Skip to main content
Cribl Authentication Guide

How to authenticate Cribl for use with Tines

Daniel Stoeski avatar
Written by Daniel Stoeski
Updated over a year ago

First, get credentials from Cribl

  1. Login to Cribl Cloud

  2. Copy the "Organization ID" to a text editor


  3. Navigate to Account > Organization


  4. Select “API Management” and click “Add Credential”


  5. Name the credential and click "Create"


  6. Copy the "Client ID" and "Client Secret" to a text editor

Next, create a Resource in Tines

  1. Login to your Tines tenant

  2. Navigate to the team that will be using the API and click "Resource"

  3. Click "+ New Resource"

  4. Input the values for the Cribl resource

    1. Name: cribl_cloud_tenant

    2. Description: Optional

    3. Builder: Organization ID you copied earlier

  5. Optional

    1. Access: What other teams can also use the resource

  6. Click "Save resource"

Lastly, create Credentials in Tines

You will need to create three credentials:

  • Two Text type: "cribl_client_id" and "cribl_client_secret"

  • One HTTP request type: "cribl"

Text type

  1. Navigate to the team that will be using the API and click "Credential"

  2. Click "+ New Credential" and select "Text"

  3. Input the values for the Cribl credential

    1. Name: cribl_client_id

    2. Description: Optional

    3. Value: Client ID you copied earlier

  4. Optional

    1. Domains: Ensure this credential can only be used when making HTTP requests to specific domains

    2. Access: What other teams can also use the API

  5. Click "Save"

  6. Click "+ New Credential" and select "Text"

  7. Input the values for the Cribl credential

    1. Name: cribl_client_secret

    2. Description: Optional

    3. Value: Client Secret you copied earlier

  8. Optional

    1. Domains: Ensure this credential can only be used when making HTTP requests to specific domains

    2. Access: What other teams can also use the API

  9. Click "Save"

HTTP request type

  1. Click "+ New Credential" and select "HTTP Request"

  2. Input the values for the Cribl credential

    1. Name: cribl

    2. Description: Optional

    3. URL: https://login.cribl.cloud/oauth/token

    4. Content Type: Form

    5. Method: post

    6. Payload: Copy the below object and paste into the "Plain code" section:

      {
      "grant_type": "client_credentials",
      "client_id": "<<CREDENTIAL.cribl_client_id>>",
      "client_secret": "<<CREDENTIAL.cribl_client_secret>>",
      "audience": "https://api.cribl.cloud"
      }

    7. Click "Run options", navigate to the access_token key and double click on the key


    8. Location of token from response: Paste the path to the token in the value pill

  3. Optional

    1. Domains: Ensure this credential can only be used when making HTTP requests to specific domains

    2. Access: What other teams can also use the API

  4. Click "Save"

Your credential should look like the following:

More on creating credentials in Tines here.

You can also find a selection of Cribl stories in the story library.

Using the credential in an action

Below is an example Cribl action you can copy and paste onto your storyboard in Tines.

{"standardLibVersion":"36","actionRuntimeVersion":"4","agents":[{"disabled":false,"name":"Search for IP with Cribl Search","description":"","options":"{\"url\":\"https://main-<<RESOURCE.cribl_cloud_tenant>>.cribl.cloud/api/v1/m/default_search/search/jobs\",\"content_type\":\"application/json\",\"method\":\"post\",\"payload\":\"<<form_job_for_cribl_search>>\",\"headers\":{\"Authorization\":\"Bearer <<CREDENTIAL.cribl>>\"}}","position":{"x":330,"y":285},"type":"httpRequest","timeSavedUnit":"minutes","timeSavedValue":0,"monitorAllEvents":false,"monitorFailures":false,"monitorNoEventsEmitted":null,"recordType":null,"recordWriters":[],"form":null,"cardIconName":null,"createdFromTemplateGuid":null,"createdFromTemplateVersion":null,"originStoryIdentifier":"cloud:d521f765a49c72507257a2620612ee96:5c48842be45a853fdd16795ec4699d6c"}],"links":[],"diagramNotes":[]}
Did this answer your question?