Box.com Events API

Box.com integration (Enterprise) outline

Create an APP on box.com (a new Box App from the Box Developer Console)
Enter your Box APP credentials into Fluency
Configure Fluency Platform / App Integration

Fluency pulls audit events (admin_log) from the Box Enterprise Events API
https://developer.box.com/guides/events/enterprise-events/for-enterprise/

Setting up on Box.com

Create a new Box app in your Box Developer Console
1. In a separate browser tab or window, log in to the Box Developer Console (https://app.box.com/developers/console)
3. Create Platform App
4. Select Custom App for the app type, then click Next
6. Enter a name for the app (i.e. Fluency), and complete the rest of the form to proceed to the next step
7. Select Server Authentication (Client Credentials Grant), enter a name for your app (e.g. Fluency), then click Create App
9. Choose the new App from the list of available Platform Apps, and click to Edit
11. On the App Access Level section of the Configuration page, select the App + Enterprise Access option
13. On the Application Scopes section, make sure Manage enterprise properties is selected
15. While in the Configuration tab, scroll down to the OAuth 2.0 Credentials section, to obtain the Client ID and Client Secret credentials
17. Save changes, to apply the changes from the above steps
Obtain Box.com credentials
1. In the Box Developer console, navigate to the new app you created. In the Configuration tab, scroll down to the OAuth 2.0 Credentials section
2. Copy the Client ID and Client Secret credentials
Obtain the Enterprise ID
1. In the Box Admin console, navigate to "Account and Billing" from the menu. The Enterprise ID should be under the Account Information section.
3. Copy the Enterprise ID
Authorize new App in the Box Admin Console
1. Log in to the Box Admin Console, and navigate to the Platform Apps Manager (https://app.box.com/master/platform-apps)
2. Add a Platform App, and enter the Client ID of the application just created.

Setting up on Fluency

Create REST API Integration, under Platform > Integrations

Add Environmental Variables, for the credentials from Box:
1. CLIENT_ID : 8lnmfhr9duj2bcl3wr0...
2. CLIENT_SECRET : GJaqaeoVjRXx...
3. ENTERPRISE_ID : 12345678...
Authentication: None
Method: any
URL: https://api.box.com
Encoding: any
Timeout: 30

Deploy/Import Reports processor BoxAPI_EventPull

function main({integration, state}) {
    // 
    printf("integration name : %s", integration)
    printf("current state :    %s", state)
    // let state = {} // testing use only
        
    let items = []
    let newState = {}
    
    let result = {}
    let args = { next_stream_position: state.next_stream_position }

    let continue_loop = true
    for let n=0; continue_loop; n++ {
        result = getEvents(integration, args)
        args = { next_stream_position: result.next_stream_position }
        continue_loop = len(result.items) > 0
        newState.next_stream_position = result.next_stream_position
        //printf("continue? %v", continue_loop)
        //printf("result.items? %v",result.items)
        if(result.items) {
            for _, item = range result.items {
                items = append(items, item)
            }
        }
        if (n > 10) {
            printf("force loop break, hold off until next poll")
            continue_loop = false
        }
    }
    let events = []
    for _, item = range items {
        let ts = new Time("2006-01-02T15:04:05Z07:00", item.created_at)
        let event = {        
            "@box": item,
            "@event_type": "box",
            "@eventType": "BoxEnterprise",
            "@type":"event",
            "@timestamp": ts.UnixMilli()
        }
        events = append(events, event)
    }
    printf("newState: %v", newState)
    //return {}
    return {state: newState, events}
}

function getEvents(integration, args) {
    let response = Platform_REST_Call(integration, {
        debug: false,
        method: "POST",
        path: "/oauth2/token",
        encoding: "form",
        paras: [
            {name: "client_id", variable:"CLIENT_ID"},
            {name: "client_secret", variable:"CLIENT_SECRET"},
            {name: "grant_type", value:"client_credentials"},
            {name: "box_subject_type", value:"enterprise"},
            {name: "box_subject_id", variable:"ENTERPRISE_ID"}
        ]
    })
    // printf("oauth: %s", response)
    
    let callArgs = {
        debug: false,
        method: "GET",
        path: "/2.0/events",
        encoding: "url",
        headers: [
            {header: "authorization", value: sprintf("Bearer %s", response.data.access_token)}
        ],
        paras:[
            {name: "stream_type", value:"admin_logs_streaming"}
        ]
    }
    
    if(args.next_stream_position) {
        // printf("previous next_stream_position: %s", args.next_stream_position)
        callArgs.paras = append(callArgs.paras,{ name: "stream_position", value: args.next_stream_position } )
        // printf("%v",callArgs)
    }
    
    let result = Platform_REST_Call(integration, callArgs)
    // printf("events: %s", result)
    printf("events next_stream_position: %d", result.data.next_stream_position)
    printf("events fetched entries :     %d", len(result.data.entries))
    // printf("events entries: %s", result.data.entries)
    return {items: result.data.entries, next_stream_position: sprintf("%d",result.data.next_stream_position)}
}

Create data Source: API Pull
1. Using Integration from above
2. Use report processor from above
3. Poll interval: 300
Create router BoxAPIAdjustments
1. Add processor passthrough
Connect Router to EventWatch sink
Connect Source to Router