Normalize and ingest raw records
For the complete documentation index, see https://devlookout.com/llms.txt. Uses a built-in normalizer. Supported IDs are zeek, syslog-rfc5424, opentelemetry-log, tailscale-logs, and linux-journal.
POST
/
api
/
v1
/
ingest
/
{normalizer}
Normalize and ingest raw records
curl --request POST \
--url https://lookout.example.com/api/v1/ingest/{normalizer} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '[
{}
]'import requests
url = "https://lookout.example.com/api/v1/ingest/{normalizer}"
payload = [{}]
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify([{}])
};
fetch('https://lookout.example.com/api/v1/ingest/{normalizer}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://lookout.example.com/api/v1/ingest/{normalizer}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
[
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://lookout.example.com/api/v1/ingest/{normalizer}"
payload := strings.NewReader("[\n {}\n]")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://lookout.example.com/api/v1/ingest/{normalizer}")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("[\n {}\n]")
.asString();require 'uri'
require 'net/http'
url = URI("https://lookout.example.com/api/v1/ingest/{normalizer}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "[\n {}\n]"
response = http.request(request)
puts response.read_body{
"accepted": [
{
"schemaVersion": 1,
"id": "<string>",
"category": "identity",
"class": "<string>",
"activity": "<string>",
"outcome": "success",
"time": "2023-11-07T05:31:56Z",
"ingestedAt": "2023-11-07T05:31:56Z",
"source": {
"adapter": "<string>",
"instance": "<string>",
"recordId": "<string>"
},
"entityKeys": [
"<string>"
],
"attributes": {},
"severity": 5,
"actor": {},
"sourceEndpoint": {},
"destinationEndpoint": {},
"service": {},
"correlation": {},
"rawReference": "<string>"
}
],
"alerts": [
{
"id": "<string>",
"status": "open"
}
],
"incidents": [
{
"id": "<string>"
}
]
}{
"error": "<string>",
"issues": [
"<string>"
]
}{
"error": "<string>",
"issues": [
"<string>"
]
}{
"error": "<string>",
"issues": [
"<string>"
]
}{
"error": "<string>",
"issues": [
"<string>"
]
}Authorizations
A 256-bit token generated by the Lookout CLI.
Path Parameters
Available options:
zeek, syslog-rfc5424, opentelemetry-log, tailscale-logs, linux-journal Query Parameters
Required for Zeek and Tailscale inputs.
Tailnet identifier for Tailscale records.
Body
application/json
- object[]
- object
The body is of type object.
⌘I
Normalize and ingest raw records
curl --request POST \
--url https://lookout.example.com/api/v1/ingest/{normalizer} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '[
{}
]'import requests
url = "https://lookout.example.com/api/v1/ingest/{normalizer}"
payload = [{}]
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify([{}])
};
fetch('https://lookout.example.com/api/v1/ingest/{normalizer}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://lookout.example.com/api/v1/ingest/{normalizer}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
[
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://lookout.example.com/api/v1/ingest/{normalizer}"
payload := strings.NewReader("[\n {}\n]")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://lookout.example.com/api/v1/ingest/{normalizer}")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("[\n {}\n]")
.asString();require 'uri'
require 'net/http'
url = URI("https://lookout.example.com/api/v1/ingest/{normalizer}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "[\n {}\n]"
response = http.request(request)
puts response.read_body{
"accepted": [
{
"schemaVersion": 1,
"id": "<string>",
"category": "identity",
"class": "<string>",
"activity": "<string>",
"outcome": "success",
"time": "2023-11-07T05:31:56Z",
"ingestedAt": "2023-11-07T05:31:56Z",
"source": {
"adapter": "<string>",
"instance": "<string>",
"recordId": "<string>"
},
"entityKeys": [
"<string>"
],
"attributes": {},
"severity": 5,
"actor": {},
"sourceEndpoint": {},
"destinationEndpoint": {},
"service": {},
"correlation": {},
"rawReference": "<string>"
}
],
"alerts": [
{
"id": "<string>",
"status": "open"
}
],
"incidents": [
{
"id": "<string>"
}
]
}{
"error": "<string>",
"issues": [
"<string>"
]
}{
"error": "<string>",
"issues": [
"<string>"
]
}{
"error": "<string>",
"issues": [
"<string>"
]
}{
"error": "<string>",
"issues": [
"<string>"
]
}