Humio

Integration with Humio.

Analytics & SIEM · Humio

Details

IDHumio
ProviderCrowdStrike
CategoryAnalytics & SIEM
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Integration with Humio

Configure Humio in Cortex

Parameter Description Required
url Humio URL True
API-key User API token True
insecure Trust any certificate (not secure) False
proxy Use system proxy settings False
queryParameter Query to use to fetch incidents False
queryRepository Fetch incidents from repository False
queryStartTime Fetch incidents from False
queryTimeZoneOffsetMinutes TimeZoneOffset in Minutes False
isFetch Fetch incidents False
incidentType Incident type False

Obtaining an API key

Go to https://your-humio/settings and copy the API token. Example https://cloud.humio.com/settings

Fetch incidents

The parameters used for fetch-incidents are only used if you want to use the fetch incidents feature. It is recommended to use alerts and notifiers in Humio to send this data to XSOAR via a webhook notifier instead. You can read more about the supported time-formats for backfilling here.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

humio-query

Query the data from Humio

Base Command

humio-query

Input

Argument Name Description Required
repository Repository to search Required
queryString Query string to use Required
start Relative or absolute (epoch) Optional
end Relative or absolute (epoch) Optional
isLive Answer with true, 1, t, y or yes Optional
timeZoneOffsetMinutes TimeZoneOffset in Minutes (default 0) Optional
arguments Additional arguments Optional

Context Output

Path Type Description
Humio.Query Unknown Query output

Command Example

!humio-query repository=sandbox queryString="foo=bar" start=24h end=now isLive=false

Context Example

{
    "Humio": {
        "Query": [
            [
                {
                    "#repo": "sandbox_Szpj6CNb6h7eWK1ZI09D9HFk",
                    "#type": "kv",
                    "@id": "hgXrSjcMWB08aJW40hfNUONL_3_2_1588676868",
                    "@rawstring": "foo=bar bar=foo",
                    "@session": "c12af55f-069d-43eb-840f-ff08fd11f685",
                    "@timestamp": 1588676868908,
                    "@timezone": "Z",
                    "bar": "foo",
                    "foo": "bar"
                },
                {
                    "#repo": "sandbox_Szpj6CNb6h7eWK1ZI09D9HFk",
                    "#type": "kv",
                    "@id": "hgXrSjcMWB08aJW40hfNUONL_3_1_1588676850",
                    "@rawstring": "foo=bar",
                    "@session": "c12af55f-069d-43eb-840f-ff08fd11f685",
                    "@timestamp": 1588676850226,
                    "@timezone": "Z",
                    "foo": "bar"
                }
            ]
        ]
    }
}

Human Readable Output

Humio Query Results

#repo #type @id @rawstring @session @timestamp @timezone bar foo
sandbox_Szpj6CNb6h7eWK1ZI09D9HFk kv hgXrSjcMWB08aJW40hfNUONL_3_2_1588676868 foo=bar bar=foo c12af55f-069d-43eb-840f-ff08fd11f685 1588676868908 Z foo bar
sandbox_Szpj6CNb6h7eWK1ZI09D9HFk kv hgXrSjcMWB08aJW40hfNUONL_3_1_1588676850 foo=bar c12af55f-069d-43eb-840f-ff08fd11f685 1588676850226 Z   bar

humio-query-job

Issue a query job to Humio

Base Command

humio-query-job

Input

Argument Name Description Required
queryString Query string to use Required
start Relative or absolute (epoch) Optional
end Relative or absolute (epoch) Optional
repository Repository to use Required
isLive Is it live? Optional
timeZoneOffsetMinutes Timezone offset in Minutes Optional
arguments Additional Arguments Optional

Context Output

Path Type Description
Humio.Job Unknown Query Job outputs

Command Example

!humio-query-job queryString="foo=bar" repository=sandbox

Context Example

{
    "Humio": {
        "Job": {
            "id": "1-1feyl7ulm_fmWhWmLhkPkWxZ",
            "queryOnView": "<M:foo=bar>"
        }
    }
}

Human Readable Output

Humio Query Job

id queryOnView
1-1feyl7ulm_fmWhWmLhkPkWxZ <M:foo=bar>

humio-poll

Issue poll command to Humio

Base Command

humio-poll

Input

Argument Name Description Required
repository Repository to use Required
id Id to poll for Required

Context Output

Path Type Description
Humio.Result Unknown Poll results
Humio.Result.cancelled Unknown If it was cancelled
Humio.Result.events Unknown Events in the poll
Humio.Result.done Unknown If its done
Humio.Result.metaData Unknown MetaData from the poll
Humio.Result.job_id String Humio Job id the results came from

