Log Sources

REST API operations for log sources

Overview

The /log-sources REST API operations are in open beta starting with Panther version 1.111, and are available to all customers. Please share any bug reports and feature requests with your Panther support team.

Use these API operations to interact with log sources in Panther. Currently, interactions with HTTP Sources are supported. (This does not include supported log sources that use HTTP as their transport mechanism.)

To call the API, see the How to use the Panther REST API instructions—including directions for how to invoke it directly from this documentation page.

Required permissions

• For GET operations, your API token must have the View Log Sources permission.

• For POST, PUT, and DELETE operations, your API token must have the Manage Log Sources permission.

Operations

create http source

POSThttps://your-api-host/log-sources/http

Body

application/json

integrationLabel*string

The name of the http source

logStreamType*enum

The log stream types

AutoCloudWatchLogsJSONJsonArrayLines

logTypes*array of string

The log types of the integration

securityAlgstring

The authentication algorithm of the http source

securityHeaderKeystring

The security header key of the http source

securityPasswordstring

The authentication header password of the http source

securitySecretValuestring

The header secret value of the http source

securityType*enum

The security type of the http endpoint

SharedSecretHMACBearerBasicNone

securityUsernamestring

The authentication header username of the http source

Response

201400409500

Created response.

Body

application/json

integrationIdstring

The id of the http source

integrationLabelstring

The integration label (name)

logStreamTypeenum

The log stream types

AutoCloudWatchLogsJSONJsonArrayLines

logTypesarray of string

The log types of the integration

securityAlgstring

The authentication algorithm of the http source

securityHeaderKeystring

The security header key of the http source

securityPasswordstring

The authentication header password of the http source

securitySecretValuestring

The header secret value of the http source

securityTypeenum

The security type of the http endpoint

SharedSecretHMACBearerBasicNone

securityUsernamestring

The authentication header username of the http source

Request

JavaScriptCurlPython

const response = await fetch('https://your-api-host/log-sources/http', {
    method: 'POST',
    headers: {
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      "integrationLabel": "text",
      "logTypes": [
        "text"
      ],
      "logStreamType": "Auto",
      "securityType": "SharedSecret"
    }),
});
const data = await response.json();

Response

201400409500

{
  "integrationId": "text",
  "integrationLabel": "text",
  "logStreamType": "Auto",
  "logTypes": [
    "text"
  ],
  "securityAlg": "text",
  "securityHeaderKey": "text",
  "securityPassword": "text",
  "securitySecretValue": "text",
  "securityType": "SharedSecret",
  "securityUsername": "text"
}

get http source

GEThttps://your-api-host/log-sources/http/{id}

Path parameters

id*string

ID of the http source to fetch

Response

200400404500

OK response.

Body

application/json

integrationIdstring

The id of the http source

integrationLabelstring

The integration label (name)

logStreamTypeenum

The log stream types

AutoCloudWatchLogsJSONJsonArrayLines

logTypesarray of string

The log types of the integration

securityAlgstring

The authentication algorithm of the http source

securityHeaderKeystring

The security header key of the http source

securityPasswordstring

The authentication header password of the http source

securitySecretValuestring

The header secret value of the http source

securityTypeenum

The security type of the http endpoint

SharedSecretHMACBearerBasicNone

securityUsernamestring

The authentication header username of the http source

Request

JavaScriptCurlPython

const response = await fetch('https://your-api-host/log-sources/http/{id}', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Response

200400404500

{
  "integrationId": "text",
  "integrationLabel": "text",
  "logStreamType": "Auto",
  "logTypes": [
    "text"
  ],
  "securityAlg": "text",
  "securityHeaderKey": "text",
  "securityPassword": "text",
  "securitySecretValue": "text",
  "securityType": "SharedSecret",
  "securityUsername": "text"
}

put http source

put updates an http source

PUThttps://your-api-host/log-sources/http/{id}

Path parameters

id*string

ID of the http source to update

Body

application/json

integrationLabel*string

The name of the http source

logStreamType*enum

The log stream types

AutoCloudWatchLogsJSONJsonArrayLines

logTypes*array of string

The log types of the integration

securityAlgstring

The authentication algorithm of the http source

securityHeaderKeystring

The security header key of the http source

securityPasswordstring

The authentication header password of the http source

securitySecretValuestring

The header secret value of the http source

securityType*enum

The security type of the http endpoint

SharedSecretHMACBearerBasicNone

securityUsernamestring

The authentication header username of the http source

Response

200400404409500

OK response.

Body

application/json

integrationIdstring

The id of the http source

integrationLabelstring

The integration label (name)

logStreamTypeenum

The log stream types

AutoCloudWatchLogsJSONJsonArrayLines

logTypesarray of string

The log types of the integration

securityAlgstring

The authentication algorithm of the http source

securityHeaderKeystring

The security header key of the http source

securityPasswordstring

The authentication header password of the http source

securitySecretValuestring

The header secret value of the http source

securityTypeenum

The security type of the http endpoint

SharedSecretHMACBearerBasicNone

securityUsernamestring

The authentication header username of the http source

Request

JavaScriptCurlPython

const response = await fetch('https://your-api-host/log-sources/http/{id}', {
    method: 'PUT',
    headers: {
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      "integrationLabel": "text",
      "logTypes": [
        "text"
      ],
      "logStreamType": "Auto",
      "securityType": "SharedSecret"
    }),
});
const data = await response.json();

Response

200400404409500

{
  "integrationId": "text",
  "integrationLabel": "text",
  "logStreamType": "Auto",
  "logTypes": [
    "text"
  ],
  "securityAlg": "text",
  "securityHeaderKey": "text",
  "securityPassword": "text",
  "securitySecretValue": "text",
  "securityType": "SharedSecret",
  "securityUsername": "text"
}

delete http source

DELETEhttps://your-api-host/log-sources/http/{id}

Path parameters

id*string

ID of the http source to delete

Response

204400500

No Content response.

Request

JavaScriptCurlPython

const response = await fetch('https://your-api-host/log-sources/http/{id}', {
    method: 'DELETE',
    headers: {},
});
const data = await response.json();

Response

400500

{
  "message": "text"
}