Skip to content

Integration to receive Zoom QSS QoS events via websocket and forward them to Falcon LogScale.

License

Notifications You must be signed in to change notification settings

CrowdStrike/Zoom-QSS-WebSocket-Falcon-Logscale-Integration

Repository files navigation

CrowdStrike Zoom QSS_to_LogScale

Twitter URL

Zoom QSS WebSocket Events to LogScale Ingest

This integration provides Python3 code and supporting assets to create a persistent WebSocket connection to the Zoom QSS api, in order to receive Zoom QoS events, and forward them to LogScale for ingest.

Zoom QSS (Quality of Service Subscription) provides near real-time quality of service (QoS) telemetry for Zoom video conference calls, webinars, and phone calls.

The Python3 code in this integration provides two (2) persistent coroutines:

  • a connection heart-beat pulse.
  • an event loop that receives and forwards QSS/QoS events.

This integration is a companion to the Zoom Qss LogScale package. The Zoom Qss LogScale package comprises the set assets that provide search analytics and data visualization of Zoom Qss QoS telemetry.

Installation and Setup

Create a Zoom Server-to-Server OAuth app

  • Sign into you Zoom account.

  • Navigate to the Zoom Marketplace

  • Create a Server-to-Server OAuth app for WebSocket API access.

  • Apply the following scopes to your app:

    Scope Name ID
    View all users' meetings information on Dashboard dashboard_meetings:read:adminDelete
    View all users' webinar information on Dashboard dashboard_webinars:read:adminDelete

    Note: This integration does not currently support Zoom phone calls

Prepare the integration

Prepare the Docker image Environmental Variables file

  • create directory: /etc/zoom-qss
  • create the vars file: /etc/zoom-qss/env.vars
  • add the environmental variable definitions (note: values should be bare. i.e. unquoted)
    LOGSCALE_HOST=<host>
    LOGSCALE_INGEST_TOKEN=<token>
    LOGSCALE_REPOSITORY=<repository>
    ZOOM_ACCOUNT_ID=<acct id>
    ZOOM_CLIENT_ID=<client id>
    ZOOM_CLIENT_SECRET=<secret>
    ZOOM_WSS_URL=<url>
    
    • LogScale variables
      • LOGSCALE_HOST - LogScale server
      • LOGSCALE_REPOSITORY - LogScale repository
      • LOGSCALE_INGEST_TOKEN - LogScale ingest token
    • Zoom API variables (from the Zoom app)

Prepare LogScale

Setup the Ingest Repository

  • select, or create a target ingest repository

  • create an ingest token, or use the default ingest token

    • install the LogScale Zoom QSS package.
    • assign the zoom_qss parser to the repository
optionally set logging level to DEBUG to view payload delivery and heartbeat progress
    logger.setLevel(logging.DEBUG)

warning: DEBUG output generates copious logging

Prepare the Python Docker image

  • cd to the directory that contains the Dockerfile, Python code, and requirements.txt
  • build the docker image:
    • docker build -t zoom-qss .

Prepare the systemd service

  • install the qss2logscale service file
    • cp qss2logscale.service /etc/systemd/system
    • systemctl daemon-reload
  • start the qss2logscale service
    • service qss2logscale start

Verify event delivery

  • if DEBUG logging was enabled, check syslog for payload and heartbeat logging.
  • check the LogScale repository to verify that events are arriving


WE STOP BREACHES

About

Integration to receive Zoom QSS QoS events via websocket and forward them to Falcon LogScale.

Resources

License

Code of conduct

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published