Command Example

!humio-poll repository=sandbox id=1-mJg87kWn247FiYFpsnwZcx9G

Context Example

{
    "Humio": {
        "Result": {
            "cancelled": false,
            "done": true,
            "events": [
                {
                    "#repo": "sandbox_Szpj6CNb6h7eWK1ZI09D9HFk",
                    "#type": "kv",
                    "@id": "hgXrSjcMWB08aJW40hfNUONL_3_2_1588676868",
                    "@rawstring": "foo=bar bar=foo",
                    "@session": "c12af55f-069d-43eb-840f-ff08fd11f685",
                    "@timestamp": 1588676868908,
                    "@timezone": "Z",
                    "bar": "foo",
                    "foo": "bar"
                },
                {
                    "#repo": "sandbox_Szpj6CNb6h7eWK1ZI09D9HFk",
                    "#type": "kv",
                    "@id": "hgXrSjcMWB08aJW40hfNUONL_3_1_1588676850",
                    "@rawstring": "foo=bar",
                    "@session": "c12af55f-069d-43eb-840f-ff08fd11f685",
                    "@timestamp": 1588676850226,
                    "@timezone": "Z",
                    "foo": "bar"
                }
            ],
            "job_id": "1-mJg87kWn247FiYFpsnwZcx9G",
            "metaData": {
                "eventCount": 2,
                "extraData": {
                    "hasMoreEvents": "false"
                },
                "filterQuery": {
                    "end": 1588680722272,
                    "includeDeletedEvents": false,
                    "isInteractive": false,
                    "isLive": false,
                    "noResultUntilDone": false,
                    "queryString": "foo=bar",
                    "showQueryEventDistribution": false,
                    "start": 1588594322272
                },
                "isAggregate": false,
                "pollAfter": 1000,
                "processedBytes": 704,
                "processedEvents": 6,
                "queryEnd": 1588680722272,
                "queryStart": 1588594322272,
                "resultBufferSize": 2,
                "timeMillis": 280833,
                "totalWork": 1,
                "warnings": [],
                "workDone": 1
            }
        }
    }
}

Human Readable Output

Humio Poll Result

#repo #type @id @rawstring @session @timestamp @timezone bar foo
sandbox_Szpj6CNb6h7eWK1ZI09D9HFk kv hgXrSjcMWB08aJW40hfNUONL_3_2_1588676868 foo=bar bar=foo c12af55f-069d-43eb-840f-ff08fd11f685 1588676868908 Z foo bar
sandbox_Szpj6CNb6h7eWK1ZI09D9HFk kv hgXrSjcMWB08aJW40hfNUONL_3_1_1588676850 foo=bar c12af55f-069d-43eb-840f-ff08fd11f685 1588676850226 Z   bar

humio-delete-job

Issue a job delete command to Humio

Base Command

humio-delete-job

Input

Argument Name Description Required
id ID of the job to delete Required
repository Repository to use Required

Context Output

There is no context output for this command.

Command Example

!humio-delete-job repository=sandbox id=1-mJg87kWn247FiYFpsnwZcx9G

Context Example

{}

Human Readable Output

Command executed. Status code <Response [204]>

humio-list-alerts

List alerts from Humio

Base Command

humio-list-alerts

Input

Argument Name Description Required
repository Repository to use Required

Context Output

Path Type Description
Humio.Alert.description String Description of the alert
Humio.Alert.id String The alert id
Humio.Alert.name String The alert name
Humio.Alert.notifiers String The notifiers the alert will use
Humio.Alert.query.end String the end time of the query
Humio.Alert.query.isLive Number whether or not the query is live
Humio.Alert.query.queryString String The query string being used
Humio.Alert.query.start String The start time of the query
Humio.Alert.silenced Number Whether or not the alert is enabled
Humio.Alert.throttleTimeMillis Number The throttle time for alerts

