VeloCloudEventCollector

Details

ID	`VeloCloudEventCollector`
Provider	Arista Networks
Category	Network Security
From Version	6.5.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	XSIAM

README

Collects events from the VeloCloud API.
This integration was integrated and tested with VeloCloud as of 2025-10-06.

Configure VeloCloud Event Collector in Cortex

Parameter	Description	Required
Server URL		True
Enterprise ID		True
API Key	API key for authenticating with Arista VeloCloud	False
First fetch timestamp		False
Limit of events per fetch		False
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

velocloud-get-events

Get events fro`m Arista VeloCloud

Base Command

velocloud-get-events

Input

Argument Name	Description	Required
start_time	Start time for event query in ISO format or human-readable format (e.g., ‘3 days ago’). Default is 1 day ago.	Optional
end_time	End time for event query in ISO format or human-readable format (e.g., ‘now’). Default is now.	Optional
limit	Maximum number of events to retrieve. Default is 100.	Optional

Context Output

Path	Type	Description
VeloCloud.Event.logicalId	String	Event logical ID
VeloCloud.Event.category	String	Event category
VeloCloud.Event.event	String	Event type
VeloCloud.Event.severity	String	Event severity
VeloCloud.Event.message	String	Event message
VeloCloud.Event.detail	String	Event details, usually in JSON string format
VeloCloud.Event.eventTime	Date	Event timestamp
VeloCloud.Event.created	Date	Event creation time
VeloCloud.Event.edgeName	String	Name of the edge
VeloCloud.Event.enterpriseName	String	Name of the enterprise
VeloCloud.Event.enterpriseUsername	String	Username associated with the enterprise
VeloCloud.Event.segmentName	String	Name of the network segment

Command Example

!velocloud-get-events limit=1

{
    "VeloCloud": {
        "Event": {
            "category": "EDGE",
            "created": "2025-11-03T21:02:36.000Z",
            "detail": "{\"last_request_time\":0,\"client_mac\":\"03:11:22:33:44:55\",\"client_ipv4addr\":\"192.168.1.1\",\"hostname\":\"nexusquantum7\",\"os_type\":800,\"os_class\":1,\"os_class_name\":\"OTHER\",\"os_version\":\"\",\"device_type\":\"\",\"os_description\":\"Xerox Printer\",\"dhcp_param_list\":\"6,3,1,15,66,67,13,44,12\",\"segment_id\":0,\"edgeSerialNumber\":\"K7M9N2P5Q8R1\"}",
            "edgeName": "radiancecdnc43",
            "enterpriseName": "ACME Co.",
            "enterpriseUsername": "",
            "event": "EDGE_NEW_DEVICE",
            "eventTime": "2025-11-03T21:02:16.000Z",
            "logicalId": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
            "message": "New or updated client device 03:11:22:33:44:55, ip 192.168.1.1, segId 0, hostname nexusquantum7, os Xerox Printer",
            "segmentName": "",
            "severity": "NOTICE"
        }
    }
}

Configuration parameters

url — Server URL (required)
enterprise_id — Enterprise ID (required)
api_key — (required)
first_fetch — First fetch timestamp
limit — Limit of events per fetch
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

velocloud-get-events
Get events fro`m Arista VeloCloud

Source

VeloCloudEventCollector.py VeloCloudEventCollector_test.py VeloCloudEventCollector.yml VeloCloudEventCollector_description.md command_examples.txt

Download History Raw

category: Network Security
provider: Arista Networks
sectionorder:
- Connect
- Collect
commonfields:
  id: VeloCloudEventCollector
  version: -1
configuration:
  - display: Server URL
    name: url
    type: 0
    required: true
    section: Connect
  - display: Enterprise ID
    name: enterprise_id
    type: 0
    required: true
    additionalinfo: The enterprise logical ID for Arista VeloCloud
    section: Connect
  - display: ""
    displaypassword: API Key
    name: api_key
    type: 9
    required: true
    hiddenusername: true
    additionalinfo: API key for authenticating with Arista VeloCloud
    section: Connect
  - display: First fetch timestamp
    name: first_fetch
    type: 0
    required: false
    additionalinfo: The time range to consider for the first fetch, for example, 3 days ago
    defaultvalue: 1 day ago
    section: Collect
  - display: Limit of events per fetch
    name: limit
    type: 0
    required: false
    additionalinfo: Maxium number of events to pull per fetch
    defaultvalue: 1000
    section: Collect
  - display: Trust any certificate (not secure)
    name: insecure
    type: 8
    required: false
    section: Connect
  - display: Use system proxy settings
    name: proxy
    type: 8
    required: false
    defaultvalue: 'false'
    section: Connect
description: 'Collects events from the VeloCloud API.'
display: VeloCloud Event Collector
name: VeloCloudEventCollector
script:
  script: ''
  type: python
  subtype: python3
  commands:
    - name: velocloud-get-events
      arguments:
        - name: start_time
          description: Start time for event query in ISO format or human-readable format (e.g., '3 days ago').
          required: false
          defaultValue: "1 day ago"
        - name: end_time
          description: End time for event query in ISO format or human-readable format (e.g., 'now').
          required: false
          defaultValue: "now"
        - name: limit
          description: Maximum number of events to retrieve.
          required: false
          defaultValue: "100"
      description: Get events fro`m Arista VeloCloud
      execution: false
      outputs:
        - contextPath: VeloCloud.Event.logicalId
          description: Event logical ID.
          type: String
        - contextPath: VeloCloud.Event.category
          description: Event category.
          type: String
        - contextPath: VeloCloud.Event.event
          description: Event type.
          type: String
        - contextPath: VeloCloud.Event.severity
          description: Event severity.
          type: String
        - contextPath: VeloCloud.Event.message
          description: Event message.
          type: String
        - contextPath: VeloCloud.Event.detail
          description: Event details, usually in JSON string format.
          type: String
        - contextPath: VeloCloud.Event.eventTime
          description: Event timestamp.
          type: Date
        - contextPath: VeloCloud.Event.created
          description: Event creation time.
          type: Date
        - contextPath: VeloCloud.Event.edgeName
          description: Name of the edge.
          type: String
        - contextPath: VeloCloud.Event.enterpriseName
          description: Name of the enterprise.
          type: String
        - contextPath: VeloCloud.Event.enterpriseUsername
          description: Username associated with the enterprise.
          type: String
        - contextPath: VeloCloud.Event.segmentName
          description: Name of the network segment.
          type: String
  dockerimage: demisto/python3:3.12.13.10116658
  isfetchevents: true
  runonce: false
fromversion: 6.5.0
tests:
- No tests (auto formatted)