xMatters

Details

ID	`xMatters`
Provider	Thoma Bravo
Category	Utilities
From Version	5.5.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

This is an integration for using xMatters.
This integration was integrated and tested with version 1 of xMatters

Configure xMatters in Cortex

Parameter	Description	Required
instance	Your xmatters instance base URL. (i.e. acme.xmatters.com)	True
insecure	Trust any certificate (not secure)	False
proxy	Use system proxy settings	False
username	Username for your xMatters instance.	True
password	Password for your xMatters instance.	True
url	URL of an HTTP trigger in a flow.	True
fetch_type		True
status	Fetch alerts with status (ACTIVE, SUSPENDED)	False
priority	Priority of events to fetch	False
isFetch	Fetch incidents	False
incidentType	Incident type	False
property_name		False
property_value		False
first_fetch	First fetch timestamp (`<number>` `<time unit>`, e.g., 12 hours, 7 days)	False
max_fetch		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

xm-trigger-workflow

sends the event to xMatters

Base Command

xm-trigger-workflow

Input

Argument Name	Description	Required
recipients	Recipients of the xMatters Message	Required
subject	Subject of the xMatters Message	Optional
body	Body of the xMatters Message	Optional
incident_id	Incident ID of Incident referenced	Optional
close_task_id	Id of task to close in playbook. Requires an incident_id as the investigation id.	Optional

Context Output

Path	Type	Description
xMatters.Workflow.request_id	string	Request ID from xMatters

Command Example

!xm-trigger-workflow recipients="Joey" subject="Major Emu Issue" body="The emu has escaped!"

Context Example

{
    "request_id": "93e6b331-2108-424d-872b-8200b476907b"
}

Human Readable Output

Successfully sent a message to xMatters.

xm-get-events

Get events from xMatters.

Base Command

xm-get-events

Input

Argument Name	Description	Required
request_id	The UUID returned from triggering a workflow.	Optional
status	Status of the event.	Optional
priority	Priority of the event.	Optional
from	A date in UTC format that represents the start of the time range you want to search.	Optional
to	A date in UTC format that represents the end of the time range you want to search.	Optional
workflow	The name of the workflow the event is tied to.	Optional
form	The name of the form the event is tied to.	Optional
property_name	An event property name to filter the events	Optional
property_value	An event property value to filter the events	Optional

Context Output

Path	Type	Description
Events	unknown	Events from xMatters.

Command Example

!xm-get-events status=ACTIVE

Context Example

{
    "Events": [
        {
            "Created": "2020-10-13T21:35:07.725+0000",
            "FormName": "Incident",
            "Incident": "7a63abc3-5abf-41ca-969b-80eb678fbf72",
            "Name": "Major Emu Issue\n",
            "PlanName": "Cortex XSOAR",
            "Prioity": "MEDIUM",
            "Properties": null,
            "Status": "ACTIVE",
            "SubmitterName": "admin",
            "Terminated": null
        },
        {
            "Created": "2020-10-13T21:33:58.444+0000",
            "FormName": "Incident",
            "Incident": "388884f1-410b-4eb8-a38e-4973e7151b89",
            "Name": "Major Emu Issue\n",
            "PlanName": "Cortex XSOAR",
            "Prioity": "MEDIUM",
            "Properties": null,
            "Status": "ACTIVE",
            "SubmitterName": "admin",
            "Terminated": null
        }
    ]
}

Human Readable Output

Retrieved Events from xMatters.

xm-get-event

Get a single event from xMatters.

Base Command

xm-get-event

Input

Argument Name	Description	Required
event_id	Unique identifier of the event	Required

Context Output

Path	Type	Description
Event	unknown	Event from xMatters.

Command Example

!xm-get-event event_id=33999001

Context Example

{
    "Event": {
        "Created": "2020-10-13T20:50:24.520+0000",
        "FormName": "Integration Builder: Integration Problem",
        "Incident": "99a7692b-30df-40c4-9a20-edc495ae91f9",
        "Name": "Your xMatters integration has a problem",
        "PlanName": "Integration Builder Notifications",
        "Prioity": "MEDIUM",
        "Properties": null,
        "Status": "ACTIVE",
        "SubmitterName": "xm-support",
        "Terminated": null
    }
}

Human Readable Output

Retrieved Event from xMatters.

Configuration parameters

instance — Your xmatters instance base URL. (i.e. acme.xmatters.com) (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
username — Username for your xMatters instance. (required)
password — Password for your xMatters instance. (required)
url — URL of an HTTP trigger in a flow. (required)
fetch_type — Fetch Type (required)
status — Fetch alerts with status (ACTIVE, TERMINATED, SUSPENDED)
priority — Priority of events to fetch
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
property_name — Property Name
property_value — Property Value
first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
max_fetch — Maximum number of incidents to fetch

Commands (3)

xm-get-event
Get a single event from xMatters.
xm-get-events
Get events from xMatters.
xm-trigger-workflow
sends the event to xMatters.

