Looker

Use the Looker integration to query an explore, save queries as looks, run looks, and fetch look results as incidents.

Analytics & SIEM · Looker

Details

ID	`Looker`
Provider	Google
Category	Analytics & SIEM
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10325753`
Supported Modules	Agentix XSIAM

README

This integration was integrated and tested with Looker version 6.10.20.

Use Cases

Ingest query results as incidents.
Run a custom (inline) query as part of a playbook.
Automatically create and save a query as a look.

Important Information

Make sure you read this information on how to obtain information required for configuring the integration.

Generate an API3 key for a Looker user:

Log in to the Looker web interface with an account that is permitted to manage users.
At the top of the page, click on the “Admin” drop down and select “Users”
Select the user you would like to generate the API3 key for.
Go to “API3 Keys” and select “Edit Keys”
Click on “New API3 Key”

Get a Look ID:

Usages:

“Look name or ID to fetch incidents from” integration parameter.
Look ID command arguments.
Uniquely identify a Look (the name is not unique).

Option A: Looker Web Interface

Click on a look.
The number at the end of the URL is the ID of the look.

Option B: Cortex XSOAR commands

Configure the Looker integration without fetching incidents, or filling in the parameter.
Run the looker-search-queries or looker-search-looks command.
The ID will be part of the results (among other look details).

Get model and view names from an explore’s URL:

Navigate to the explore.
The URL will be formatted like this: https://<looker server>/explore/<model>/<view>

Get a field’s SQL name (for command arguments):

Navigate to the explore.
Click a field.
In the DATA tab, click SQL.

You will see the field name in the following format: object_name.field_name.

Configure Looker on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for Looker.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- API URL and port (e.g., https://example.looker.com:19999)
- Trust any certificate (not secure)
- Use system proxy settings
- API3 Client ID
- API3 Client Secret
Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

Run a saved look: looker-run-look
Search for saved looks: looker-search-looks
Run an inline query: looker-run-inline-query
Create a look: looker-create-look

1. Run a saved look

Runs a saved look and returns the results in the specified format.

Base Command

looker-run-look

Input

Argument Name	Description	Required
id	ID of the look. Can be found in the look’s URL, or by running the ‘looker-search-looks’ command.	Optional
fields	Fields to return.	Optional
name	Name of the look.	Optional
limit	Maximum number of looks to return (0 for looker-determined limit).	Optional
result_format	Format of the result.	Required

Context Output

Path	Type	Description
LookerResults.LookID	Number	Look ID.
LookerResults.Results	Unknown	Look Results.

Command Example

looker-run-look name="Look 1" limit="2" result_format="json"

Context Example

"LookerResults": {
    "LookID": 3,
    "Results": [
        {
            "OrderItems_Id": 160086,
            "OrderItems_OrderId": 153797,
            "OrderItems_Status": "Complete",
            "OrderItems_CreatedDate": "2019-04-02",
            "OrderItems_SalePrice": 54,
            "Products_Brand": "Alternative",
            "Products_ItemName": "Alternative Women's Alice Drop Shoulder V-Neck",
            "Users_Name": "Chelsea Mccormick",
            "Users_Email": "example@gmail.com"
        },
        {
            "OrderItems_Id": 63757,
            "OrderItems_OrderId": 58557,
            "OrderItems_Status": "Cancelled",
            "OrderItems_CreatedDate": "2019-04-19",
            "OrderItems_SalePrice": 49.5,
            "Products_Brand": "Lucky Brand",
            "Products_ItemName": "Lucky Brand Women's Plus-Size Moroccan Medallion Tee",
            "Users_Name": "Darrell Nelson",
            "Users_Email": "example@aol.com"
        }
    ]
}