Command Example

!humio-list-alerts repository=sandbox

Context Example

{
    "Humio": {
        "Alert": [
            {
                "description": "",
                "error": "All notifications failed.",
                "id": "ArHY37FM9Z8kWxYMRknwmdR5yJwNEUgc",
                "labels": [],
                "lastAlarm": 1588680716684,
                "name": "new_alert_namme2",
                "notifiers": [
                    "AQs6CuWm-uyXfYaNzwMyDGTX4S4qyAez"
                ],
                "query": {
                    "end": "now",
                    "isLive": true,
                    "queryString": "alert=true",
                    "start": "24h"
                },
                "silenced": false,
                "throttleTimeMillis": 300000
            },
            {
                "description": "",
                "error": "All notifications failed.",
                "id": "zXN-qja2pm5YFKVYDnllAmK4ctQ3wiOs",
                "labels": [],
                "lastAlarm": 1588680716684,
                "name": "new_alert_name3",
                "notifiers": [
                    "AQs6CuWm-uyXfYaNzwMyDGTX4S4qyAez"
                ],
                "query": {
                    "end": "now",
                    "isLive": true,
                    "queryString": "alert=true",
                    "start": "24h"
                },
                "silenced": false,
                "throttleTimeMillis": 300000
            },
            {
                "description": "",
                "error": "All notifications failed.",
                "id": "dIn3uuIvY4Gz90Bt2Dn2mVtDuB11ZUl2",
                "labels": [],
                "lastAlarm": 1588680716685,
                "name": "SampleAlert",
                "notifiers": [
                    "BTkuj8QArhIFMh_L39FoN0tnyTUEXplc"
                ],
                "query": {
                    "end": "now",
                    "isLive": true,
                    "queryString": "foo=bar",
                    "start": "24h"
                },
                "silenced": false,
                "throttleTimeMillis": 300000
            },
            {
                "description": "new_alert",
                "error": "All notifications failed.",
                "id": "kgguoWz0KgxEwge8IQt70L33C1J83U0C",
                "labels": [
                    "label"
                ],
                "lastAlarm": 1588680716684,
                "name": "new_alert_name",
                "notifiers": [
                    "AQs6CuWm-uyXfYaNzwMyDGTX4S4qyAez"
                ],
                "query": {
                    "end": "now",
                    "isLive": true,
                    "queryString": "alert=true",
                    "start": "24h"
                },
                "silenced": false,
                "throttleTimeMillis": 500000
            },
            {
                "description": "description 2",
                "id": "zNVae7vz-DH7GpeQUPfx1KXMGXGg7bf7",
                "labels": [
                    "label"
                ],
                "lastAlarm": 1588677696684,
                "name": "new name",
                "notifiers": [
                    "BTkuj8QArhIFMh_L39FoN0tnyTUEXplc"
                ],
                "query": {
                    "end": "now",
                    "isLive": true,
                    "queryString": "test=true",
                    "start": "24h"
                },
                "silenced": false,
                "throttleTimeMillis": 500000
            },
            {
                "description": "",
                "error": "All notifications failed.",
                "id": "sFeYsP2mOJ_-CAqKt9frixFIYzXluiTB",
                "labels": [],
                "lastAlarm": 1588680716684,
                "name": "new_alert_name2",
                "notifiers": [
                    "AQs6CuWm-uyXfYaNzwMyDGTX4S4qyAez"
                ],
                "query": {
                    "end": "now",
                    "isLive": true,
                    "queryString": "alert=true",
                    "start": "24h"
                },
                "silenced": false,
                "throttleTimeMillis": 300000
            },
            {
                "description": "",
                "error": "All notifications failed.",
                "id": "sn82IuvTc9Vfnl45XqLWoZASIcBezvu1",
                "labels": [],
                "lastAlarm": 1588680716684,
                "name": "new_alert_name4",
                "notifiers": [
                    "AQs6CuWm-uyXfYaNzwMyDGTX4S4qyAez"
                ],
                "query": {
                    "end": "now",
                    "isLive": true,
                    "queryString": "alert=true",
                    "start": "24h"
                },
                "silenced": false,
                "throttleTimeMillis": 300000
            },
            {
                "description": "",
                "error": "All notifications failed.",
                "id": "ljeBta_tEvrGRRbae7MzLRiZG4NbckBm",
                "labels": [],
                "lastAlarm": 1588680716684,
                "name": "new_alert_name5",
                "notifiers": [
                    "AQs6CuWm-uyXfYaNzwMyDGTX4S4qyAez"
                ],
                "query": {
                    "end": "now",
                    "isLive": true,
                    "queryString": "alert=true",
                    "start": "24h"
                },
                "silenced": false,
                "throttleTimeMillis": 300000
            }
        ]
    }
}

Human Readable Output

Humio Alerts

description error id labels lastAlarm name notifiers query silenced throttleTimeMillis
  All notifications failed. ArHY37FM9Z8kWxYMRknwmdR5yJwNEUgc   1588680716684 new_alert_namme2 AQs6CuWm-uyXfYaNzwMyDGTX4S4qyAez end: now
isLive: true
queryString: alert=true
start: 24h		 false 300000
  All notifications failed. zXN-qja2pm5YFKVYDnllAmK4ctQ3wiOs   1588680716684 new_alert_name3 AQs6CuWm-uyXfYaNzwMyDGTX4S4qyAez end: now
isLive: true
queryString: alert=true
start: 24h		 false 300000
  All notifications failed. dIn3uuIvY4Gz90Bt2Dn2mVtDuB11ZUl2   1588680716685 SampleAlert BTkuj8QArhIFMh_L39FoN0tnyTUEXplc end: now
isLive: true
queryString: foo=bar
start: 24h		 false 300000
new_alert All notifications failed. kgguoWz0KgxEwge8IQt70L33C1J83U0C label 1588680716684 new_alert_name AQs6CuWm-uyXfYaNzwMyDGTX4S4qyAez end: now
isLive: true
queryString: alert=true
start: 24h		 false 500000
description 2   zNVae7vz-DH7GpeQUPfx1KXMGXGg7bf7 label 1588677696684 new name BTkuj8QArhIFMh_L39FoN0tnyTUEXplc end: now
isLive: true
queryString: test=true
start: 24h		 false 500000
  All notifications failed. sFeYsP2mOJ_-CAqKt9frixFIYzXluiTB   1588680716684 new_alert_name2 AQs6CuWm-uyXfYaNzwMyDGTX4S4qyAez end: now
isLive: true
queryString: alert=true
start: 24h		 false 300000
  All notifications failed. sn82IuvTc9Vfnl45XqLWoZASIcBezvu1   1588680716684 new_alert_name4 AQs6CuWm-uyXfYaNzwMyDGTX4S4qyAez end: now
isLive: true
queryString: alert=true
start: 24h		 false 300000
  All notifications failed. ljeBta_tEvrGRRbae7MzLRiZG4NbckBm   1588680716684 new_alert_name5 AQs6CuWm-uyXfYaNzwMyDGTX4S4qyAez end: now
isLive: true
queryString: alert=true
start: 24h		 false 300000

humio-get-alert-by-id

list alerts by id from Humio

Base Command

humio-get-alert-by-id

Input

Argument Name Description Required
repository Repository to use Required
id Alert ID Required