Source

xMatters.py xMatters_test.py xMatters.yml command_examples.txt xMatters_description.md

Download History Raw

commonfields:
  id: xMatters
  version: -1
name: xMatters
display: xMatters
category: Utilities
sectionorder:
- Connect
- Collect
provider: Thoma Bravo
description: This is an integration for using xMatters.
configuration:
- display: Your xmatters instance base URL. (i.e. acme.xmatters.com)
  name: instance
  type: 0
  required: true
  additionalinfo: This is used to retrieve events and other api calls
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Username for your xMatters instance.
  name: username
  type: 0
  required: true
  section: Connect
- display: Password for your xMatters instance.
  name: password
  type: 4
  required: true
  section: Connect
- display: URL of an HTTP trigger in a flow.
  name: url
  defaultvalue: https://acme.xmatters.com
  type: 0
  required: true
  additionalinfo: This is for creating events in xMatters from Cortex XSOAR. Used for the xm-trigger-workflow command.
  section: Connect
- display: Fetch Type
  additionalinfo: In a future release the xMatters incidents will be supported. For now it's just events.
  name: fetch_type
  defaultvalue: events
  type: 15
  required: true
  options:
  - events
  section: Collect
- display: Fetch alerts with status (ACTIVE, TERMINATED, SUSPENDED)
  name: status
  type: 15
  options:
  - ACTIVE
  - TERMINATED
  - SUSPENDED
  required: false
  section: Collect
- display: Priority of events to fetch
  name: priority
  type: 16
  options:
  - LOW
  - MEDIUM
  - HIGH
  required: false
  section: Collect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- display: Property Name
  name: property_name
  type: 0
  additionalinfo: Property Name to look for in xMatters. Used for importing events.
  required: false
  section: Collect
- display: Property Value
  name: property_value
  type: 0
  additionalinfo: Property Value to look for in xMatters. Used for importing events.
  required: false
  section: Collect
- display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  defaultvalue: 7 days
  name: first_fetch
  type: 0
  required: false
  section: Collect
- display: Maximum number of incidents to fetch
  defaultvalue: '50'
  name: max_fetch
  type: 0
  additionalinfo: Must be between 0 and 201.
  required: false
  section: Collect
script:
  commands:
  - name: xm-trigger-workflow
    arguments:
    - name: recipients
      required: true
      description: Recipients of the xMatters Message.
    - name: subject
      description: Subject of the xMatters Message.
    - name: body
      description: Body of the xMatters Message.
    - name: incident_id
      description: Incident ID of Incident referenced.
    - name: close_task_id
      description: Id of task to close in playbook. Requires an incident_id as the investigation id.
    outputs:
    - contextPath: xMatters.Workflow.request_id
      description: Request ID from xMatters.
      type: string
    description: sends the event to xMatters.
  - name: xm-get-events
    arguments:
    - name: request_id
      description: The UUID returned from triggering a workflow.
    - name: status
      auto: PREDEFINED
      predefined:
      - ACTIVE
      - SUSPENDED
      - TERMINATED
      description: Status of the event.
    - name: priority
      auto: PREDEFINED
      predefined:
      - LOW
      - MEDIUM
      - HIGH
      description: Priority of the event.
    - name: from
      description: A date and time in UTC format that represents the start of the time range you want to search. (i.e. `2020-01-01T00:11:22Z`).
    - name: to
      description: A date and time in UTC format that represents the end of the time range you want to search. (i.e. `2020-01-01T00:11:22Z`).
    - name: workflow
      description: The name of the workflow the event is tied to.
    - name: form
      description: The name of the form the event is tied to.
    - name: property_name
      description: An event property name to filter the events.
    - name: property_value
      description: An event property value to filter the events.
    outputs:
    - contextPath: xMatters.GetEvents.Events
      description: Events from xMatters.
    - contextPath: xMatters.GetEvents.Created
      description: The date and time the event was created.
    - contextPath: xMatters.GetEvents.Terminated
      description: The date and time the event was terminated. Populated only if the event is terminated.
    - contextPath: xMatters.GetEvents.ID
      description: The UUID of the event.
    - contextPath: xMatters.GetEvents.Name
      description: The subject of the event as seen in the event report.
    - contextPath: xMatters.GetEvents.PlanName
      description: The name of the workflow the event is tied to.
    - contextPath: xMatters.GetEvents.FormName
      description: The name of the form the event is tied to.
    - contextPath: xMatters.GetEvents.Status
      description: The status of the event ACTIVE, SUSPENDED, TERMINATED, TERMINATED_EXTERNAL, SUPRESSED.
    - contextPath: xMatters.GetEvents.Priority
      description: The priority of the event. LOW, MEDIUM, HIGH.
    - contextPath: xMatters.GetEvents.Properties
      description: The list of properties tied to the event in name/value pairs.
    - contextPath: xMatters.GetEvents.SubmitterName
      description: The user or integration that created the event.
    description: Get events from xMatters.
  - name: xm-get-event
    arguments:
    - name: event_id
      required: true
      description: Unique identifier of the event.
    outputs:
    - contextPath: xMatters.GetEvent.Events
      description: Events from xMatters.
    - contextPath: xMatters.GetEvent.Created
      description: The date and time the event was created.
    - contextPath: xMatters.GetEvent.Terminated
      description: The date and time the event was terminated. Populated only if the event is terminated.
    - contextPath: xMatters.GetEvent.ID
      description: The UUID of the event.
    - contextPath: xMatters.GetEvent.Name
      description: The subject of the event as seen in the event report.
    - contextPath: xMatters.GetEvent.PlanName
      description: The name of the workflow the event is tied to.
    - contextPath: xMatters.GetEvent.FormName
      description: The name of the form the event is tied to.
    - contextPath: xMatters.GetEvent.Status
      description: The status of the event ACTIVE, SUSPENDED, TERMINATED, TERMINATED_EXTERNAL, SUPRESSED.
    - contextPath: xMatters.GetEvent.Priority
      description: The priority of the event. LOW, MEDIUM, HIGH.
    - contextPath: xMatters.GetEvent.Properties
      description: The list of properties tied to the event in name/value pairs.
    - contextPath: xMatters.GetEvent.SubmitterName
      description: The user or integration that created the event.
    description: Get a single event from xMatters.
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  script: '-'
  subtype: python3
  type: python
fromversion: 5.5.0
tests:
- no tests