category: Network Security provider: SolarWinds Corporation sectionorder: - Connect - Collect commonfields: id: SolarWinds version: -1 configuration: - additionalinfo: 'Name or IP address of the Orion server you want to connect to. Do not specify the port number. Examples: myorigin.mydomain.local, 12.153.24.2' display: Name or IP address of the Orion server name: server required: true type: 0 section: Connect - additionalinfo: 'Port number with which to connect to the Orion server. Default is 17774.' display: Port name: port defaultvalue: 17774 required: false type: 0 section: Connect - additionalinfo: Admin can create users such as guests from the Orion platform and provide access permission according to need. display: Username of the account name: credentials required: true type: 9 section: Connect - additionalinfo: 'Note: "Type of incident to be fetched" and "Incident type" should be the same to fetch similar types of incidents.' defaultvalue: Alert display: Type of incident to be fetched name: fetch_type options: - Alert - Event type: 15 section: Collect advanced: true required: false - additionalinfo: The maximum limit is 1000. defaultvalue: '15' display: Maximum number of incidents per fetch name: max_fetch type: 0 section: Collect required: false - additionalinfo: 'Date or relative timestamp to start fetching incidents from. For Alert, incidents will be fetched based on triggered date. For Event, the incidents will be fetched based on event time. (Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.).' defaultvalue: 3 days display: First fetch time interval name: first_fetch type: 0 section: Collect required: false - additionalinfo: |- Fetch list of alerts as per the severity level. If not specified, it fetches all the incidents. Note: Severity level is only available for alerts. display: Severity levels name: severities options: - Information - Notice - Warning - Serious - Critical type: 16 section: Collect advanced: true required: false - additionalinfo: Filter alerts based on the type of property to monitor. If not specified, it will fetch all types of alerts. To list additional object types, use the query 'SELECT DISTINCT ObjectType FROM Orion.AlertConfigurations' in the swis-query command. display: Object Types name: object_types options: - Application - Component - Group - Node - Interface - Volume - 'APM: Application' - 'APM: Component' - Auditing Events - Interface - IPAM DHCPScopes Overlapping - IPAM IP Address Conflict - IPAM.IPRequests - 'NTA: CBQoS Class Map' - Orion.DiscoveryLogs - Orion.NPM.InterfacesForecastCapacity - Orion.NPM.SwitchStack - Orion.NPM.SwitchStackMember - Orion.NPM.SwitchStackPower - Orion.PollingUsage - Polling Engines - QoE Application - QoE Application (per node) - Wireless Access Point - Wireless Controller type: 16 section: Collect advanced: true required: false - additionalinfo: Filter events based on the type. If not specified, it will fetch all types of events. To list additional event types, use the query 'SELECT Name FROM Orion.EventTypes' in the swis-query command. display: Event Types name: event_types options: - Node Down - Node Warning - Interface Down - Interface Up - Interface Shutdown - Critical System Error - Monitoring Started - Monitoring Stopped - Application Stopped - Application Restart - NetFlow Event - NetFlow Critical - Informational - Warning - Critical - SAM Critical - SAM Warning - Rogue Detected - NPM licensing - NPM Module Engine Started - NPM Module Engine Stopped - IPAM Information - IPAM Critical - IPAM Warning - Alert Triggered - Alert Reset - Anomaly detected type: 16 section: Collect advanced: true required: false - display: Use system proxy settings name: proxy type: 8 section: Connect advanced: true required: false - display: Trust any certificate (not secure) name: insecure type: 8 section: Connect advanced: true required: false - defaultvalue: SolarWinds Alert display: Incident type name: incidentType type: 13 section: Connect required: false - display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: '1' required: false type: 19 section: Collect advanced: true - display: Fetch incidents name: isFetch type: 8 section: Collect required: false description: The SolarWinds integration interacts with the SWIS API to allow you to fetch alerts and events. It also provides commands to retrieve lists of alerts and events. display: SolarWinds name: SolarWinds script: commands: - arguments: - auto: PREDEFINED description: |- Whether to retrieve events that are acknowledged. If true, retrieves all acknowledged events. Possible values: "true" and "false". name: acknowledged predefined: - 'true' - 'false' - description: |- A comma-separated ist of event IDs. Note: event_id supports integer values (int64). isArray: true name: event_id - description: 'A comma-separated list of event types. For example: "Warning", "Informational", "Node Up", etc.' isArray: true name: event_type - description: A comma-separated list of nodes. isArray: true name: node - auto: PREDEFINED defaultValue: EventID description: |- Key by which the response will be sorted. For example: "EventID", "EventTime", "Message", "TimeStamp", "EventTypeName", "Node", etc. name: sort_key predefined: - EventID - EventTime - Message - TimeStamp - EventTypeName - Node - auto: PREDEFINED defaultValue: ascending description: 'Order by which the response will be sorted. Possible values: "ascending" and "descending".' name: sort_order predefined: - ascending - descending - defaultValue: '0' description: The page number from which to retrieve events. By default, the per-page limit is 50 events. You can change this value in the limit argument. name: page - defaultValue: '50' description: |- The maximum number of records to be retrieved. Note: The maximum value supported by the limit is maxValue int32. name: limit description: Retrieves a list of events according to filter values provided in the command arguments. execution: true name: swis-event-list outputs: - contextPath: SolarWinds.Event.EventID description: Event ID of the triggered event. type: Number - contextPath: SolarWinds.Event.EventTime description: Timestamp at which the event is triggered. type: Date - contextPath: SolarWinds.Event.NetworkNode description: Network node ID of a triggered event. type: Number - contextPath: SolarWinds.Event.Node description: Network node of a triggered event. type: String - contextPath: SolarWinds.Event.NetObjectID description: NetObject ID of a triggered event. type: Number - contextPath: SolarWinds.Event.NetObjectValue description: NetObject value of a triggered event. type: String - contextPath: SolarWinds.Event.EngineID description: Engine ID of a triggered event. type: Number - contextPath: SolarWinds.Event.EventType description: Type of a triggered event. type: Number - contextPath: SolarWinds.Event.EventTypeName description: Name of the type of a triggered event. type: String - contextPath: SolarWinds.Event.Message description: Message of a triggered event. type: String - contextPath: SolarWinds.Event.Acknowledged description: Whether the event is acknowledged. type: Boolean - contextPath: SolarWinds.Event.NetObjectType description: NetObject type of a triggered event. type: String - contextPath: SolarWinds.Event.Timestamp description: Last modified time of an event. It is a counter that SQL server automatically increments when the event is updated. type: String - contextPath: SolarWinds.Event.DisplayName description: Display name of an event. type: String - contextPath: SolarWinds.Event.Description description: Description of an event. type: String - contextPath: SolarWinds.Event.InstanceType description: Instance type of an event. type: String - contextPath: SolarWinds.Event.Uri description: URI of a triggered event. type: String - contextPath: SolarWinds.Event.InstanceSiteID description: ID of an instance site of which event is triggered. type: Number - arguments: - description: |- A comma-separated list of alert IDs. Note: alert_id supports integer values (int64). isArray: true name: alert_id - description: 'A comma-separated list of the type of property to monitor. For example: "Node", "IPAM.IPRequests", "Orion"."DiscoveryLogs", "APM: Component", "IPAM Networks", "Orion.NodesForecastCapacity", "APM: Application", "Orion.VolumesForecastCapacity", "Orion.NodesForecastCapacity", etc.' isArray: true name: type - description: |- A comma-separated list of severity levels. Possible values: "Information", "Warning", "Critical", "Serious", and "Notice". isArray: true name: severity - auto: PREDEFINED defaultValue: AlertActiveID description: |- Key by which the response will be sorted. For example: "AlertID", "AlertActiveID", "AlertObjectID", "TriggeredDateTime", "TriggeredMessage", "AcknowledgedDateTime", "EngineID", "Name","ObjectType", etc. name: sort_key predefined: - AlertID - AlertActiveID - AlertObjectID - TriggeredDateTime - TriggeredMessage - AcknowledgedDateTime - EngineID - Name - ObjectType - auto: PREDEFINED defaultValue: ascending description: 'Order by which the response will be sorted. Possible values are: "ascending" and "descending".' name: sort_order predefined: - ascending - descending - defaultValue: '0' description: The page number from which to retrieve alerts. By default, the per-page limit is 50 alerts. You can change this value in the limit argument. name: page - defaultValue: '50' description: |- The number of records to be retrieved. Note: The maximum value supported by the limit is maxValue int32. name: limit description: Retrieves a list of alerts based on the filter values provided in the command arguments. name: swis-alert-list outputs: - contextPath: SolarWinds.Alert.AlertActiveID description: Active ID of the triggered alert. type: Number - contextPath: SolarWinds.Alert.AlertObjectID description: Object ID of the triggered alert. type: Number - contextPath: SolarWinds.Alert.Acknowledged description: Whether the alert is acknowledged. type: Boolean - contextPath: SolarWinds.Alert.AcknowledgedBy description: Name of the person who acknowledged the alert. type: String - contextPath: SolarWinds.Alert.AcknowledgedDateTime description: Timestamp when the alert was acknowledged. type: Date - contextPath: SolarWinds.Alert.AcknowledgedNote description: Acknowledge note of the alert. type: String - contextPath: SolarWinds.Alert.TriggeredDateTime description: Timestamp when the alert was triggered. type: Date - contextPath: SolarWinds.Alert.TriggeredMessage description: Message of the triggered alert. type: String - contextPath: SolarWinds.Alert.NumberOfNotes description: Number of notes of the alert. type: Number - contextPath: SolarWinds.Alert.LastExecutedEscalationLevel description: Last executed escalation level for the alert. type: Number - contextPath: SolarWinds.Alert.DisplayName description: Display name of the alert. type: String - contextPath: SolarWinds.Alert.AlertDescription description: Description of the alert. type: String - contextPath: SolarWinds.Alert.InstanceType description: Type of instance of the alert. type: String - contextPath: SolarWinds.Alert.Uri description: URI of the alert. type: String - contextPath: SolarWinds.Alert.InstanceSiteId description: Site ID of the instance. type: Number - contextPath: SolarWinds.Alert.AlertID description: ID of the alert. type: Number - contextPath: SolarWinds.Alert.EntityUri description: URI for the object that triggered the alert. type: String - contextPath: SolarWinds.Alert.EntityType description: Type of the object that triggered the alert. type: String - contextPath: SolarWinds.Alert.EntityCaption description: The display name for the triggering object. type: String - contextPath: SolarWinds.Alert.EntityDetailsUrl description: Relative URL for the details view for the triggering object. type: String - contextPath: SolarWinds.Alert.EntityNetObjectId description: NetObject ID of the entity. type: String - contextPath: SolarWinds.Alert.RelatedNodeUri description: URI of the related node. type: String - contextPath: SolarWinds.Alert.RelatedNodeId description: ID of the related node. type: Number - contextPath: SolarWinds.Alert.RelatedNodeDetailsUrl description: URL which contains node details. type: String - contextPath: SolarWinds.Alert.RelatedNodeCaption description: Caption of the related node. type: String - contextPath: SolarWinds.Alert.RealEntityUri description: URI of the real entity. type: String - contextPath: SolarWinds.Alert.RealEntityType description: Type of the real entity. type: String - contextPath: SolarWinds.Alert.TriggeredCount description: Number of times the alert was triggered. type: Number - contextPath: SolarWinds.Alert.LastTriggeredDateTime description: Timestamp when the alert was last triggered. type: Date - contextPath: SolarWinds.Alert.Context description: Context of the alert. type: String - contextPath: SolarWinds.Alert.AlertNote description: Note of the alert. type: String - contextPath: SolarWinds.Alert.AlertMessage description: Message of the alert. type: String - contextPath: SolarWinds.Alert.AlertRefID description: Unique identifier of the alert. type: String - contextPath: SolarWinds.Alert.Name description: Name of the alert. type: String - contextPath: SolarWinds.Alert.ConfigurationDescription description: Configuration description of the alert. type: String - contextPath: SolarWinds.Alert.ObjectType description: Object type of the alert. type: String - contextPath: SolarWinds.Alert.Enabled description: Whether the alert is enabled. type: Boolean - contextPath: SolarWinds.Alert.Frequency description: Frequency of the alert. type: Number - contextPath: SolarWinds.Alert.Trigger description: Condition due to which the alert was triggered. type: String - contextPath: SolarWinds.Alert.Reset description: Reset condition for the alert. When the condition is met, the alert is removed from active alerts. type: String - contextPath: SolarWinds.Alert.Severity description: Severity of the alert. type: Number - contextPath: SolarWinds.Alert.NotifyEnabled description: Whether it is notified enabled. type: Boolean - contextPath: SolarWinds.Alert.NotificationSettings description: Settings of the notifications for the alerts. type: String - contextPath: SolarWinds.Alert.LastEdit description: Timestamp when the alert was last edited. type: Date - contextPath: SolarWinds.Alert.CreatedBy description: Name of the person who created the alert. type: String - contextPath: SolarWinds.Alert.Category description: Category of the alert. type: String - contextPath: SolarWinds.Alert.Canned description: Whether the alert is canned. type: Boolean - contextPath: SolarWinds.Alert.ResponsibleTeam description: Team that is responsible for the alert. type: String - arguments: - description: The SWQL query to be executed. name: query required: true description: |- Executes a query request. Note: The guidelines for composing the query can be found in the 'View Integration Documentation' linked in the integration tips. name: swis-query dockerimage: demisto/python3:3.12.13.10116658 isfetch: true runonce: false script: '-' subtype: python3 type: python tests: - No tests (auto formatted) fromversion: 5.5.0