Audits

Overview

Get a list of Agari DMARC Protection audits by domain, user or organization through the Agari API using the HTTP Pull Listener.

HTTP Pull Listener configuration

In Falcon Onum, go to the Listeners area and click New Listener > HTTP Pull. Give a name to your new Listener and enter the following data:

Parameters

Add the following parameter:

• Name - domain

• Value - Enter your Agari DMARC Protection domain name.

Secrets

You must define these credentials in Onum:

• client_id will reference your Agari DMARC Protection API Application ID.

• client_secret will reference your Agari DMARC Protection Application secret key.

To do it, click Add element and enter a Name for the secret (in this case, client_id). Then, click the Value field and select New secret to create a new one:

• Give the secret a Name.

• Turn off the Expiration date option.

• Click Add new value and paste the secret corresponding to the value.

• Click Save.

You can now select the secret you just created in the Value field list. Repeat the process for the client_secret.

Learn more about secrets in Onum in this article.

Setup

After entering the required parameters and secrets, you can choose to manually enter the rest of configuration fields, or simply paste the given YAML:

• Audits by domain

• Audits by organization

• Audits by user

Audits by domain

Config as YAML

Toggle ON the Config as YAML option to enable a free text field where you can paste the following YAML:

withTemporalWindow: true
temporalWindow:
  duration: 5m
  offset: 5m
  tz: UTC
  format: RFC3339
withAuthentication: true
authentication:
  type: token
  token:
    request:
      method: POST
      url: ${parameters.domain}/v1/cp/oauth/token
      headers:
        - name: Content-Type
          value: application/x-www-form-urlencoded
        - name: Accept
          value: application/json
      bodyType: urlEncoded
      bodyParams:
        - name: client_id
          value: '${secrets.client_id}'
        - name: client_secret
          value: '${secrets.client_secret}'
    tokenPath: ".access_token"
    authInjection:
      in: header
      name: Authorization
      prefix: 'Bearer '
      suffix: ''
withEnumerationPhase: true
enumerationPhase:
  paginationType: offsetLimit
  isZeroIndex: false
  limit: 200
  request:
    responseType: json
    method: GET
    url: ${parameters.domain}/v1/cp/domains
    headers:
      - name: Accept
        value: application/json
    queryParams:
      - name: offset
        value: ${pagination.offset}
      - name: limit
        value: ${pagination.limit}
  output:
    select: "[.domains[].id]"
    map: "."
    outputMode: element
collectionPhase:
  variables:
    - source: input
      name: domainId
      expression: "."
      format: ""
  paginationType: none
  request:
    responseType: json
    method: GET
    url: ${parameters.domain}/v1/cp/audits
    headers:
      - name: Accept
        value: application/json
    queryParams:
      - name: start_date
        value: ${temporalWindow.from}
      - name: end_date
        value: ${temporalWindow.to}
      - name: object_type
        value: domain
      - name: object_id
        value: ${inputs.domainId}
  output:
    select: ".audits.entries"
    map: "."
    outputMode: element

Manually configure

Audits by organization

Config as YAML

Toggle ON the Config as YAML option to enable a free text field where you can paste the following YAML:

withTemporalWindow: true
temporalWindow:
  duration: 5m
  offset: 5m
  tz: UTC
  format: RFC3339
withAuthentication: true
authentication:
  type: token
  token:
    request:
      method: POST
      url: ${parameters.domain}/v1/cp/oauth/token
      headers:
        - name: Content-Type
          value: application/x-www-form-urlencoded
        - name: Accept
          value: application/json
      bodyType: urlEncoded
      bodyParams:
        - name: client_id
          value: '${secrets.client_id}'
        - name: client_secret
          value: '${secrets.client_secret}'
    tokenPath: ".access_token"
    authInjection:
      in: header
      name: Authorization
      prefix: 'Bearer '
      suffix: ''
withEnumerationPhase: true
enumerationPhase:
  paginationType: offsetLimit
  limit: 200
  request:
    responseType: json
    method: GET
    url: ${parameters.domain}/v1/cp/organizations
    headers:
      - name: Accept
        value: application/json
    queryParams:
      - name: offset
        value: ${pagination.offset}
      - name: limit
        value: ${pagination.limit}
  output:
    select: "[.organizations[].id]"
    map: "."
    outputMode: element
collectionPhase:
  variables:
    - source: input
      name: orgId
      expression: "."
      format: ""
  paginationType: none
  request:
    responseType: json
    method: GET
    url: ${parameters.domain}/v1/cp/audits
    headers:
      - name: Accept
        value: application/json
    queryParams:
      - name: start_date
        value: ${temporalWindow.from}
      - name: end_date
        value: ${temporalWindow.to}
      - name: object_type
        value: organization
      - name: object_id
        value: ${inputs.orgId}
  output:
    select: ".audits.entries"
    map: "."
    outputMode: element

Manually configure

Audits by user

Config as YAML

Toggle ON the Config as YAML option to enable a free text field where you can paste the following YAML:

withTemporalWindow: true
temporalWindow:
  duration: 5m
  offset: 5m
  tz: UTC
  format: RFC3339
withAuthentication: true
authentication:
  type: token
  token:
    request:
      method: POST
      url: ${parameters.domain}/v1/cp/oauth/token
      headers:
        - name: Content-Type
          value: application/x-www-form-urlencoded
        - name: Accept
          value: application/json
      bodyType: urlEncoded
      bodyParams:
        - name: client_id
          value: '${secrets.client_id}'
        - name: client_secret
          value: '${secrets.client_secret}'
    tokenPath: ".access_token"
    authInjection:
      in: header
      name: Authorization
      prefix: 'Bearer '
      suffix: ''
withEnumerationPhase: true
enumerationPhase:
  paginationType: offsetLimit
  limit: 200
  request:
    responseType: json
    method: GET
    url: ${parameters.domain}/v1/cp/users
    headers:
      - name: Accept
        value: application/json
    queryParams:
      - name: offset
        value: ${pagination.offset}
      - name: limit
        value: ${pagination.limit}
  output:
    select: "[.users[].id]"
    map: "."
    outputMode: element
collectionPhase:
  variables:
    - source: input
      name: userId
      expression: "."
      format: ""
  paginationType: none
  request:
    responseType: json
    method: GET
    url: ${parameters.domain}/v1/cp/audits
    headers:
      - name: Accept
        value: application/json
    queryParams:
      - name: start_date
        value: ${temporalWindow.from}
      - name: end_date
        value: ${temporalWindow.to}
      - name: object_type
        value: user
      - name: object_id
        value: ${inputs.userId}
  output:
    select: ".audits.entries"
    map: "."
    outputMode: element

Manually configure

When you're done, click Create labels to move on to the next step and define the required Labels if needed.