Context Output

Path Type Description
Humio.Alert.description String Description of the alert
Humio.Alert.id String The alert id
Humio.Alert.name String The alert name
Humio.Alert.notifiers String The notifiers the alert will use
Humio.Alert.query.end String the end time of the query
Humio.Alert.query.isLive Number whether or not the query is live
Humio.Alert.query.queryString String The query string being used
Humio.Alert.query.start String The start time of the query
Humio.Alert.silenced Number Whether or not the alert is enabled
Humio.Alert.throttleTimeMillis Number The throttle time for alerts

Command Example

!humio-get-alert-by-id repository=sandbox id=ArHY37FM9Z8kWxYMRknwmdR5yJwNEUgc

Context Example

{
    "Humio": {
        "Alert": {
            "description": "",
            "error": "All notifications failed.",
            "id": "ArHY37FM9Z8kWxYMRknwmdR5yJwNEUgc",
            "labels": [],
            "lastAlarm": 1588680716684,
            "name": "new_alert_namme2",
            "notifiers": [
                "AQs6CuWm-uyXfYaNzwMyDGTX4S4qyAez"
            ],
            "query": {
                "end": "now",
                "isLive": true,
                "queryString": "alert=true",
                "start": "24h"
            },
            "silenced": false,
            "throttleTimeMillis": 300000
        }
    }
}

Human Readable Output

Humio Alerts

error id lastAlarm name notifiers query silenced throttleTimeMillis
All notifications failed. ArHY37FM9Z8kWxYMRknwmdR5yJwNEUgc 1588680716684 new_alert_namme2 AQs6CuWm-uyXfYaNzwMyDGTX4S4qyAez end: now
isLive: true
queryString: alert=true
start: 24h		 false 300000

humio-create-alert

Create an alert in Humio

Base Command

humio-create-alert

Input

Argument Name Description Required
repository Repository to use Required
name Name of the alert Required
queryString Query to use Required
start Start time, relative or epoch in ms. Optional
description Description of the alert Optional
throttleTimeMillis Time millis interval Optional
silenced Is it silenced Optional
notifiers comma-separated values of notifier IDs Required
labels comma-separated values of labels Optional

Context Output

Path Type Description
Humio.Alert.description String Description of the alert
Humio.Alert.id String The alert id
Humio.Alert.name String The alert name
Humio.Alert.notifiers String The notifiers the alert will use
Humio.Alert.query.end String the end time of the query
Humio.Alert.query.isLive Number whether or not the query is live
Humio.Alert.query.queryString String The query string being used
Humio.Alert.query.start String The start time of the query
Humio.Alert.silenced Number Whether or not the alert is enabled
Humio.Alert.throttleTimeMillis Number The throttle time for alerts

Command Example

!humio-create-alert name=SampleTestAlert notifiers=BTkuj8QArhIFMh_L39FoN0tnyTUEXplc queryString="foo=bar" repository=sandbox

Context Example

{
    "Humio": {
        "Alert": {
            "description": "",
            "id": "_LLJeuH_--APkyCVaj3NDdXPlyfAtcsB",
            "labels": [],
            "name": "SampleTestAlert",
            "notifiers": [
                "BTkuj8QArhIFMh_L39FoN0tnyTUEXplc"
            ],
            "query": {
                "end": "now",
                "isLive": true,
                "queryString": "foo=bar",
                "start": "24h"
            },
            "silenced": false,
            "throttleTimeMillis": 300000
        }
    }
}

Human Readable Output

Humio Alerts

id name notifiers query silenced throttleTimeMillis
LLJeuH–APkyCVaj3NDdXPlyfAtcsB SampleTestAlert BTkuj8QArhIFMh_L39FoN0tnyTUEXplc end: now
isLive: true
queryString: foo=bar
start: 24h		 false 300000

