Example Script

There are many ways you can request information from the SIEM API. The following is an example using a Python script that requests information from the SIEM API and records it in a log file.

#!/usr/bin/env python
            import unirest
            import time
            import logging
            #import logging.handlers
            
            logging.basicConfig(filename='api.log', filemode='w', level=logging.DEBUG, format='LINE: %(message)s' )
            
            # Setting up syslog
            # siem_logger = logging.getLogger('SIEM Logger')
            # handler = logging.handlers.SysLogHandler(address='/dev/log')
            # siem_logger.addHandler(handler
            # siem_logger.info()
            
            currentTimeInMillis = int(round(time.time() * 1000) - 60000)
            fromTimeInMillis = currentTimeInMillis - (5*60*1000)
            jwt="<insert SIEM token value here>"
            url="https://siem.zixcorp.com/siemauthapi/api/siem/all"
            
            while True:
              response = unirest.get(url, headers={"Authorization": jwt}, params={ "from": fromTimeInMillis, "to": currentTimeInMillis})
              lines = response.body.split("\n")
              for line in lines:
                logging.info(line)
              time.sleep(300)
              fromTimeInMillis = currentTimeInMillis
              currentTimeInMillis = int(round(time.time() * 1000) - 60000)
            

Example Script Instructions

Prerequisites:

1. Install pip using ‘yum install python-pip’
2. Install unirest using ‘pip install unirest’ (http://unirest.io/python.html)

 

Using the Script:

To use the basic configuration:

1. Download the SIEM Token from the management console.
2. Enter the SIEM Token value after “jwt=“ in the quotations.
3. Run the script using ./sampleSiemApi.
4. Access the logs by opening the api.log.

The base configuration creates a log in the location where sampleSiemApi is stored.

To set up an optional syslog:

1. Uncomment the #import logging.handlers line and the lines Setting up syslog through siem.logger.info().
2. Change the location where the log will be stored using the handler.
3. Replace "dev/log" with the location you want to save the syslog to.
4. Enter the SIEM Token value after "jwt=" in the quotations.

https://siem.zixcorp.com/siemauthapi/api