Netmiko
Multi-vendor library to simplify SSH connections to network devices. Utilizes the Python library Netmiko for connections. Supports SSH Key authentication and username / password.
Utilities · Netmiko
Details
| ID | Netmiko |
|---|---|
| Provider | Open Source |
| Category | Utilities |
| From Version | 6.0.0 |
| Docker Image | demisto/netmiko:1.0.0.9067966 |
| Supported Modules | Agentix XSIAM |
README
Netmiko SSH module integration
This integration provides ssh-based access to network devices, servers, and other appliances that support this method of configuration. For a complete list of supported platforms, please visit the below URL:
Netmiko Platforms.md on Github
Configure Netmiko Integration in Cortex XSOAR
- Navigate to Settings - Integrations
- Search for Netmiko
- Click Add instance to create and configure a new integration instance.
- Name: a name for the integration instance.
- Platform: the platform identifier taken from the above SSH or Telnet platform name lists (e.g., linux_ssh, paloalto_panos, etc.)
NOTE: Platform names are taken from the supported
SSH or Telnet device type lists on GitHub.- Hostname: The IP address, hostname, or FQDN for the device to connect to via SSH.
- Port: The port to connect to via SSH
- Credentials: The username/password, or XSOAR credential object, to be used for the connection
- Override the default timeout value: Override the timeout value (in seconds) for a given integration instance. This is useful for devices that are slow in responding with requested output over SSH.
- Click Test to validate the new instance. This performs a simple connection to the system hosting the SSH server.
Commands
The Netmiko integration currently only supports the netmiko-cmds command for SSH. This command can be used via the XSOAR CLI, as part of an automation, or as a task in an XSOAR playbook. Like other XSOAR commands, this object can be passed a single command, a list of commands, or an array of commands to execute in a single session.
netmiko-cmds
Executes a command, or series of commands, over an SSH connection. Outputs from the executed commands are returned to the incident/playground context.
Base Command
netmiko-cmds
Input
| Argument Name | Description | Required |
|---|---|---|
| cmds | The command, or commands, to execute. When commands are manually specified and executed via the XSOAR CLI or in a task, place each command after the first on a new line (no comma required) | Required |
| disable_context | The package ID. Package ID or package name is required. When both exist, ID is used. | Optional |
| exit_argument | The optional exit command to be executed after the cmds parameter. This is tied to the requires_exit optional parameter. (Default: q) | Optional |
| isConfig | Specifies whether or not the commands being executed require a configure command to be executed first (e.g., conf t for Cisco IOS). The specific configure command is handled by the Netmiko Python module, and is associated with the Platform parameter specified in the integration instance. (Default: False) | Optional |
| override_host | If specified, uses this host in place of the one specified in the instance configuration. | Optional |
| override_password | If specified, uses this password in place of the one specified in the instance configuration. | Optional |
| override_platform | If specified, uses this platform name in place of the one specified in the instance configuration. | Optional |
| override_port | If specified, uses this port in place of the one specified in the instance configuration. | Optional |
| override_username | If specified, uses this username in place of the one specified in the instance configuration. | Optional |
| raw_print | Prints the raw output directly to the war room (Default: False) | Optional |
