Prometheus

Query Prometheus via its HTTP API (/api/v1/query). Supports a pipe-separated metric list (e.g., "co2|solar|load") which is converted to a metric-name regex on __name__. Returns a tidy table plus machine-readable outputs under Prometheus.Metrics.

Database · Prometheus

Details

IDPrometheus
ProviderOpen Source
CategoryDatabase
From Version6.10.0
Docker Imagedemisto/python3:3.12.13.10116658

README

Query Prometheus via its HTTP API (/api/v1/query). Supports a pipe-separated metric list (e.g., “co2 solar load”) which is converted to a metric-name regex on name. Returns a tidy table plus machine-readable outputs under Prometheus.Metrics.

This integration was integrated and tested with version 2.55 of Prometheus.

Configure Prometheus in Cortex

Parameter Description Required
Prometheus URL   True
Username / Token label (set to “Bearer” to send a Bearer token) If you set the username to “Bearer”, the password will be used as a Bearer token in the Authorization header. False
Password   False
Trust any certificate (not secure)   False
Use system proxy settings   False
Request timeout (seconds)   False
Default fields (pipe-separated) Optional default metric list, e.g. co2|solar|load|battery|temperature|ambient_temperature|ambient_humidity|humidity|NH3|oxidising|reducing|PM10|pressure|proximity False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

prometheus-query

Query Prometheus instant vectors by metric name using a pipe-separated “fields” list. Builds {name=~”…”} (anchored by default) and calls /api/v1/query.

Base Command

prometheus-query

Input

Argument Name Description Required
fields Pipe-separated metric names (e.g., “co2|solar|load”). If omitted, falls back to instance “default_fields”. Optional
anchor Anchor metric-name regex with ^ and $ to avoid partial matches (default: true).. Possible values are: true, false. Optional
time Query evaluation time (RFC3339 timestamp or unix seconds). Optional. Optional
query Raw Prometheus query string to use instead of building from fields. Example: {name=~”(co2|solar)”} or rate(http_requests_total[5m]). Optional

Context Output

Path Type Description
Prometheus.Metrics.name String Metric name (name).
Prometheus.Metrics.value Unknown Metric value (float if numeric, otherwise string).
Prometheus.Metrics.ts Date Sample timestamp (ISO8601, UTC).
Prometheus.Metrics.ts_unix Number Sample timestamp (unix seconds).
Prometheus.Metrics.labels Unknown Metric labels (excluding name).

Command example

!prometheus-query fields="go_info|node_hwmon_temp_celsius"

prometheus-raw

Run any raw Prometheus instant query string against /api/v1/query.

Base Command

prometheus-raw

Input

Argument Name Description Required
query Prometheus query string (required). Required
time Query evaluation time (RFC3339 timestamp or unix seconds). Optional. Optional

Context Output

Path Type Description
Prometheus.Metrics.name String Metric name (name).
Prometheus.Metrics.value Unknown Metric value (float if numeric, otherwise string).
Prometheus.Metrics.ts Date Sample timestamp (ISO8601, UTC).
Prometheus.Metrics.ts_unix Number Sample timestamp (unix seconds).
Prometheus.Metrics.labels Unknown Metric labels (excluding name).

Command example

!prometheus-raw query="{__name__=~'^(go_info|node_hwmon_temp_celsius)$'}"

Configuration parameters

  • url — Prometheus URL (required)
  • credentials — Username / Token label (set to "Bearer" to send a Bearer token)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • timeout — Request timeout (seconds)
  • default_fields — Default fields (pipe-separated)

Commands (2)

  • prometheus-query

    Query Prometheus instant vectors by metric name using a pipe-separated "fields" list. Builds {__name__=~"..."} (anchored by default) and calls /api/v1/query.

  • prometheus-raw

    Run any raw Prometheus instant query string against /api/v1/query.

Source

Prometheus.py Prometheus_test.py Prometheus.yml Prometheus_description.md command_examples.txt
Download History Raw 
category: Database
provider: Open Source
sectionorder:
- Connect
- Collect
commonfields:
  id: Prometheus
  version: -1
name: Prometheus
display: Prometheus
description: >
  Query Prometheus via its HTTP API (/api/v1/query). Supports a pipe-separated
  metric list (e.g., "co2|solar|load") which is converted to a metric-name regex on __name__.
  Returns a tidy table plus machine-readable outputs under Prometheus.Metrics.
fromversion: 6.10.0
marketplaces:
- xsoar
- marketplacev2
defaultEnabled: true

configuration:
- display: Prometheus URL
  name: url
  type: 0
  required: true
  section: Connect
- display: Username / Token label (set to "Bearer" to send a Bearer token)
  name: credentials
  type: 9
  required: false
  additionalinfo: >
    If you set the username to "Bearer", the password will be used as a Bearer token in the Authorization header.
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Request timeout (seconds)
  name: timeout
  type: 0
  required: false
  defaultvalue: "30"
  section: Connect
- display: Default fields (pipe-separated)
  name: default_fields
  type: 0
  required: false
  additionalinfo: >
    Optional default metric list, e.g.
    co2|solar|load|battery|temperature|ambient_temperature|ambient_humidity|humidity|NH3|oxidising|reducing|PM10|pressure|proximity
  section: Collect

script:
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
  commands:
  - name: prometheus-query
    description: >
      Query Prometheus instant vectors by metric name using a pipe-separated "fields" list.
      Builds {__name__=~"..."} (anchored by default) and calls /api/v1/query.
    arguments:
    - name: fields
      description: Pipe-separated metric names (e.g., "co2|solar|load"). If omitted, falls back to instance "default_fields".
      required: false
    - name: anchor
      description: >
        Anchor metric-name regex with ^ and $ to avoid partial matches (default: true).
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      default: true
      required: false
    - name: time
      description: Query evaluation time (RFC3339 timestamp or unix seconds). Optional.
      required: false
    - name: query
      description: >-
        Raw Prometheus query string to use instead of building from fields. Example: {__name__=~"(co2|solar)"} or rate(http_requests_total[5m]).
      required: false
    outputs:
    - contextPath: Prometheus.Metrics.name
      description: Metric name (__name__).
      type: String
    - contextPath: Prometheus.Metrics.value
      description: Metric value (float if numeric, otherwise string).
      type: Unknown
    - contextPath: Prometheus.Metrics.ts
      description: Sample timestamp (ISO8601, UTC).
      type: Date
    - contextPath: Prometheus.Metrics.ts_unix
      description: Sample timestamp (unix seconds).
      type: Number
    - contextPath: Prometheus.Metrics.labels
      description: Metric labels (excluding __name__).
      type: Unknown

  - name: prometheus-raw
    description: Run any raw Prometheus instant query string against /api/v1/query.
    arguments:
    - name: query
      description: Prometheus query string (required).
      required: true
    - name: time
      description: Query evaluation time (RFC3339 timestamp or unix seconds). Optional.
      required: false
    outputs:
    - contextPath: Prometheus.Metrics.name
      description: Metric name (__name__).
      type: String
    - contextPath: Prometheus.Metrics.value
      description: Metric value (float if numeric, otherwise string).
      type: Unknown
    - contextPath: Prometheus.Metrics.ts
      description: Sample timestamp (ISO8601, UTC).
      type: Date
    - contextPath: Prometheus.Metrics.ts_unix
      description: Sample timestamp (unix seconds).
      type: Number
    - contextPath: Prometheus.Metrics.labels
      description: Metric labels (excluding __name__).
      type: Unknown

  script: ""
tests:
- No tests (auto)