category: Analytics & SIEM
provider: Google
commonfields:
  id: Looker
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- display: API URL and port (e.g., https://example.looker.com:19999)
  name: url
  required: true
  type: 0
  section: Connect
- display: API3 Client ID
  name: client_id
  required: false
  hidden: true
  type: 0
  section: Connect
- display: API3 Client Secret
  name: client_secret
  type: 4
  hidden: true
  required: false
  section: Connect
- display: API3 Client ID
  name: credentials_api3_client
  type: 9
  displaypassword: API3 Client Secret
  section: Connect
  required: false
- display: Trust any certificate (not secure)
  name: unsecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
description: Use the Looker integration to query an explore, save queries as looks, run looks, and fetch look results as incidents.
display: Looker
name: Looker
script:
  commands:
  - arguments:
    - default: true
      description: ID of the look. Can be found in the look's URL, or by running the 'looker-search-looks' command.
      name: id
    - description: Fields to return.
      isArray: true
      name: fields
    - description: Name of the look.
      name: name
    - defaultValue: '50'
      description: Maximum number of looks to return (0 for looker-determined limit).
      name: limit
    - auto: PREDEFINED
      defaultValue: json
      description: Format of the result.
      name: result_format
      predefined:
      - json
      - csv
      required: true
    description: Runs a saved look and returns the results in the specified format.
    name: looker-run-look
    outputs:
    - contextPath: LookerResults.LookID
      description: Look ID.
      type: Number
    - contextPath: LookerResults.Results
      description: Look results.
      type: Unknown
  - arguments:
    - default: true
      description: Match look name.
      name: name
    - description: Filter results by a particular space.
      name: space_id
    - description: Filter by dashboards created by a particular user.
      name: user_id
    - defaultValue: '50'
      description: Maximum number of looks to return (0 for looker-determined limit).
      name: limit
      predefined:
      - ''
    description: Retrieves saved looks that match the search criteria.
    name: looker-search-looks
    outputs:
    - contextPath: Looker.Look.ID
      description: Look ID.
      type: Number
    - contextPath: Looker.Look.Name
      description: Look name.
      type: String
    - contextPath: Looker.Look.SpaceID
      description: ID of the space that contains the look.
      type: Number
    - contextPath: Looker.Look.SpaceName
      description: Name of the space that contains the look.
      type: String
    - contextPath: Looker.Look.LastUpdated
      description: The time that the look was last updated.
      type: Date
  - arguments:
    - description: Name of the model. Can be found in the explore's URL.
      name: model
      required: true
    - description: Name of the view or explore. Can be found in the explore's URL.
      name: view
      required: true
    - description: 'List of fields to display. (Field name format: "object_name.field_name").'
      isArray: true
      name: fields
    - description: 'Filters for the query, passed as a semicolon-separated list with the format: "field name=filter value;..." (Field name format: "object_name.field_name").'
      isArray: true
      name: filters
    - description: 'List of pivots. (Field name format: "object_name.field_name").'
      isArray: true
      name: pivots
    - description: 'Sorting for the query results. (Field name format: "object_name.field_name").'
      isArray: true
      name: sorts
    - defaultValue: '50'
      description: Maximum number of looks to return (0 for looker-determined limit).
      name: limit
    - auto: PREDEFINED
      defaultValue: json
      description: Format of the results.
      name: result_format
      predefined:
      - json
      - csv
      required: true
    description: Runs a query by defining it in the command arguments, rather than a saved query in looker.
    name: looker-run-inline-query
    outputs:
    - contextPath: LookerResults.InlineQuery
      description: Inline query results.
      type: Unknown
  - arguments:
    - description: Name of the model. Can be found in the explore's URL.
      name: model
      required: true
    - description: Name of the view or explore. Can be found in the explore's URL.
      name: view
      required: true
    - description: 'List of fields to display. (Field name format: "object_name.field_name").'
      isArray: true
      name: fields
    - description: 'Filters for the query, passed as a semicolon-separated list with the format: "field name=filter value;..." (Field name format: "object_name.field_name").'
      isArray: true
      name: filters
    - description: 'List of pivots. (Field name format: "object_name.field_name").'
      isArray: true
      name: pivots
    - description: 'Sorting for the query results. (Field name format: "object_name.field_name").'
      isArray: true
      name: sorts
    - description: Title of the look.
      name: look_title
      required: true
    - description: Description of the look.
      name: look_description
    - description: ID of the space that will contain the look.
      name: look_space_id
      required: true
    description: Creates a look from a query.
    name: looker-create-look
    outputs:
    - contextPath: Looker.Look.ID
      description: Look ID.
      type: Number
    - contextPath: Looker.Look.Name
      description: Look name.
      type: String
    - contextPath: Looker.Look.SpaceID
      description: ID of the space that contains the look.
      type: Number
    - contextPath: Looker.Look.SpaceName
      description: Name of the space that contains the look.
      type: String
    - contextPath: Looker.Look.LastUpdated
      description: The time that the look was last updated.
      type: Date
  dockerimage: demisto/python3:3.12.13.10325753
  runonce: false
  script: '-'
  type: python
  subtype: python3
tests:
- Test-Looker
fromversion: 5.0.0