Human Readable Output

Results for look Look 1

LookerResults.Results.OrderItems_Id	LookerResults.Results.OrderItems_OrderId	LookerResults.Results.OrderItems_Status	LookerResults.Results.OrderItems_CreatedDate	LookerResults.Results.OrderItems_SalePrice	LookerResults.Results.Products_Brand	LookerResults.Results.Products_ItemName	LookerResults.Results.Users_Name	LookerResults.Results.Users_Email
160086	153797	Complete	2019-04-02	54	Alternative	Alternative Women’s Alice Drop Shoulder V-Neck	Chelsea Mccormick	example.gmail.com
63757	58557	Cancelled	2019-04-19	49.5	Lucky Brand	Lucky Brand Women’s Plus-Size Moroccan Medallion Tee	Darrell Nelson	example.gmail.com

This command has dynamic output keys.
To access them in the context, copy the key’s path from the column header in the results table.

2. Search for saved looks

Retrieves saved looks that match the search criteria.

Base Command

looker-search-looks

Input

Argument Name	Description	Required
name	Match look name.	Optional
space_id	Filter results by a particular space.	Optional
user_id	Filter by dashboards created by a particular user.	Optional
limit	Maximum number of looks to return (0 for looker-determined limit).	Optional

Context Output

Path	Type	Description
Looker.Look.ID	Number	Look ID.
Looker.Look.Name	String	Look name.
Looker.Look.SpaceID	Number	ID of the space that contains the look.
Looker.Look.SpaceName	String	Name of the space that contains the look.
Looker.Look.LastUpdated	Date	The time that the look was last updated.

Command Example

!looker-search-looks limit="2"

Context Example

"Looker": {
    "Look": {
        [
            {
                "ID": 3,
                "LastUpdated": "2019-04-10T16:11:43.249Z",
                "Name": "Look 1",
                "SpaceID": 6,
                "SpaceName": "Space 1"
            },
            {
                "ID": 4,
                "LastUpdated": "2019-04-16T11:41:57.482Z",
                "Name": "Look 2",
                "SpaceID": 7,
                "SpaceName": "Space 2"
            }
        ]
    }
}

Human Readable Output

Look search results

ID	Name	SpaceID	SpaceName	LastUpdated
3	Look 1	6	Space 1	2019-04-10T16:11:43.249Z
4	Look 2	7	Space 2	2019-04-16T11:41:57.482Z

3. Run an inline query

Runs a query by defining it in the command arguments, rather than a saved query in looker.

Base Command

looker-run-inline-query

Input

Argument Name	Description	Required
model	Name of the model - can be found in the explore’s URL	Required
view	Name of the view or explore. Can be found in the explore’s URL.	Required
fields	List of fields to display. (Field name format: “object_name.field_name”).	Optional
filters	Filters for the query, passed as a comma-separated list with the format: “field name=filter value;…” (Field name format: “object_name.field_name”).	Optional
pivots	List of pivots. (Field name format: “object_name.field_name”).	Optional
sorts	Sorting for the query results. (Field name format: “object_name.field_name”).	Optional
limit	Maximum number of looks to return (0 for looker-determined limit).	Optional
result_format	Format of the result.	Required

Context Output

Path	Type	Description
LookerResults.InlineQuery	Unknown	Inline query results.

Command Example

looker-run-inline-query model="thelook" view="order_items" fields="order_items.status, order_items.order_id, products.brand" filters="products.brand=Ray-Ban, Calvin Klein" limit="2" result_format="json"

Context Example

"LookerResults": {
        "InlineQuery": [
            {
                "OrderItems_OrderId": 5704,
                "OrderItems_Status": "Cancelled",
                "Products_Brand": "Ray-Ban"
            },
            {
                "OrderItems_OrderId": 1535,
                "OrderItems_Status": "Cancelled",
                "Products_Brand": "Ray-Ban"
            }
        ]
    }

Human Readable Output

Inline Query Results

LookerResults.InlineQuery.OrderItems_Status	LookerResults.InlineQuery.OrderItems_OrderId	LookerResults.InlineQuery.Products_Brand
Cancelled	5704	Ray-Ban
Cancelled	1535	Ray-Ban

