Nikhil Chawla Add-on for AirWatch (Workspace ONE UEM)

Collects device GPS locations from Workspace ONE UEM (AirWatch) over its REST API and indexes them as JSON events, sourcetype airwatch:gps. Each sample gets the device's serial number, friendly name, user name and e-mail address, and the nearest city, county, state and country from a bundled GeoNames city list (offline, no lookups to outside services). - One input per console, several consoles per heavy forwarder - Inputs page in Splunk Web: add OAuth clients (client secrets stored encrypted in Splunk's credential store) and inputs; test, enable, disable, and run now (for schedules in seconds) - Status dashboard: last run per input, devices and samples per run, errors, indexed samples per hour - Optional CEF output: one CEF file per run, for a syslog agent to forward to another SIEM - Each run picks up where the last good run ended, with an overlap; each sample is written once - Read-only towards the console: an OAuth token, the device list and the GPS search - Python standard library only, no third-party packages These events hold the positions of named people. Limit who can search the index. Independent project, not affiliated with or endorsed by the product's vendor. AirWatch and Workspace ONE are trademarks of their owners. City data: GeoNames, CC BY 4.0.