category: Database
provider: Open Source
sectionorder:
- Connect
- Collect
commonfields:
  id: Prometheus
  version: -1
name: Prometheus
display: Prometheus
description: >
  Query Prometheus via its HTTP API (/api/v1/query). Supports a pipe-separated
  metric list (e.g., "co2|solar|load") which is converted to a metric-name regex on __name__.
  Returns a tidy table plus machine-readable outputs under Prometheus.Metrics.
fromversion: 6.10.0
marketplaces:
- xsoar
- marketplacev2
defaultEnabled: true

configuration:
- display: Prometheus URL
  name: url
  type: 0
  required: true
  section: Connect
- display: Username / Token label (set to "Bearer" to send a Bearer token)
  name: credentials
  type: 9
  required: false
  additionalinfo: >
    If you set the username to "Bearer", the password will be used as a Bearer token in the Authorization header.
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Request timeout (seconds)
  name: timeout
  type: 0
  required: false
  defaultvalue: "30"
  section: Connect
- display: Default fields (pipe-separated)
  name: default_fields
  type: 0
  required: false
  additionalinfo: >
    Optional default metric list, e.g.
    co2|solar|load|battery|temperature|ambient_temperature|ambient_humidity|humidity|NH3|oxidising|reducing|PM10|pressure|proximity
  section: Collect

script:
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
  commands:
  - name: prometheus-query
    description: >
      Query Prometheus instant vectors by metric name using a pipe-separated "fields" list.
      Builds {__name__=~"..."} (anchored by default) and calls /api/v1/query.
    arguments:
    - name: fields
      description: Pipe-separated metric names (e.g., "co2|solar|load"). If omitted, falls back to instance "default_fields".
      required: false
    - name: anchor
      description: >
        Anchor metric-name regex with ^ and $ to avoid partial matches (default: true).
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      default: true
      required: false
    - name: time
      description: Query evaluation time (RFC3339 timestamp or unix seconds). Optional.
      required: false
    - name: query
      description: >-
        Raw Prometheus query string to use instead of building from fields. Example: {__name__=~"(co2|solar)"} or rate(http_requests_total[5m]).
      required: false
    outputs:
    - contextPath: Prometheus.Metrics.name
      description: Metric name (__name__).
      type: String
    - contextPath: Prometheus.Metrics.value
      description: Metric value (float if numeric, otherwise string).
      type: Unknown
    - contextPath: Prometheus.Metrics.ts
      description: Sample timestamp (ISO8601, UTC).
      type: Date
    - contextPath: Prometheus.Metrics.ts_unix
      description: Sample timestamp (unix seconds).
      type: Number
    - contextPath: Prometheus.Metrics.labels
      description: Metric labels (excluding __name__).
      type: Unknown

  - name: prometheus-raw
    description: Run any raw Prometheus instant query string against /api/v1/query.
    arguments:
    - name: query
      description: Prometheus query string (required).
      required: true
    - name: time
      description: Query evaluation time (RFC3339 timestamp or unix seconds). Optional.
      required: false
    outputs:
    - contextPath: Prometheus.Metrics.name
      description: Metric name (__name__).
      type: String
    - contextPath: Prometheus.Metrics.value
      description: Metric value (float if numeric, otherwise string).
      type: Unknown
    - contextPath: Prometheus.Metrics.ts
      description: Sample timestamp (ISO8601, UTC).
      type: Date
    - contextPath: Prometheus.Metrics.ts_unix
      description: Sample timestamp (unix seconds).
      type: Number
    - contextPath: Prometheus.Metrics.labels
      description: Metric labels (excluding __name__).
      type: Unknown

  script: ""
tests:
- No tests (auto)