Need to use with multiple API tokens about canarytokens HOT 6 CLOSED

Hi @feldmannb,

I just want to make sure im understanding your use case here:

1. multiple companies each with their own Canarytokens server (say canarytokens.company1.com, canarytokens.company2.com)
2. Each company has an api token used in sending incidents to your one Splunk installation - this allows Splunk to know which company's incidents are being sent in.

The question then is how you can add that api token to the canarytoken webhhook that sends the events to your Splunk incident? Or is this a question of whether the Canary Splunk addon can support more than one Canarytokens instance sending incidents?

from canarytokens.

from canarytokens.

HI @feldmannb,

Thanks for the explanation. I think there may be some confusion here. Are you a Canary customer? i.e. you have your own Canary Console instance?

from canarytokens.

@jayjb

I am actually a Splunk SE working with a customer who is a Canary customer. It is possible the confusion is on my side or I did not explain the issue clearly or I may be in the wrong Git thread for the customer issue.

The problem is not with anything on the Canary Console it is with the Thinkst Canary Add-On for Splunk (https://splunkbase.splunk.com/app/3980/). The add-on can only be configured with a single API Token and tied to a single Canary Console instance. I have a customer that has multiple operating companies each with their own Canary Console instance but using a single instance of Splunk and as a result a single instance of the Add-On.

from canarytokens.

Hi @feldmannb,

So if you working for a Canary Customer you should totally mail in support [at] canary [dot] tools please. We would be happy to help.

I can tell you though that we are currently working on our Splunk app (so that it adheres to the latest version). We don't support multiple API keys and I dont think we have ever had that request before. If you wouldn't mailing the above address with some details, so that we know how to get hold of you.

In the meantime, ill bring it up with the folks this side and see if we can figure something out.

from canarytokens.

Closing this issue because the Thinkst Canary Add-on for Splunk doesn't apply here. We can route this to actual support for a Canary Customer (also the Splunk App has been updated recently so new issues to follow I'm sure)

from canarytokens.