humio-list-notifiers

List all notifiers in Humio

Base Command

humio-list-notifiers

Input

Argument Name Description Required
repository Repository to use Required

Context Output

Path Type Description
Humio.Notifier Unknown List of notifiers

Command Example

!humio-list-notifiers repository=sandbox

Context Example

{
    "Humio": {
        "Notifier": [
            {
                "entity": "WebHookNotifier",
                "id": "BTkuj8QArhIFMh_L39FoN0tnyTUEXplc",
                "name": "Null Webhook",
                "properties": {
                    "bodyTemplate": "{\n  \"repository\": \"{repo_name}\",\n  \"timestamp\": \"{alert_triggered_timestamp}\",\n  \"alert\": {\n    \"name\": \"{alert_name}\",\n    \"description\": \"{alert_description}\",\n    \"query\": {\n      \"queryString\": \"{query_string} \",\n      \"end\": \"{query_time_end}\",\n      \"start\": \"{query_time_start}\"\n    },\n    \"notifierID\": \"{alert_notifier_id}\",\n    \"id\": \"{alert_id}\",\n    \"linkURL\": \"{url}\"\n  },\n  \"warnings\": \"{warnings}\",\n  \"events\": {events},\n  \"numberOfEvents\": {event_count}\n}",
                    "headers": {
                        "Content-Type": "application/json"
                    },
                    "ignoreSSL": false,
                    "method": "POST",
                    "url": "http://localhost"
                }
            },
            {
                "entity": "WebHookNotifier",
                "id": "AQs6CuWm-uyXfYaNzwMyDGTX4S4qyAez",
                "name": "other",
                "properties": {
                    "bodyTemplate": "BODY",
                    "headers": {
                        "Content-Type": "application/json"
                    },
                    "ignoreSSL": false,
                    "method": "POST",
                    "url": "http://localhost"
                }
            }
        ]
    }
}

Human Readable Output

Humio Notifiers

entity id name properties
WebHookNotifier BTkuj8QArhIFMh_L39FoN0tnyTUEXplc Null Webhook bodyTemplate: {
“repository”: “{repo_name}”,
“timestamp”: “{alert_triggered_timestamp}”,
“alert”: {
“name”: “{alert_name}”,
“description”: “{alert_description}”,
“query”: {
“queryString”: “{query_string} “,
“end”: “{query_time_end}”,
“start”: “{query_time_start}”
},
“notifierID”: “{alert_notifier_id}”,
“id”: “{alert_id}”,
“linkURL”: “{url}”
},
“warnings”: “{warnings}”,
“events”: {events},
“numberOfEvents”: {event_count}
}
headers: {“Content-Type”: “application/json”}
ignoreSSL: false
method: POST
url: http://localhost
WebHookNotifier AQs6CuWm-uyXfYaNzwMyDGTX4S4qyAez other bodyTemplate: BODY
headers: {“Content-Type”: “application/json”}
ignoreSSL: false
method: POST
url: http://localhost

humio-delete-alert

Delete alert in Humio

Base Command

humio-delete-alert

Input

Argument Name Description Required
repository Repository to use Required
id ID of the alert to be deleted Required

Context Output

Path Type Description
Humio.Humio-delete-alert Unknown Details of the deletion

Command Example

!humio-delete-alert repository=sandbox id=dIn3uuIvY4Gz90Bt2Dn2mVtDuB11ZUl2

Context Example

{}

Human Readable Output

Command executed. Status code <Response [204]>

humio-get-notifier-by-id

Get notifier from Humio by id

Base Command

humio-get-notifier-by-id

Input

Argument Name Description Required
repository Repository to use Required
id ID to use Required

Context Output

Path Type Description
Humio.Notifier Unknown Details of the notifier

Command Example

!humio-get-notifier-by-id repository=sandbox id=BTkuj8QArhIFMh_L39FoN0tnyTUEXplc

Context Example

{
    "Humio": {
        "Notifier": {
            "entity": "WebHookNotifier",
            "id": "BTkuj8QArhIFMh_L39FoN0tnyTUEXplc",
            "name": "Null Webhook",
            "properties": {
                "bodyTemplate": "BODY",
                "headers": {
                    "Content-Type": "application/json"
                },
                "ignoreSSL": false,
                "method": "POST",
                "url": "http://localhost"
            }
        }
    }
}

Human Readable Output

Humio Notifiers

entity id name properties
WebHookNotifier BTkuj8QArhIFMh_L39FoN0tnyTUEXplc Null Webhook bodyTemplate: {
“repository”: “{repo_name}”,
“timestamp”: “{alert_triggered_timestamp}”,
“alert”: {
“name”: “{alert_name}”,
“description”: “{alert_description}”,
“query”: {
“queryString”: “{query_string} “,
“end”: “{query_time_end}”,
“start”: “{query_time_start}”
},
“notifierID”: “{alert_notifier_id}”,
“id”: “{alert_id}”,
“linkURL”: “{url}”
},
“warnings”: “{warnings}”,
“events”: {events},
“numberOfEvents”: {event_count}
}
headers: {“Content-Type”: “application/json”}
ignoreSSL: false
method: POST
url: http://localhost

Configuration parameters

  • url — Humio URL (required)
  • API-key — User API token (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • queryParameter — Query to use to fetch incidents
  • queryRepository — Fetch incidents from repository
  • queryStartTime — Fetch incidents from
  • queryTimeZoneOffsetMinutes — TimeZoneOffset in Minutes
  • queryChunkSize — Query chunk size
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval

Commands (10)