4. Create a look

Creates a look from a query

Base Command

looker-create-look

Input

Argument Name	Description	Required
model	Name of the model. Can be found in the explore’s URL.	Required
view	Name of the view or Explore. Can be found in the explore’s URL.	Required
fields	List of fields to display. (Field name format: “object_name.field_name”).	Optional
filters	Filters for the query, passed as a comma-separated list with the format: “field name=filter value;…” (Field name format: “object_name.field_name”).	Optional
pivots	List of pivots. (Field name format: “object_name.field_name”).	Optional
sorts	Sorting for the query results. (Field name format: “object_name.field_name”).	Optional
look_title	Title of the look.	Required
look_description	Description of the look.	Optional
look_space_id	ID of the space that will contain the look.	Required

Context Output

Path	Type	Description
Looker.Look.ID	Number	Look ID.
Looker.Look.Name	String	Look name.
Looker.Look.SpaceID	Number	ID of the space that contains the look.
Looker.Look.SpaceName	String	Name of the space that contains the look.
Looker.Look.LastUpdated	Date	The time that the look was last updated.

This command has dynamic output keys.
To access them in the context, copy the key’s path from the column header in the results table.

Command Example

looker-run-inline-query model="thelook" view="order_items" fields="order_items.status, order_items.order_id, products.brand" filters="products.brand=Ray-Ban, Calvin Klein" limit="2" result_format="json" look_space_id=6 look_title="Look 3" look_description="This is my third saved look"

Context Example

"Looker": {
    "Look": {
        "ID": 7,
        "LastUpdated": "2019-04-10T16:11:43.249Z",
        "Name": "Look 3",
        "SpaceID": 6,
        "SpaceName": "Space 1"
    }
}

Human Readable Output

Look “Look 3” created successfully

ID	Name	SpaceID	SpaceName	LastUpdated
7	Look 3	6	Space 1	2019-04-10T16:11:43.249Z

Configuration parameters

url — API URL and port (e.g., https://example.looker.com:19999) (required)
client_id — API3 Client ID
client_secret — API3 Client Secret
credentials_api3_client — API3 Client ID
unsecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (4)

looker-create-look
Creates a look from a query.
looker-run-inline-query
Runs a query by defining it in the command arguments, rather than a saved query in looker.
looker-run-look
Runs a saved look and returns the results in the specified format.
looker-search-looks
Retrieves saved looks that match the search criteria.

