Project

General

Profile

Use Forms Authentication » History » Version 2

Luke Murphey, 05/09/2018 07:02 PM

1 1 Luke Murphey
h1. Use HTML Form Authentication
2 1 Luke Murphey
3 1 Luke Murphey
Website Monitoring does not currently support HTML forms authentication (the type of authentication where you fill out an HTML form to get the website to let you in). However, you may be able to use the Website Inputs app instead since it does support form authentication. You could so this by:
4 1 Luke Murphey
5 1 Luke Murphey
# Installing Website Inputs (see https://splunkbase.splunk.com/app/1818/)
6 1 Luke Murphey
# Create an input against the website you want to monitor. I recommend using the wizard that is built into the app.
7 1 Luke Murphey
## When you get the step two of the wizard ("Enter Credentials"), make sure to set the authentication so that you can log in to the website.
8 1 Luke Murphey
## Leave the selector blank in step three ("Define CSS Selector") 
9 1 Luke Murphey
# Create a search to analyze the output of the input you just created such that it alerts you accordingly. You will likely want to consider the following fields:
10 1 Luke Murphey
## content_md5
11 1 Luke Murphey
## content_sha224
12 1 Luke Murphey
## response_code
13 1 Luke Murphey
## response_size
14 2 Luke Murphey
## request_time
15 1 Luke Murphey
16 1 Luke Murphey
Once you get the input created, you could use a search like this:
17 1 Luke Murphey
18 1 Luke Murphey
<pre>
19 1 Luke Murphey
source="web_input://my_input_with_forms_auth" | table _time content* response*
20 1 Luke Murphey
</pre>