  • humio-create-alert

    Create an alert in Humio

  • humio-delete-alert

    Delete alert in Humio

  • humio-delete-job

    Issue a job delete command to Humio

  • humio-get-alert-by-id

    list alerts by id from Humio

  • humio-get-notifier-by-id

    Get notifier from Humio by id

  • humio-list-alerts

    List alerts from Humio

  • humio-list-notifiers

    List all notifiers in Humio

  • humio-poll

    Issue poll command to Humio

  • humio-query

    Query the data from Humio

  • humio-query-job

    Issue a query job to Humio

Source

Humio.py Humio_test.py Humio.yml Humio_description.md command_examples.txt
Download History Raw 
import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401
import json
import urllib3
from datetime import datetime

import requests


""" IMPORTS """


# Disable insecure warnings from urllib3
# - this does not disable SSL checking, just the warnings logged from urllib3
urllib3.disable_warnings()

""" CLASS for Humio"""


class Client:
    def __init__(self, base_url, verify, proxies):
        self.base_url = base_url
        self.verify = verify
        self.proxies = proxies

    def http_request(self, method, url_suffix, data=None, headers=None):
        server = self.base_url + url_suffix
        res = requests.request(
            method,
            server,
            json=data,
            verify=self.verify,
            headers=headers,
            proxies=self.proxies,
        )
        return res


def test_module(client, headers=None):
    response = client.http_request("GET", "/api/v1/status")
    headers = {} if headers is None else headers
    if response.status_code == 200:
        try:
            resp = response.json()
        except Exception:
            return f"Could connect to server, but got unexpected response: {response.text}"

        if resp["status"].lower() == "ok":  # noqa: RET503
            incidentquery = demisto.params().get("queryParameter")
            incidentrepo = demisto.params().get("queryRepository")
            if incidentquery is not None and incidentrepo is not None:
                args = {
                    "queryString": incidentquery,
                    "repository": incidentrepo,
                    "start": "1m",
                    "end": "now",
                    "isLive": "false",
                    "timeZoneOffsetMinutes": 0,
                }
                humio_query(client, args, headers)
                return "ok"
            else:
                return "ok"

    else:
        return f"Bad status from server: ({response.status_code}) {response.text}"


def humio_query(client, args, headers):
    data = {}
    data["queryString"] = args.get("queryString")
    try:
        data["start"] = int(args.get("start"))
    except ValueError:
        data["start"] = args.get("start")
    try:
        data["end"] = int(args.get("end"))
    except ValueError:
        data["end"] = args.get("end")
    data["isLive"] = args.get("isLive").lower() in ["true", "1", "t", "y", "yes"]
    data["timeZoneOffsetMinutes"] = int(args.get("timeZoneOffsetMinutes", 0))
    if args.get("arguments"):
        data["arguments"] = args.get("arguments")
    url = "/api/v1/repositories/" + args.get("repository") + "/query"
    headers["Accept"] = "application/json"
    response = client.http_request("POST", url, data, headers)
    if response.status_code == 200:
        result = response.json()
        markdown = tableToMarkdown("Humio Query Results", result, removeNull=True)
        outputs = {"Humio.Query": [result]}
        return markdown, outputs, result
    else:
        raise ValueError("Error:" + " response from server was: " + str(response.text))


def humio_query_job(client, args, headers):
    data = {}
    data["queryString"] = args.get("queryString")
    data["start"] = args.get("start")
    data["end"] = args.get("end")
    data["isLive"] = args.get("isLive").lower() in ["true", "1", "t", "y", "yes"]
    data["timeZoneOffsetMinutes"] = int(args.get("timeZoneOffsetMinutes"))
    if args.get("arguments"):
        data["arguments"] = args.get("arguments")
    url = "/api/v1/repositories/" + args.get("repository") + "/queryjobs"
    headers["Accept"] = "application/json"
    response = client.http_request("POST", url, data, headers)
    if response.status_code == 200:
        result = response.json()
        markdown = tableToMarkdown("Humio Query Job", result, removeNull=True)
        outputs = {"Humio.Job": result}
        return markdown, outputs, result
    else:
        raise ValueError("Error:" + " response from server was: " + str(response.text))


def humio_poll(client, args, headers):
    data: dict[str, str] = {}
    url = "/api/v1/repositories/" + args.get("repository") + "/queryjobs/" + args.get("id")
    headers["Accept"] = "application/json"
    response = client.http_request("GET", url, data, headers)
    if response.status_code == 200:
        result = response.json()
        result["job_id"] = args.get("id")
        markdown = tableToMarkdown("Humio Poll Result", result.get("events", []), removeNull=True)
        outputs = {"Humio.Result(val.job_id == obj.job_id)": result}
        return markdown, outputs, result
    elif response.status_code == 404:
        raise ValueError(response.text)
    else:
        raise ValueError("Error:" + " response from server was: " + str(response.text))


def humio_delete_job(client, args, headers):
    data: dict[str, str] = {}
    url = "/api/v1/repositories/" + args.get("repository") + "/queryjobs/" + args.get("id")
    headers["Accept"] = "application/json"
    response = client.http_request("DELETE", url, data, headers)
    if response.status_code == 204:
        return "Command executed. Status code " + str(response), None, None
    elif response.status_code == 404:
        raise ValueError(response.text)
    else:
        raise ValueError("Error:" + " response from server was: " + str(response.text))