Source

Looker.py Looker_test.py Looker.yml Looker_description.md

Download History Raw

category: Analytics & SIEM
provider: Google
commonfields:
  id: Looker
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- display: API URL and port (e.g., https://example.looker.com:19999)
  name: url
  required: true
  type: 0
  section: Connect
- display: API3 Client ID
  name: client_id
  required: false
  hidden: true
  type: 0
  section: Connect
- display: API3 Client Secret
  name: client_secret
  type: 4
  hidden: true
  required: false
  section: Connect
- display: API3 Client ID
  name: credentials_api3_client
  type: 9
  displaypassword: API3 Client Secret
  section: Connect
  required: false
- display: Trust any certificate (not secure)
  name: unsecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
description: Use the Looker integration to query an explore, save queries as looks, run looks, and fetch look results as incidents.
display: Looker
name: Looker
script:
  commands:
  - arguments:
    - default: true
      description: ID of the look. Can be found in the look's URL, or by running the 'looker-search-looks' command.
      name: id
    - description: Fields to return.
      isArray: true
      name: fields
    - description: Name of the look.
      name: name
    - defaultValue: '50'
      description: Maximum number of looks to return (0 for looker-determined limit).
      name: limit
    - auto: PREDEFINED
      defaultValue: json
      description: Format of the result.
      name: result_format
      predefined:
      - json
      - csv
      required: true
    description: Runs a saved look and returns the results in the specified format.
    name: looker-run-look
    outputs:
    - contextPath: LookerResults.LookID
      description: Look ID.
      type: Number
    - contextPath: LookerResults.Results
      description: Look results.
      type: Unknown
  - arguments:
    - default: true
      description: Match look name.
      name: name
    - description: Filter results by a particular space.
      name: space_id
    - description: Filter by dashboards created by a particular user.
      name: user_id
    - defaultValue: '50'
      description: Maximum number of looks to return (0 for looker-determined limit).
      name: limit
      predefined:
      - ''
    description: Retrieves saved looks that match the search criteria.
    name: looker-search-looks
    outputs:
    - contextPath: Looker.Look.ID
      description: Look ID.
      type: Number
    - contextPath: Looker.Look.Name
      description: Look name.
      type: String
    - contextPath: Looker.Look.SpaceID
      description: ID of the space that contains the look.
      type: Number
    - contextPath: Looker.Look.SpaceName
      description: Name of the space that contains the look.
      type: String
    - contextPath: Looker.Look.LastUpdated
      description: The time that the look was last updated.
      type: Date
  - arguments:
    - description: Name of the model. Can be found in the explore's URL.
      name: model
      required: true
    - description: Name of the view or explore. Can be found in the explore's URL.
      name: view
      required: true
    - description: 'List of fields to display. (Field name format: "object_name.field_name").'
      isArray: true
      name: fields
    - description: 'Filters for the query, passed as a semicolon-separated list with the format: "field name=filter value;..." (Field name format: "object_name.field_name").'
      isArray: true
      name: filters
    - description: 'List of pivots. (Field name format: "object_name.field_name").'
      isArray: true
      name: pivots
    - description: 'Sorting for the query results. (Field name format: "object_name.field_name").'
      isArray: true
      name: sorts
    - defaultValue: '50'
      description: Maximum number of looks to return (0 for looker-determined limit).
      name: limit
    - auto: PREDEFINED
      defaultValue: json
      description: Format of the results.
      name: result_format
      predefined:
      - json
      - csv
      required: true
    description: Runs a query by defining it in the command arguments, rather than a saved query in looker.
    name: looker-run-inline-query
    outputs:
    - contextPath: LookerResults.InlineQuery
      description: Inline query results.
      type: Unknown
  - arguments:
    - description: Name of the model. Can be found in the explore's URL.
      name: model
      required: true
    - description: Name of the view or explore. Can be found in the explore's URL.
      name: view
      required: true
    - description: 'List of fields to display. (Field name format: "object_name.field_name").'
      isArray: true
      name: fields
    - description: 'Filters for the query, passed as a semicolon-separated list with the format: "field name=filter value;..." (Field name format: "object_name.field_name").'
      isArray: true
      name: filters
    - description: 'List of pivots. (Field name format: "object_name.field_name").'
      isArray: true
      name: pivots
    - description: 'Sorting for the query results. (Field name format: "object_name.field_name").'
      isArray: true
      name: sorts
    - description: Title of the look.
      name: look_title
      required: true
    - description: Description of the look.
      name: look_description
    - description: ID of the space that will contain the look.
      name: look_space_id
      required: true
    description: Creates a look from a query.
    name: looker-create-look
    outputs:
    - contextPath: Looker.Look.ID
      description: Look ID.
      type: Number
    - contextPath: Looker.Look.Name
      description: Look name.
      type: String
    - contextPath: Looker.Look.SpaceID
      description: ID of the space that contains the look.
      type: Number
    - contextPath: Looker.Look.SpaceName
      description: Name of the space that contains the look.
      type: String
    - contextPath: Looker.Look.LastUpdated
      description: The time that the look was last updated.
      type: Date
  dockerimage: demisto/python3:3.12.13.10325753
  runonce: false
  script: '-'
  type: python
  subtype: python3
tests:
- Test-Looker
fromversion: 5.0.0