Nikhil Chawla Add-on for Absolute Secure Endpoint

Collects Absolute Secure Endpoint data from the Absolute API and maps it to the Splunk Common Information Model. - SIEM events (sourcetype absolute:events): what devices report (applications installed, removed and updated; hardware, network, OS and user changes; location and geofence changes; encryption, antivirus and application-persistence status), what console users do (sign-ins, account and role changes, rules, geofences, policy groups, device freeze, disable and unenroll, location lookups), and alerts (alert rules that fired, connections blocked in restricted regions). The same events Absolute's SIEM Connector sends to a syslog server, read straight from the API, with each event's id and as JSON. - Devices (sourcetype absolute:devices): an inventory snapshot, one event per device: hardware, OS, users, agent, addresses, encryption, antivirus, location. CIM: Authentication, Change (Account_Management, Endpoint_Changes), Alerts, Data Access and Inventory. A saved search builds an Enterprise Security asset lookup from the device inventory. - Inputs page in Splunk Web: Absolute accounts (API host, token ID and secret key, optional proxy; stored encrypted in Splunk's credential store; a Test button checks the token) and inputs: add, edit, enable, disable, run now, delete. - SIEM events are collected from a checkpoint in overlapping windows and de-duplicated by event id: restarts and failures do not lose events. If Splunk stops a run part-way (input disabled or restarted), the next run continues from the checkpoint; at most the window it was cut off in is sent again. - Status dashboard: last run, events and devices collected, minutes behind, errors, how late events arrive. Overview dashboard: event types, console activity, alerts, posture changes, devices by OS, agent, encryption and antivirus. - Python standard library only, no third-party packages. Independent project, not affiliated with or endorsed by Absolute Software. Absolute and Absolute Secure Endpoint are trademarks of Absolute Software Corporation.