Splunk Add-on for Box : Not able to capture the logs due to API access limit

Applicability

Description

Cannot capture logs using the Splunk Add-on for Box, and finding API failures.

Investigation

Check the internal logs for the input using the below SPL:

index=_internal *box* log_level=Error

And receiving the below erros:

Error:

2024-01-26 01:25:37,133 ERROR pid=60862 tid=139722237933248 tname=MainThread filename=box_helper.py::fetch_data #62 | Failed to connect url=https://api.box.com/2.0/events?stream_type=admin_logs_streaming&limit=500&stream_position=0, message=None, status=403, code=, context_info=Traceback (most recent call last):
File "/opt/splunk/etc/apps/Splunk_TA_box/bin/box_client.py", line 198, in make_request
params=params,
File "/opt/splunk/etc/apps/Splunk_TA_box/lib/boxsdk/util/api_call_decorator.py", line 63, in call
return method(*args, **kwargs)
File "/opt/splunk/etc/apps/Splunk_TA_box/lib/boxsdk/client/client.py", line 1144, in make_request
return self._session.request(method, url, **kwargs)
File "/opt/splunk/etc/apps/Splunk_TA_box/lib/boxsdk/session/session.py", line 138, in request
response = self._prepare_and_send_request(method, url, **kwargs)
File "/opt/splunk/etc/apps/Splunk_TA_box/lib/boxsdk/session/session.py", line 362, in _prepare_and_send_request
self._raise_on_unsuccessful_request(network_response, request, raised_exception)
File "/opt/splunk/etc/apps/Splunk_TA_box/lib/boxsdk/session/session.py", line 280, in _raise_on_unsuccessful_request
network_response=network_response
boxsdk.exception.BoxAPIException: Message: None
Status: 403
Code: None
Request ID: None
Headers: {'Date': 'Fri, 26 Jan 2024 01:25:37 GMT', 'x-envoy-upstream-service-time': '202', 'www-authenticate': 'Bearer realm="Service", error="insufficient_scope", error_description="The request requires higher privileges than provided by the access token."', 'box-request-id': '0865c685f24f3b9c08f971ee80957d643', 'strict-transport-security': 'max-age=31536000', 'Via': '1.1 google', 'Content-Length': '0', 'Alt-Svc': 'h3=":443"; ma=2592000,h3-29=":443"; ma=2592000'}
URL: https://api.box.com/2.0/events?stream_type=admin_logs_streaming&limit=500&stream_position=0
Method: GET
Context Info: None

The error indicates the permission realted issues.
So, need to check the user permission over the source, which is used to configure the inputs over the add-on.

Resolution

Box account with a co-admin role, needs to enable the permission to "Run new reports and access existing reports" for that account.

Related Links

Splunk Documentation for Box API Permissions