthentication = true output_modes = json passPayload = true python.version = python3 ################# Internal use only ######################### [script:event_management_interface_no_capability_checks_internal_use] # Path like /event_management_interface/mad_event_action/... match = /event_management_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/(mad_event_action|user_message_mad_event)/? handler = event_management_interface_splunkd.EventManagementInterfaceSplunkd scripttype = persist script = event_management_interface_splunkd.py output_modes = json python.version = python3 [script:itsi_data_integrations_template_interface_splunkd] # Path like itoa_interface/data_integrations/template match = /event_management_interface/data_integrations/template/? handler = itsi_data_integrations_template_interface_splunkd.DataIntegrationsTemplateInterfaceSplunkd scripttype = persist script = itsi_data_integrations_template_interface_splunkd.py output_modes = json capability.get = read_itsi_data_integration capability.post = write_itsi_data_integration capability.put = write_itsi_data_integration capability.delete = delete_itsi_data_integration python.version = python3 [script:migration_internal_use] # Path like /migration/info match = /migration/? handler = migration_interface_splunkd.MigrationInterfaceSplunkd scripttype = persist script = migration_interface_splunkd.py output_modes = json capability.get = read_itsi_backup_restore capability.post = write_itsi_backup_restore capability.put = write_itsi_backup_restore capability.delete = delete_itsi_backup_restore passPayload = base64 passHttpHeaders = true python.version = python3 [script:feature_flagging_interface_no_capability_checks_internal_use] # Path like /feature_flagging/features match = /feature_flagging/(features) handler = feature_flagging_interface_splunkd.FeatureFlaggingInterfaceSplunkd scripttype = persist script = feature_flagging_interface_splunkd.py passHttpHeaders = true passSystemAuth = true passPayload = true output_modes = json python.version = python3 [script:itoa_interface_entity_management_policies_capability] # Path like /itoa_interface/vLatest//... match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/(entity_management_policies|entity_management_rules)/? handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json capability.get = read_itsi_entity_management_policies capability.post = write_itsi_entity_management_policies capability.put = write_itsi_entity_management_policies capability.delete = delete_itsi_entity_management_policies passHttpHeaders = true passPayload = true python.version = python3 [script:adaptive_thresholding_usage] # Path like /at_usage_data match = /at_usage_data handler = at_usage_interface_splunkd.ATUsageInterfaceSplunkd scripttype = persist script = at_usage_interface_splunkd.py passHttpHeaders = true passSystemAuth = true passPayload = true output_modes = json python.version = python3 [script:itoa_interface_custom_threshold_windows_capability] # Path like /itoa_interface/vLatest//... match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/(custom_threshold_windows)/? handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json capability.get = read_itsi_custom_threshold_windows capability.post = write_itsi_custom_threshold_windows capability.put = write_itsi_custom_threshold_windows capability.delete = delete_itsi_custom_threshold_windows passHttpHeaders = true passPayload = true python.version = python3 [script:itoa_interface_custom_threshold_windows_associated_kpis] # Path like /itoa_interface/vLatest/custom_threshold_windows/ # linked_kpis?custom_threshold_window_id={custom_threshold_windows_id} match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/custom_threshold_windows/(linked_kpis)/? handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json capability.get = read_itsi_custom_threshold_windows capability.post = write_itsi_custom_threshold_windows capability.put = write_itsi_custom_threshold_windows capability.delete = delete_itsi_custom_threshold_windows passHttpHeaders = true passPayload = true python.version = python3 [script:itoa_interface_custom_threshold_windows_disconnect_from_kpis] # Path like /itoa_interface/vLatest/custom_threshold_windows/{custom_threshold_windows_id}/ # disconnect_kpis/{"service_kpis_dict": [{'service_id': service_id1, 'linked_kpi_ids': [kpi_id1, kpi_id2]}]} match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/(custom_threshold_windows)/?/disconnect_kpis/? handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json capability.get = read_itsi_custom_threshold_windows capability.post = write_itsi_custom_threshold_windows capability.put = write_itsi_custom_threshold_windows capability.delete = delete_itsi_custom_threshold_windows passHttpHeaders = true passPayload = true python.version = python3 [script:itoa_interface_upgrade_readiness_precheck_capability] # Path like /itoa_interface/vLatest/upgrade_readiness_prechecks?filter=<{"status":"IN_PROGRESS/COMPLETED/FAILED"}> # &count=1&sort_dir=desc&sort_key=start_time match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/upgrade_readiness_prechecks/? capability.get = read_itsi_upgrade_readiness_prechecks capability.post = write_itsi_upgrade_readiness_prechecks capability.put = write_itsi_upgrade_readiness_prechecks capability.delete = delete_itsi_upgrade_readiness_prechecks handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json passPayload = true python.version = python3 [script:itoa_interface_upgrade_readiness_start_new_upgrade_readiness_precheck] # Path like /itoa_interface/vLatest/upgrade_readiness_prechecks/start_new_upgrade_readiness_precheck match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/upgrade_readiness_prechecks/start_new_upgrade_readiness_precheck capability.get = read_itsi_upgrade_readiness_prechecks capability.post = write_itsi_upgrade_readiness_prechecks capability.put = write_itsi_upgrade_readiness_prechecks capability.delete = delete_itsi_upgrade_readiness_prechecks handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json passPayload = true python.version = python3 [script:itoa_interface_upgrade_readiness_get_precheck_details] # Path like /itoa_interface/vLatest/upgrade_readiness_prechecks/failed_precheck/ match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/upgrade_readiness_prechecks/failed_precheck/? capability.get = read_itsi_upgrade_readiness_prechecks capability.post = write_itsi_upgrade_readiness_prechecks capability.put = write_itsi_upgrade_readiness_prechecks capability.delete = delete_itsi_upgrade_readiness_prechecks handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json passPayload = true python.version = python3 [script:itoa_interface_sandbox_save_capability] # Path like /itoa_interface//... match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/sandbox/.