Hi @mikewilusz ,

Could you please help me here?

Thanks,
Aravind

Hi Aravind,

It appears you have an extra / in the URL which is not supposed to be there, please retry with the format as;

*/feeds/*****-***-****-******-******:importPushLogs

-------------------------------------------------------v This needs to be deleted
*/feeds/*****-***-****-******-******/:importPushL

EXAMPLE CURL

#curl "https://eu-chronicle.googleapis.com/v1alpha/projects/123456789/locations/eu/instances/123456-1234-1234-1234-123456789/feeds/12345678-1234-1234-1234-123456789:importPushLogs?key=***************************************&secret=********************************************************" -d "TESTDATA"

Hi @jkephsecru,

Thank you for the revert.

Also we need to add those api key and secret key right?
The key is obtained from google console and the feed's secret key. in the below format right?
https://**-chronicle.googleapis.com/v1alpha/projects/*******/locations/**/instances/*****-***-****-******-******/feeds/*****-***-****-******-******:importPushLogs?key=*****************&secret=*************************************

Please correct me if I'm wrong.

Thanks,
Aravind S

Hi @jkephsecru,

Please find the below snip. It is again throwing 404 error.

Thanks,
Aravind

Hi @ara,

Try to capture the whole URL into quotes "https://URL...?..."

Yes, API key is generated in the project (restricted to Chronicle API), the Secret can be captured from the feed UI when creating the feed.

Thank you @jkephsecru it is working,
Now if we want to integrate the webook to cribl can i use the same format or with the quotes?

Yes that should work with the URL in that format, currently the same is required for Auth0 until custom headers can be set. Please be aware that the URL and it's keys will be viewable in certain logs (exposing your keys). Where possible, set custom headers for the secret and api key.

On a seperate note- I have found in testing that data can still be submitted & ingested without the secret key (I'm not sure if this is supposed to happen).

Hi @jkephsecru,
It Worked.