def humio_list_alerts(client, args, headers):
    data: dict[str, str] = {}
    url = "/api/v1/repositories/" + args.get("repository") + "/alerts"
    headers["Accept"] = "application/json"
    response = client.http_request("GET", url, data, headers)
    if response.status_code == 200:
        result = response.json()
        markdown = tableToMarkdown("Humio Alerts", result, removeNull=True)
        outputs = {"Humio.Alert(val.id == obj.id)": result}
        return markdown, outputs, result
    else:
        raise ValueError("Error:" + " response from server was: " + str(response.text))


def humio_get_alert_by_id(client, args, headers):
    data: dict[str, str] = {}
    url = "/api/v1/repositories/" + args.get("repository") + "/alerts/" + args.get("id")
    headers["Accept"] = "application/json"
    response = client.http_request("GET", url, data, headers)
    if response.status_code == 200:
        if not response.text:
            raise ValueError("Alert with id " + str(args.get("id")) + " not found")
        result = response.json()
        markdown = tableToMarkdown("Humio Alerts", result, removeNull=True)
        outputs = {"Humio.Alert(val.id == obj.id)": result}
        return markdown, outputs, result
    else:
        raise ValueError("Error:" + " response from server was: " + str(response.text))


def humio_create_alert(client, args, headers):
    fulldata = {}
    data = {}
    data["queryString"] = args.get("queryString")
    data["start"] = args.get("start")
    data["end"] = "now"
    data["isLive"] = True
    fulldata["name"] = args.get("name")
    fulldata["description"] = args.get("description", "")
    fulldata["throttleTimeMillis"] = int(args.get("throttleTimeMillis"))
    fulldata["silenced"] = args.get("silenced", "false").lower() in [
        "true",
        "1",
        "t",
        "y",
        "yes",
    ]
    fulldata["notifiers"] = [notifier for notifier in args.get("notifiers").split(",") if notifier]
    fulldata["labels"] = [label for label in args.get("labels", "").split(",") if label]
    fulldata["query"] = data
    url = "/api/v1/repositories/" + args.get("repository") + "/alerts"
    headers["Accept"] = "application/json"
    response = client.http_request("POST", url, fulldata, headers)
    if response.status_code == 201:
        result = response.json()
        markdown = tableToMarkdown("Humio Alerts", result, removeNull=True)
        outputs = {"Humio.Alert(val.id == obj.id)": result}
        return markdown, outputs, result
    else:
        raise ValueError("Error:" + " response from server was: " + str(response.text))


def humio_delete_alert(client, args, headers):
    data: dict[str, str] = {}
    url = "/api/v1/repositories/" + args.get("repository") + "/alerts/" + args.get("id")
    headers["Accept"] = "application/json"
    response = client.http_request("DELETE", url, data, headers)
    if response.status_code == 204:
        return "Command executed. Status code " + str(response), None, None
    else:
        raise ValueError("Error:" + " response from server was: " + str(response.text))


def humio_list_notifiers(client, args, headers):
    url = "/graphql"
    headers["Accept"] = "application/json"

    graphql_query = """
    query{{searchDomain(name:"{repoName}"){{actions{{__typename, id , name
        ... on EmailAction{{id, name, recipients, subjectTemplate, emailBodyTemplate: bodyTemplate, useProxy, attachCsv}}
        ... on SlackAction{{url, fields{{fieldName, value}}, useProxy}}
        ... on SlackPostMessageAction{{apiToken, channels, fields{{fieldName, value}}, useProxy}}
        ... on WebhookAction{{method, url, webhookBodyTemplate: bodyTemplate, headers{{header,value}}, ignoreSSL, useProxy}}
        ... on OpsGenieAction{{apiUrl, genieKey, useProxy}}
        ... on VictorOpsAction{{messageType, notifyUrl, useProxy}}
        ... on PagerDutyAction{{severity, routingKey, useProxy}}
        ... on HumioRepoAction{{ingestToken}}
        ... on UploadFileAction{{fileName}}
        }}}}}}
    """.format(repoName=args.get("repository"))

    data = {"query": graphql_query}

    response = client.http_request("POST", url, data, headers)

    if response.status_code == 200:
        result = response.json()
        if not result.get("data"):
            raise ValueError(f"Failed to execute request: {response['errors'][0]['message']}")

        actions = result.get("data", {}).get("searchDomain", {}).get("actions", [])
        markdown = tableToMarkdown("Humio Notifiers", actions, removeNull=True)
        outputs = {"Humio.Notifier(val.id == obj.id)": actions}
        return markdown, outputs, actions
    else:
        raise ValueError("Error:" + " response from server was: " + str(response.text))


