Cribl Authentication Guide | Tines Explained

First, get credentials from Cribl

Login to Cribl Cloud
Copy the "Organization ID" to a text editor
Navigate to Account > Organization
Select “API Management” and click “Add Credential”
Name the credential and click "Create"
Copy the "Client ID" and "Client Secret" to a text editor

Next, create a Resource in Tines

Login to your Tines tenant
Navigate to the team that will be using the API and click "Resource"
Click "+ New Resource"
Input the values for the Cribl resource
1. Name: cribl_cloud_tenant
2. Description: Optional
3. Builder: Organization ID you copied earlier
Optional
1. Access: What other teams can also use the resource
Click "Save resource"

Lastly, create Credentials in Tines

You will need to create three credentials:

Two Text type: "cribl_client_id" and "cribl_client_secret"
One HTTP request type: "cribl"

Text type

Navigate to the team that will be using the API and click "Credential"
Click "+ New Credential" and select "Text"
Input the values for the Cribl credential
1. Name: cribl_client_id
2. Description: Optional
3. Value: Client ID you copied earlier
Optional
1. Domains: Ensure this credential can only be used when making HTTP requests to specific domains
2. Access: What other teams can also use the API
Click "Save"
Click "+ New Credential" and select "Text"
Input the values for the Cribl credential
1. Name: cribl_client_secret
2. Description: Optional
3. Value: Client Secret you copied earlier
Optional
1. Domains: Ensure this credential can only be used when making HTTP requests to specific domains
2. Access: What other teams can also use the API
Click "Save"

HTTP request type

Click "+ New Credential" and select "HTTP Request"
Input the values for the Cribl credential
1. Name: cribl
2. Description: Optional
3. URL: https://login.cribl.cloud/oauth/token
4. Content Type: Form
5. Method: post
6. Payload: Copy the below object and paste into the "Plain code" section:
```
{
  "grant_type": "client_credentials",
  "client_id": "<<CREDENTIAL.cribl_client_id>>",
  "client_secret": "<<CREDENTIAL.cribl_client_secret>>",
  "audience": "https://api.cribl.cloud"
}
```
7. Click "Run options", navigate to the access_token key and double click on the key
8. Location of token from response: Paste the path to the token in the value pill
Optional
1. Domains: Ensure this credential can only be used when making HTTP requests to specific domains
2. Access: What other teams can also use the API
Click "Save"

Your credential should look like the following:

More on creating credentials in Tines here.

You can also find a selection of Cribl stories in the story library.

Using the credential in an action

Below is an example Cribl action you can copy and paste onto your storyboard in Tines.

{"standardLibVersion":"36","actionRuntimeVersion":"4","agents":[{"disabled":false,"name":"Search for IP with Cribl Search","description":"","options":"{\"url\":\"https://main-<<RESOURCE.cribl_cloud_tenant>>.cribl.cloud/api/v1/m/default_search/search/jobs\",\"content_type\":\"application/json\",\"method\":\"post\",\"payload\":\"<<form_job_for_cribl_search>>\",\"headers\":{\"Authorization\":\"Bearer <<CREDENTIAL.cribl>>\"}}","position":{"x":330,"y":285},"type":"httpRequest","timeSavedUnit":"minutes","timeSavedValue":0,"monitorAllEvents":false,"monitorFailures":false,"monitorNoEventsEmitted":null,"recordType":null,"recordWriters":[],"form":null,"cardIconName":null,"createdFromTemplateGuid":null,"createdFromTemplateVersion":null,"originStoryIdentifier":"cloud:d521f765a49c72507257a2620612ee96:5c48842be45a853fdd16795ec4699d6c"}],"links":[],"diagramNotes":[]}

WatchGuard Authentication Guide

JAMF Authentication Guide