> For the complete documentation index, see [llms.txt](https://docs.onum.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.onum.com/the-workspace/listeners/listener-integrations/pull-data-from-http-endpoints/collect-data-from-absolute.md).

# Collect data from Absolute

## Overview

Use the **HTTP Pull** Listener to collect data from the [Absolute API](https://abnormalsecurity.my.site.com/knowledgebase/s/article/Abnormal-REST-API-Integration). Currently, we support the device reporting endpoint.

## HTTP Pull Listener configuration

In Falcon Onum, go to the **Listeners** area and click **New Listener > HTTP Pull**. Give a name to your new Listener and enter the following data:

### Parameters

N/A

### Secrets

You must define these credentials in Onum:

* `secretKey` will reference your Absolute secret key.
* `TokenId` will reference your Absolute token ID.

To do it, click **Add element** and enter a **Name** for the secret (in this case, `secretKey`). Then, click the **Value** field and select **New secret** to create a new one:

* Give the secret a **Name**.
* Turn off the **Expiration date** option.
* Click **Add new value** and paste the secret corresponding to the value.
* Click **Save**.

You can now select the secret you just created in the **Value** field list. Repeat the process for the `TokenId`.

{% hint style="info" %}
Learn more about secrets in Onum in [this article](/administration/global-settings/organization-settings/secrets-management.md).
{% endhint %}

### Setup

After entering the required parameters and secrets, you can choose to manually enter the rest of configuration fields, or simply paste the given YAML:

{% tabs %}
{% tab title="Config as YAML" %}
Toggle **ON** the **Config as YAML** option to enable a free text field where you can paste the following YAML:

```yaml
withTemporalWindow: true
temporalWindow:
  duration: 5m
  offset: 5m
  tz: UTC
  format: RFC3339
withAuthentication: true
authentication:
  type: hmac
  hmac:
    request:
      generateId: false
      idType: uuid
      generateTimestamp: true
      timestamp:
        tz: UTC
        format: RFC1123
    hash:
      algorithm: hmac_sha256
      encoding: base64
      secretKey: ${secrets.secretKey}
      dataToSign: "${request.method}\n${request.relativeUrl}\n${request.timestamp}\n${request.body}\n"
    headers:
      - name: x-abs-date
        value: ${request.timestamp}
      - name: Authorization
        value: "Absolute token=${secrets.TokenId}:${hmac.hash}"
withEnumerationPhase: false
collectionPhase:
  paginationType: "responseBodyLink"
  responseBodyLinkSelector: ".metadata.pagination.nextPage"
  request:
    responseType: json
    method: "GET"
    url: "https://api.absolute.com/v3/reporting/devices"
    headers:
      - name: Accept
        value: "application/json"
      - name: Content-Type
        value: "application/json"
    queryParams: 
      - name: nextPage
        value: "${pagination.responseBodyLink}"
      - name: pageSize
        value: "500"
      - name: timeZone
        value: "UTC"
      - name: lastUpdatedDateTimeUtcFromInclusive
        value: ${temporalWindow.from}
      - name: lastUpdatedDateTimeUtcTo
        value: ${temporalWindow.to}
  output:
    select: ".data"
    map: "."
    outputMode: "element"
```

{% endtab %}

{% tab title="Manually configure" %}
**Temporal Window**

Toggle **ON** to add a temporal window for events. This repeatedly shifts the time window over which data is collected.

* **Duration**<mark style="color:$primary;">**\***</mark> - `5m`
* **Offset**<mark style="color:$primary;">**\***</mark> - `5m`
* **Format**<mark style="color:$primary;">**\***</mark> - `RFC3339`

**Authentication**

Toggle **ON** to configure the authentication phase.&#x20;

* **Type**<mark style="color:red;">**\***</mark> - `HMAC`
* **HMAC**
  * **Request**
    * **Generate Timestamp** - Toggle **ON**
    * **Timestamp**
      * **Format** - `RFC1123`
  * **Hash**
    * **Hashing algorithm**<mark style="color:$primary;">**\***</mark> - SHA256&#x20;
    * **Format**<mark style="color:$primary;">**\***</mark> - `base64`&#x20;
    * **Secret key** - `${secrets.secretKey}`&#x20;
    * **Data to sign**<mark style="color:$primary;">**\***</mark> - `${request.method}\n${request.relativeUrl}\n${request.timestamp}\n${request.body}\n${request.method}\n${request.relativeUrl}\n${request.timestamp}\n${request.body}\n`&#x20;
  * **Headers**
    * **Name** - `x-abs-date`
    * **Value** - `${request.timestamp}`
    * **Name** - `authorization`
    * **Value** - `Absolute token=${secrets.TokenId}:${hmac.hash}`

**Collection Phase**&#x20;

* **Pagination Type**<mark style="color:red;">**\***</mark> - `Next Link at Response Body`
* **Selector**<mark style="color:red;">**\***</mark> - `.metadata.pagination.nextPage`
* **Request**&#x20;
  * **Response type**<mark style="color:$primary;">**\***</mark> - `JSON`
  * **Method**<mark style="color:red;">**\***</mark> - `GET`
  * **URL**<mark style="color:red;">**\***</mark> - `https://api.absolute.com/v3/reporting/devices`
  * **Headers**
    * **Name** - `Accept`
    * **Value** - `application/json`
    * **Name** - `Content-Type`
    * **Value** - `application/json`
  * **Query params**
    * **Name** - `nextPage`
    * **Value** - `${pagination.responseBodyLink}`
    * **Name** - `pageSize`
    * **Value** - `500`
    * **Name** - `TimeZone`
    * **Value** - `yourtimezone`
    * **Name** - `lastUpdatedDateTimeUtcFromInclusive`
    * **Value** - `${temporalWindow.from}`
    * **Name** - `lastUpdatedDateTimeUtcTo`
    * **Value** - `${temporalWindow.to}`
* **Output**&#x20;
  * **Select**<mark style="color:$primary;">**\***</mark> - `.data`
  * **Map** - `.`
  * **Output Mode**<mark style="color:$primary;">**\***</mark> - `element`
    {% endtab %}
    {% endtabs %}

When you're done, click **Create labels** to move on to the next step and define the required [Labels](/the-workspace/listeners/labels.md) if needed.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.onum.com/the-workspace/listeners/listener-integrations/pull-data-from-http-endpoints/collect-data-from-absolute.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.