def humio_get_notifier_by_id(client, args, headers):
    url = "/graphql"
    graphql_query = """
    query{{searchDomain(name:"{repoName}"){{action(id:"{id}"){{__typename, id, name
        ... on EmailAction{{id, name, recipients, subjectTemplate, emailBodyTemplate: bodyTemplate, useProxy, attachCsv}}
        ... on SlackAction{{url, fields{{fieldName, value}}, useProxy}}
        ... on SlackPostMessageAction{{apiToken, channels, fields{{fieldName, value}}, useProxy}}
        ... on WebhookAction{{method, url, webhookBodyTemplate: bodyTemplate, headers{{header,value}}, ignoreSSL, useProxy}}
        ... on OpsGenieAction{{apiUrl, genieKey, useProxy}}
        ... on VictorOpsAction{{messageType, notifyUrl, useProxy}}
        ... on PagerDutyAction{{severity, routingKey, useProxy}}
        ... on HumioRepoAction{{ingestToken}}
        ... on UploadFileAction{{fileName}}}}}}}}
    """.format(repoName=args.get("repository"), id=args.get("id"))

    headers["Accept"] = "application/json"

    data = {"query": graphql_query}

    response = client.http_request("POST", url, data, headers)
    if response.status_code == 200:
        result = response.json()
        if not result.get("data"):
            raise ValueError(f"Failed to execute request: {response['errors'][0]['message']}")
        actions = result.get("data", {}).get("searchDomain", {}).get("action")
        markdown = tableToMarkdown("Humio Notifiers", actions, removeNull=True)
        outputs = {"Humio.Notifier(val.id == obj.id)": actions}
        return markdown, outputs, actions
    else:
        raise ValueError("Error:" + " response from server was: " + str(response.text))


def fetch_incidents(client, headers):
    incidentquery = demisto.params().get("queryParameter")
    incidentrepo = demisto.params().get("queryRepository")
    timestampfrom = demisto.params().get("queryStartTime")
    chunkSize = demisto.params().get("queryChunkSize", "50")
    lastrun = demisto.getLastRun()
    url = "/api/v1/repositories/" + incidentrepo + "/query"
    headers["Accept"] = "application/json"

    last_event_ts = int(lastrun.get("time", 0))

    # Only query events with an ingesttimestamp greater than the last run and
    # set maximum of 50 returned events (this is idempotent)
    incidentquery = "@ingesttimestamp > " + str(last_event_ts) + " | " + incidentquery + " | head(" + str(chunkSize) + ")"

    demisto.debug("Querying '" + incidentquery + "'")
    data = {
        "queryString": incidentquery,
        "end": "now",
        "isLive": False,
        "timeZoneOffsetMinutes": int(demisto.params().get("queryTimeZoneOffsetMinutes")),
        "start": timestampfrom,
    }

    response = client.http_request("POST", url, data, headers)
    if response.status_code == 200:
        response_data = response.json()
        if response_data:
            for result in response_data:
                ingest_ts = int(result.get("@ingesttimestamp"))
                if ingest_ts > last_event_ts:
                    last_event_ts = ingest_ts

            last_event_ts += 1
            demisto.setLastRun({"time": last_event_ts})
        return form_incindents(response_data)
    else:
        raise ValueError("Error in fetching incidents. Error from server was: " + str(response.text))


def create_incident_from_humioquery(incident):
    occurred = datetime.fromtimestamp(incident["@timestamp"] / 1000.0).strftime("%Y-%m-%dT%H:%M:%SZ")
    keys = incident.keys()
    labels = []
    for key in keys:
        labels.append({"type": key, "value": str(incident[key])})
    return {
        "name": "Humio Incident {id}".format(id=incident["@id"]),
        "labels": labels,
        "rawJSON": json.dumps(incident),
        "occurred": occurred,
    }


def form_incindents(incidents):
    returnableincidents = []
    for item in incidents:
        returnableincidents.append(create_incident_from_humioquery(item))
    return returnableincidents


def main():
    apikey = demisto.params().get("API-key")
    baseserver = (
        demisto.params()["url"][:-1]
        if (demisto.params()["url"] and demisto.params()["url"].endswith("/"))
        else demisto.params()["url"]
    )
    verify_certificate = not demisto.params().get("insecure", False)
    proxies = handle_proxy()

    headers = {}
    headers["Content-Type"] = "application/json"
    headers["Authorization"] = "Bearer " + apikey

    command = demisto.command()
    LOG(f"Command being called is {command}")
    try:
        client = Client(baseserver, verify_certificate, proxies)
        commands = {
            "humio-query": humio_query,
            "humio-query-job": humio_query_job,
            "humio-poll": humio_poll,
            "humio-delete-job": humio_delete_job,
            "humio-list-alerts": humio_list_alerts,
            "humio-get-alert-by-id": humio_get_alert_by_id,
            "humio-create-alert": humio_create_alert,
            "humio-delete-alert": humio_delete_alert,
            "humio-list-notifiers": humio_list_notifiers,
            "humio-get-notifier-by-id": humio_get_notifier_by_id,
        }
        if command == "test-module":
            results = test_module(client, headers)
            return_outputs(results)
        elif demisto.command() == "fetch-incidents":
            demisto.incidents(fetch_incidents(client, headers))
        elif command in commands:
            return_outputs(*commands[command](client, demisto.args(), headers))
    except Exception as e:
        return_error(str(e))


if __name__ in ["__main__", "builtin", "builtins"]:
    main()