*/*save handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json capability.put = write_itsi_sandbox passHttpHeaders = true passPayload = true python.version = python3 [script:itoa_interface_upgrade_remediate_failed_precheck] # Path like /itoa_interface/vLatest/upgrade_readiness_prechecks/remediate_failed_precheck/ match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/upgrade_readiness_prechecks/remediate_failed_precheck/? capability.get = read_itsi_upgrade_readiness_prechecks capability.post = write_itsi_upgrade_readiness_prechecks capability.put = write_itsi_upgrade_readiness_prechecks capability.delete = delete_itsi_upgrade_readiness_prechecks handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json passPayload = true python.version = python3 ## capabilities are not defined in package.json, setting up default. [script:SA-ITOA.apiiconcollection] match = SA-ITOA/v1/icon_collection handler = rest_imports_apiiconcollection_SA_ITOA.IconCollectionRestHandler requireAuthentication = true scripttype = python python.version = python3 [script:itoa_interface_upgrade_readiness_get_remediation_details] # Path like /itoa_interface/vLatest/upgrade_readiness_prechecks/auto_remediation/ match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/upgrade_readiness_prechecks/auto_remediation/? capability.get = read_itsi_upgrade_readiness_prechecks capability.post = write_itsi_upgrade_readiness_prechecks capability.put = write_itsi_upgrade_readiness_prechecks capability.delete = delete_itsi_upgrade_readiness_prechecks handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json passPayload = true python.version = python3 [script:itoa_interface_entity_discovery_searches] # Path for /itoa_interface/entity_discovery_searches(/) match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/entity_discovery_searches(/search_id/|/entity_id/|/)? handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json passHttpHeaders = true passPayload = true python.version = python3 [script:admin_console_interface] # Path like /admin_console_interface/vLatest//... match = /admin_console_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/? handler = admin_console_interface.AdminConsoleInterfaceSplunkd scripttype = persist script = admin_console_interface_splunkd.py output_modes = json capability.get = read_itsi_admin_console capability.post = write_itsi_admin_console passPayload = true python.version = python3 [script:itoa_interface_kpi_at_info] # Path like /itoa_interface/kpi_at_info//... match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/(kpi_at_info)/? handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json capability.get = read_itsi_kpi_at_info capability.post = write_itsi_kpi_at_info capability.put = write_itsi_kpi_at_info capability.delete = delete_itsi_kpi_at_info passHttpHeaders = true passPayload = true python.version = python3 [script:itoa_interface_kpi_entity_threshold] # Path like /itoa_interface/kpi_entity_threshold//... match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/(kpi_entity_threshold)/? handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json capability.get = read_itsi_kpi_entity_threshold capability.post = write_itsi_kpi_entity_threshold capability.put = write_itsi_kpi_entity_threshold capability.delete = delete_itsi_kpi_entity_threshold passHttpHeaders = true passPayload = true python.version = python3 [script:itoa_interface_kpi_entity_threshold_recommendations] # Path like /itoa_interface/kpi_entity_threshold_recommendations/... match = /itoa_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/(kpi_entity_threshold_recommendations)/? handler = itoa_rest_interface_splunkd.ItoaRestInterfaceSplunkd scripttype = persist script = itoa_rest_interface_splunkd.py output_modes = json capability.get = read_itsi_kpi_entity_threshold capability.post = write_itsi_kpi_entity_threshold capability.put = write_itsi_kpi_entity_threshold capability.delete = delete_itsi_kpi_entity_threshold passHttpHeaders = true passPayload = true python.version = python3 [script:event_management_interface_data_integration_capability] # Path like /event_management_interface//... match = /event_management_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/data_integration/? handler = event_management_interface_splunkd.EventManagementInterfaceSplunkd scripttype = persist script = event_management_interface_splunkd.py output_modes = json capability.get = read_itsi_data_integration capability.post = write_itsi_data_integration capability.put = write_itsi_data_integration capability.delete = delete_itsi_data_integration passPayload = true python.version = python3 # # Permissions API for data integration in itoa interface # [script:_data_integration_rbac_capability] # Path like /event_management_interface//]perms/ match = /event_management_interface(/(vLatest|v[0-9]+(\.[0-9]+){0,2})){0,1}/data_integration/.*/*perms/? handler = event_management_interface_splunkd.EventManagementInterfaceSplunkd scripttype = persist script = event_management_interface_splunkd.py output_modes = json capability.get = read_itsi_data_integration capability.post = configure_perms capability.put = configure_perms capability.delete = configure_perms passPayload = true python.version = python3 ## capabilities are not defined in package.json, setting up default. [script:SA-ITOA.apifilesave] match = SA-ITOA/v1/files handler = rest_imports_apifilesave_SA_ITOA.FilesaveRestHandler requireAuthentication = true scripttype = python python.version = python3