Instrument a Python application

Instrument a Python application for Secure Application.

Follow the steps that correspond to your Python application's environment:

Instrument a Python application in a non-Kubernetes environment

Instrument a Python application with the Secure Application Python extension.

Secure Application integrates runtime security detection into your Python application through a Python extension (secureapp-python-agent) that works with the Splunk Distribution of OpenTelemetry Python. This extension sends the OpenTelemetry events and logs that Secure Application needs to Splunk Observability Cloud. Follow these steps to add this extension to your Python application.

Note: The examples in this topic are for a Linux environment.
  1. Install the Secure Application Python extension (secureapp-python-agent):

    • If you've already installed the Splunk Distribution of OpenTelemetry Python, you already have the Splunk instrumentation agent (splunk-opentelemetry) installed. Just install the Secure Application Python extension:

      BASH 
      pip install secureapp-python-agent

    • Otherwise, install the Secure Application Python extension together with the Splunk instrumentation agent (splunk-opentelemetry):

      BASH 
      pip install "splunk-opentelemetry[secureapp]"
    Tip: If you're using a requirements.txt or pyproject.toml file, add splunk-opentelemetry to it.
  2. (Optional) Set these environment variables to customize the behavior of the Secure Application Python extension. However, using the default values is strongly recommended:
    Environment variable Default Description
    SPLUNK_SECUREAPP_AGENT_ENABLED true Activate or deactivate the agent.
    SPLUNK_SECUREAPP_DEPENDENCY_INITIAL_DELAY 60.0 Initial delay (seconds) before dependency tracking starts.
    SPLUNK_SECUREAPP_DEPENDENCY_SCAN_INTERVAL 86400 Interval (seconds) between dependency scans (24 hours).

    Example:

    BASH 
    export SPLUNK_SECUREAPP_AGENT_ENABLED=true
export SPLUNK_SECUREAPP_DEPENDENCY_INITIAL_DELAY=60
export SPLUNK_SECUREAPP_DEPENDENCY_SCAN_INTERVAL=86400
  3. (Optional) If you haven't already done so, run the opentelemetry-bootstrap tool to scan your current Python environment, detect which libraries you have installed, and automatically install the necessary OpenTelemetry instrumentation packages for them:
    BASH 
    opentelemetry-bootstrap -a install

    Alternatively, run the opentelemetry-bootstrap tool to print the supported packages to the console, and add the output to your requirements.txt or pipfile:

    CODE 
    opentelemetry-bootstrap
  4. Run your Python application with the opentelemetry-instrument wrapper.
    BASH 
    opentelemetry-instrument python3 <application-name>.py
  5. (Optional) Send data directly to Splunk Observability Cloud.

    By default, the extension sends all telemetry to the local instance of the Splunk Distribution of OpenTelemetry Collector. To send data directly to Splunk Observability Cloud, set the SPLUNK_ACCESS_TOKEN and SPLUNK_REALM environment variables:

    BASH 
    export SPLUNK_ACCESS_TOKEN=<access-token>
export SPLUNK_REALM=<realm>

    To obtain a Splunk access token, see Retrieve and manage user API access tokens using Splunk Observability Cloud. To find your Splunk realm, see Configure SSO integrations for Splunk Observability Cloud. For more information on the ingest API endpoints, see Send APM traces.

  6. Set service metadata for your Python application.

    For descriptions of these environment variables, see Configure the Python agent for Splunk Observability Cloud:

    • OTEL_SERVICE_NAME
    • OTEL_RESOURCE_ATTRIBUTES

    Sample minimal configuration for a Kubernetes environment:

    BASH 
    export OTEL_SERVICE_NAME=<application-name>
export OTEL_RESOURCE_ATTRIBUTES="service.name=<application-name>,service.version=<version>"

Your Python application:

  • Sends vulnerability and library data to the Splunk Observability Cloud backend.

  • Collects potential attack events at runtime.

  • Reports data once at application startup and then every 24 hours thereafter.