XSIAM HTTP Log Collector Testing

[J.Huchtktter]

Hello everyone,

We are currently considering to us a HTTP Log Collector.

However, before this can be started, I wanted to test the collection. 

Now, in theory, this should not be hard, due to the examples provided after setting up the integration.

Nonetheless, either the Python Example is faulty in some way, or I am being exceedingly stupid.

Currently, my code looks like this, very close to the provided example:

def test_http_collector(api_key: str) -> requests.Response:
    headers = {
        "Authorization": api_key,
        "Content-Type": "text/plain"
    }
    # Note: the logs must be separated by a new line
    body = "{'example1': 'test', 'timestamp': 1609100113039}\n{'example2': [12321,546456,45687,1]}"
    res = requests.post(url="https://api-<name>.xdr.de.paloaltonetworks.com/logs/v1/event",
                        headers=headers,
                        data=body,
                        timeout=600
                        )
    return res

I've only added a timeout and changed the linebreak (which would not add a newline) to a \n.

This consistently seems to return HTTP 500 for me.

The best I've managed in trying multiple ways for hours is HTTP 400 and I cannot even replicate it right now.

Does someone who is running a working HTTP log collector have any idea?

Or maybe a tested and proven, minimal working example?

Is there anywhere I can check what actually happened in XSIAM?