splunk / zoom-webhook-to-hec

Serverless Application for AWS: Zoom Webhook to Splunk HTTP Event Collector (HEC)

Splunk OCSF Extension

The Splunk schema extension repository

zoom-webhook-to-hec's Issues

Add support for Webhook Validation

October of this year zoom will require all webhooks to validate based on a response to a specific message every 72 hours, it appears the current function lacks this ability.
https://developers.zoom.us/docs/api/rest/webhook-reference/#validate-your-webhook-endpoint

Why not use HEC query string auth?

The JWT addon method and this lambda proxy method seem overly complicated.
Lets assume I've misunderstood something and hopefully you can tell me where my method for getting Zoom data in via Webhook to HEC below is wrong.

1. Create HEC token for zoom with query string auth
   inputs.conf

[http://hec-app-zoom]
disabled = 0
token = goes-here
description = Receiver for Zoom webhook
index = zoom
indexes = zoom
sourcetype= zoom:webhook
allowQueryStringAuth = true

I found that Splunk was setting the time wrong (choosing the wrong field) on some events from Zoom so:
props.conf

[http://hec-app-zoom]
DATETIME_CONFIG = CURRENT

2. Setup Webhook in Zoom with url:
   https://my-hec-service/services/collector/raw?token=goes-here

The authorisation is done within the url.
The authorisation header sent by Zoom is ignored by Splunk HEC, because we are doing query string auth with our HEC token.

I've had this running since April 3.