These docs are for Cribl Stream 4.1 and are no longer actively maintained.

See the latest version (4.20).

You can configure the Lacework v2 API within Stream. This enables you to collect data from the Lacework API without introducing custom scripts or add-ons into your Lacework environment.

Your workflow will be based on the Discover and Collect pattern that’s standard for REST/API Collectors. In the Lacework API variation described here, the Discover job will generate the access token that the collection job uses in requests to the API. As an example, we’ll configure Cribl Stream to collect Host Vulnerability data, using optional filters available in the Lacework API.

Before you begin, make sure you have a Lacework API KeyID and secretKey, or create them as described in the Lacework docs.

Configuring the REST Collector ​

Collector Sources currently cannot be selected or enabled in the QuickConnect UI.

For additional details about all the configuration options specified here, see our REST/API Endpoint and Scheduling and Running topics.

From the top nav of a Cribl Stream instance or Group, select Data > Sources, then select Collectors > REST from the Data Sources page’s tiles or the Sources left nav. Click Add Collector to open the REST > New Collector modal. Enter a Collector ID, then complete the following options and fields.

Discover Settings ​

From the Discover type drop-down, select HTTP Request. Then complete the Discover settings as follows.

Discover URL: Enter the URL at which Cribl Stream should access the Lacework v2/access/tokens endpoint.

Discover method: From the drop-down, select POST with Body.

Discover POST Body: Enter `{"keyId":"<keyID>", "expiryTime":3600}`, substituting your Lacework API KeyID for the placeholder.

Discover headers: Create the two headers specified in the table below, substituting your Lacework API secretKey for the placeholder.

Your Collector configuration should look similar to this:

Collect Settings ​

Collect URL: Enter the URL at which Cribl Stream should access the Lacework v2/Vulnerabilities/Hosts/search endpoint.

Collect method: From the drop-down, select POST with Body.

Collect POST body: Enter the following request body.

 `{"timeFilter": { "startTime": "${C.Time.strftime(earliest || new Date().getTime()/1000-(24*60*60), '%Y-%m-%dT%H:%M:%SZ')}", "endTime": "${C.Time.strftime(latest || new Date().getTime()/1000, '%Y-%m-%dT%H:%M:%SZ')}"},"filters": [ { "expression":"eq","field":"vulnId", "value": "CVE-2018-11233" } ] }`