| require_enable | Specifies whether or not the enable command must be executed before the commands specified in the cmds parameter. (Default: False) | Optional |
| require_exit | Specifies an optional command that must be executed upon completion of the cmds parameter being executed. (Default: False) | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Netmiko.Command | String | The executed command(s) |
| Netmiko.DateTimeUTC | DateTime | The datetime at which the command(s) were executed (in UTC) |
| Netmiko.Hostname | String | The hostname used for this execution of the integration |
| Netmiko.Output | String | The results of the command(s) that were executed |
Command Example (Single command)
!netmiko-cmds cmds="whoami"
Context Example
{
“Command”: “whoami”,
“DateTimeUTC”: “2023-04-24T21:40:21.755985”,
“Hostname”: “192.168.0.1”,
“Output”: “[someuser@someserver ~]$ root”
}
Human Readable Output
Command(s) against 192.168.0.1 (linux)
| Command | DateTimeUTC | Hostname | Output |
|---|---|---|---|
| whoami | 2023-04-24T21:40:21.755985 | 192.168.0.1 | root |
Command Example (Multiple commands)
As multiple commands via CLI or task
!netmiko-cmds cmds="whoami
who"
As multiple commands via CLI or task using an array
array context key = ["whoami", "who"]
!netmiko-cmds cmds=${array}
Context Example
{
“Netmiko”: [{
“Command”: “whoami”,
“DateTimeUTC”: “2023-04-24T21:59:02.177240”,
“Hostname”: “192.168.0.1”,
“Output”: “[someuser@somehost ~]$ root”
},
{
“Command”: “who”,
“DateTimeUTC”: “2023-04-24T21:59:04.882842”,
“Hostname”: “192.168.0.1”,
“Output”: “[someuser@somehost ~]$ root pts/0 2023-04-24 17:58 (192.168.0.1)”
}]
}
Human Readable Output
Command(s) against 192.168.0.1 (linux)
| Command | DateTimeUTC | Hostname | Output |
|---|---|---|---|
| whoami | 2023-04-24T21:59:02.177240 | 192.168.0.1 | root |
| who | 2023-04-24T21:59:04.882842 | 192.168.0.1 | [someuser@somehost ~]$ root pts/0 2023-04-24 17:58 (192.168.0.1) |
Configuration parameters
hostname— Hostname (required)port— Port (required)platform— Platform (required)credentials— Credentials (required)TimeoutOverride— Override the default timeout value
Commands (1)
-
netmiko-cmdsExecute commands using Netmiko.
category: Utilities provider: Open Source commonfields: id: Netmiko version: -1 sectionorder: - Connect - Collect configuration: - name: hostname display: Hostname required: true defaultvalue: type: 0 section: Connect additionalinfo: - name: port display: Port required: true defaultvalue: type: 0 section: Connect additionalinfo: "" - name: platform display: Platform required: true defaultvalue: type: 15 section: Connect additionalinfo: "" options: - a10 - accedian - adtran_os - adtran_os_telnet - adva_fsp150f2 - adva_fsp150f3 - alcatel_aos - alcatel_sros - allied_telesis_awplus - apresia_aeos - apresia_aeos_telnet - arista_eos - arista_eos_telnet - arris_cer - aruba_os - aruba_osswitch - aruba_procurve - aruba_procurve_telnet - avaya_ers - avaya_vsp - broadcom_icos - brocade_fastiron - brocade_fastiron_telnet - brocade_fos - brocade_netiron - brocade_netiron_telnet - brocade_nos - brocade_vdx - brocade_vyos - calix_b6 - calix_b6_telnet - casa_cmts - cdot_cros - centec_os - centec_os_telnet - checkpoint_gaia - ciena_saos - ciena_saos_telnet - cisco_asa - cisco_ftd - cisco_ios - cisco_ios_telnet - cisco_nxos - cisco_s300 - cisco_s300_telnet - cisco_tp - cisco_viptela - cisco_wlc - cisco_xe - cisco_xr - cisco_xr_telnet - cloudgenix_ion - coriant - dell_dnos6_telnet - dell_dnos9 - dell_force10 - dell_isilon - dell_os10 - dell_os6 - dell_os9 - dell_powerconnect - dell_powerconnect_telnet - dell_sonic - dlink_ds - dlink_ds_telnet - eltex - eltex_esr - endace - enterasys - ericsson_ipos - extreme - extreme_ers - extreme_exos - extreme_exos_telnet - extreme_netiron - extreme_netiron_telnet - extreme_nos - extreme_slx - extreme_telnet - extreme_tierra - extreme_vdx - extreme_vsp - extreme_wing - f5_linux - f5_ltm - f5_tmsh - flexvnf - fortinet - generic - generic_telnet - generic_termserver - generic_termserver_telnet - hillstone_stoneos - hp_comware - hp_comware_telnet - hp_procurve - hp_procurve_telnet - huawei - huawei_olt - huawei_olt_telnet - huawei_smartax - huawei_telnet - huawei_vrpv8 - ipinfusion_ocnos - ipinfusion_ocnos_telnet - juniper - juniper_junos - juniper_junos_telnet - juniper_screenos - keymile - keymile_nos - linux - mellanox - mellanox_mlnxos - mikrotik_routeros - mikrotik_switchos - mrv_lx - mrv_optiswitch - netapp_cdot - netgear_prosafe - netscaler - nokia_srl - nokia_sros - nokia_sros_telnet - oneaccess_oneos - oneaccess_oneos_telnet - ovs_linux - paloalto_panos - paloalto_panos_telnet - pluribus - quanta_mesh - rad_etx - rad_etx_telnet - raisecom_roap - raisecom_telnet - ruckus_fastiron - ruckus_fastiron_telnet - ruijie_os - ruijie_os_telnet - sixwind_os - sophos_sfos - supermicro_smis - supermicro_smis_telnet - Supported Secure Copy device_type values - tplink_jetstream - tplink_jetstream_telnet - ubiquiti_edge - ubiquiti_edgerouter - ubiquiti_edgeswitch - ubiquiti_unifiswitch - vyatta_vyos - vyos - watchguard_fireware - yamaha - yamaha_telnet - zte_zxros - zte_zxros_telnet - zyxel_os - name: credentials display: Credentials required: true section: Connect defaultvalue: type: 9 additionalinfo: displaypassword: "" hiddenusername: false - name: TimeoutOverride display: Override the default timeout value required: false defaultvalue: "60" type: 0 additionalinfo: Specify a timeout override value in seconds for devices that have a lengthy login process or are behind a latent connection. (Default 60 seconds). section: Connect description: Multi-vendor library to simplify SSH connections to network devices. Utilizes the Python library Netmiko for connections. Supports SSH Key authentication and username / password. display: Netmiko name: Netmiko script: commands: - arguments: - name: cmds description: Command(s) to run (provide a single command, a context key array value, or multiple commands with each on a new line after the first (e.g., cmds="whoami SHIFT+ENTER who"). required: true isArray: true defaultValue: "" - auto: PREDEFINED defaultValue: "false" description: Whether requires "enable" to be run before commands are executed. Default is false. name: require_enable predefined: - "false" - "true" - auto: PREDEFINED defaultValue: "false" description: Whether commands are config items (such as those used in Cisco devices). Default is false. name: isConfig predefined: - "false" - "true" - defaultValue: "false" description: Whether an exit argument is required after commands are executed (default is false). name: require_exit auto: PREDEFINED predefined: - "false" - "true" required: false isArray: false - defaultValue: q description: Optional exit argument used to exit the terminal after commands are executed. Default is q. name: exit_argument - auto: PREDEFINED defaultValue: "false" description: If true, the output in the War Room is raw output (as seen in a terminal) and not in JSON format. Default is false. name: raw_print predefined: - "false" - "true" - auto: PREDEFINED defaultValue: "false" description: If set to true, the context is not ouput. This is useful if the command needs to be executed but the result of the command is not required in context. Default is false. name: disable_context predefined: - "false" - "true" - description: If specified, it will override the target host specified in the integration instance. name: override_host - description: If specified, it will override the target port specified in the integration instance. name: override_port - auto: PREDEFINED name: override_platform description: If specified, it will override the target platform specified in the integration instance. defaultValue: "" predefined: - a10 - a10_ssh - accedian - accedian_ssh - alcatel_aos - alcatel_aos_ssh - alcatel_sros - alcatel_sros_ssh - apresia_aeos - apresia_aeos_ssh - apresia_aeos_telnet - arista_eos - arista_eos_ssh - arista_eos_telnet - aruba_os - aruba_os_ssh - autodetect - avaya_ers - avaya_ers_ssh - avaya_vsp - avaya_vsp_ssh - brocade_fastiron - brocade_fastiron_ssh - brocade_fastiron_telnet - brocade_netiron - brocade_netiron_ssh - brocade_netiron_telnet - brocade_nos - brocade_nos_ssh - brocade_vdx - brocade_vdx_ssh - brocade_vyos - brocade_vyos_ssh - calix_b6 - calix_b6_ssh - calix_b6_telnet - checkpoint_gaia - checkpoint_gaia_ssh - ciena_saos - ciena_saos_ssh - cisco_asa - cisco_asa_ssh - cisco_ios - cisco_ios_serial - cisco_ios_ssh - cisco_ios_telnet - cisco_nxos - cisco_nxos_ssh - cisco_s300 - cisco_s300_ssh - cisco_tp - cisco_tp_ssh - cisco_wlc - cisco_wlc_ssh - cisco_xe - cisco_xe_ssh - cisco_xr - cisco_xr_ssh - cisco_xr_telnet - cloudgenix_ion - cloudgenix_ion_ssh - coriant - coriant_ssh - dell_dnos6_telnet - dell_dnos9 - dell_dnos9_ssh - dell_force10 - dell_force10_ssh - dell_isilon - dell_isilon_ssh - dell_os10 - dell_os10_ssh - dell_os6 - dell_os6_ssh - dell_os9 - dell_os9_ssh - dell_powerconnect - dell_powerconnect_ssh - dell_powerconnect_telnet - eltex - eltex_ssh - endace - endace_ssh - enterasys - enterasys_ssh - extreme - extreme_ers - extreme_ers_ssh - extreme_exos - extreme_exos_ssh - extreme_exos_telnet - extreme_netiron - extreme_netiron_ssh - extreme_netiron_telnet - extreme_nos - extreme_nos_ssh - extreme_slx - extreme_slx_ssh - extreme_ssh - extreme_telnet - extreme_vdx - extreme_vdx_ssh - extreme_vsp - extreme_vsp_ssh - extreme_wing - extreme_wing_ssh - f5_linux - f5_linux_ssh - f5_ltm - f5_ltm_ssh - f5_tmsh - f5_tmsh_ssh - flexvnf - flexvnf_ssh - fortinet - fortinet_ssh - generic_termserver - generic_termserver_ssh - generic_termserver_telnet - hp_comware - hp_comware_ssh - hp_comware_telnet - hp_procurve - hp_procurve_ssh - hp_procurve_telnet - huawei - huawei_ssh - huawei_telnet - huawei_vrpv8 - huawei_vrpv8_ssh - ipinfusion_ocnos - ipinfusion_ocnos_ssh - ipinfusion_ocnos_telnet - juniper - juniper_junos - juniper_junos_ssh - juniper_junos_telnet - juniper_ssh - keymile - keymile_nos - keymile_nos_ssh - keymile_ssh - linux - linux_ssh - mellanox - mellanox_mlnxos - mellanox_mlnxos_ssh - mellanox_ssh - mikrotik_routeros - mikrotik_routeros_ssh - mikrotik_switchos - mikrotik_switchos_ssh - mrv_lx - mrv_lx_ssh - mrv_optiswitch - mrv_optiswitch_ssh - netapp_cdot - netapp_cdot_ssh - netscaler - netscaler_ssh - oneaccess_oneos - oneaccess_oneos_ssh - oneaccess_oneos_telnet - ovs_linux - ovs_linux_ssh - paloalto_panos - paloalto_panos_ssh - paloalto_panos_telnet - pluribus - pluribus_ssh - quanta_mesh - quanta_mesh_ssh - rad_etx - rad_etx_ssh - rad_etx_telnet - ruckus_fastiron - ruckus_fastiron_ssh - ruckus_fastiron_telnet - terminal_server - ubiquiti_edge - ubiquiti_edge_ssh - ubiquiti_edgeswitch - ubiquiti_edgeswitch_ssh - vyatta_vyos - vyatta_vyos_ssh - vyos - vyos_ssh - description: If specified, it will override the username specified in the integration instance. name: override_username - description: If specified, it will override the password specified in the integration instance. name: override_password description: Execute commands using Netmiko. execution: true name: netmiko-cmds outputs: - contextPath: Netmiko.Command description: The command that was executed. type: string - contextPath: Netmiko.DateTimeUTC description: The datetime at which the command was executed (in UTC). type: date - contextPath: Netmiko.Hostname description: The hostname on which the command was executed. type: string - contextPath: Netmiko.Output description: The results of the command. type: string dockerimage: demisto/netmiko:1.0.0.9067966 script: "" subtype: python3 type: python fromversion: 6.0.0 tests: - Netmiko_test