Skip to main content

Azure Storage Table

This Integration is part of the Azure Storage Table Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.0.0 and later.

Azure Storage Table#

Create and Manage Azure Storage Tables and Entities. This integration was integrated and tested with version "2020-10-02" of Azure Storage Table

Configure Azure Storage Table on Cortex XSOAR#

  1. Navigate to Settings > Integrations > Servers & Services.

  2. Search for Azure Storage Table.

  3. Click Add instance to create and configure a new integration instance.

    ParameterRequired
    Storage account nameTrue
    Account SAS TokenTrue
    Use system proxy settingsFalse
    Trust any certificate (not secure)False
  4. Click Test to validate the URLs, token, and connection.

Shared Access Signatures (SAS) Permissions#

In order to use the integration use-cases, please make sure your SAS token contains the following permissions:

  1. 'Table' service.
  2. 'Service' and 'Object' resource types.
  3. 'Read', 'Write', 'Delete', 'List', 'Create', 'Add', 'Update' and 'Immutable storage' permissions.
  • Review and select "Generate".

Commands#

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

azure-storage-table-create#


Creates a new table in a storage account.

Base Command#

azure-storage-table-create

Input#

Argument NameDescriptionRequired
table_nameThe name of the new table to create. Rules for naming tables can be found here: https://docs.microsoft.com/en-us/rest/api/storageservices/understanding-the-table-service-data-model.Required

Context Output#

PathTypeDescription
AzureStorageTable.Table.nameStringTable name.

Command Example#

!azure-storage-table-create table_name="xsoar"

Context Example#

{
"AzureStorageTable": {
"Table": {
"name": "xsoar"
}
}
}

Human Readable Output#

Table xsoar successfully created.

azure-storage-table-delete#


Delete the specified table and any data it contains.

Base Command#

azure-storage-table-delete

Input#

Argument NameDescriptionRequired
table_nameThe name of the table to delete.Required

Context Output#

There is no context output for this command.

Command Example#

!azure-storage-table-delete table_name="xsoar"

Human Readable Output#

Table xsoar successfully deleted.

azure-storage-table-query#


List tables under the specified account.

Base Command#

azure-storage-table-query

Input#

Argument NameDescriptionRequired
limitNumber of Tables to retrieve. Default is 50. Default is 50.Optional
filterFilter Tables Query expression.
Information about Query expression structure can be found here: https://docs.microsoft.com/en-us/rest/api/storageservices/querying-tables-and-entities#constructing-filter-strings.
Optional
pagePage Number. Default is 1. Default is 1.Optional

Context Output#

PathTypeDescription
AzureStorageTable.Table.nameStringTable name.

Command Example#

!azure-storage-table-query filter="TableName%20eq%20'xsoar'"

Context Example#

{
"AzureStorageTable": {
"Table": {
"name": "xsoar"
}
}
}

Human Readable Output#

Tables List:#

Current page size: 50 Showing page 1 out others that may exist |Name| |---| | xsoar |

azure-storage-table-entity-insert#


Insert a new entity into a table.

Base Command#

azure-storage-table-entity-insert

Input#

Argument NameDescriptionRequired
table_nameTable name.Required
partition_keyUnique identifier for the partition within a given table.Required
row_keyUnique identifier for an entity within a given partition.Required
entity_fieldsEntity fields in JSON format: { "Key1": Value1, "Key2": Value2}.Required

Context Output#

PathTypeDescription
AzureStorageTable.Table.Entity.PartitionKeyStringEntity partition key.
AzureStorageTable.Table.Entity.RowKeyStringEntity row key.
AzureStorageTable.Table.Entity.TimestampDateEntity last update UTC time.
AzureStorageTable.Table.nameStringEntity table name.

Command Example#

``!azure-storage-table-entity-insert table_name="xsoar" partition_key="xsoar-partition" row_key="xsoar-row" entity_fields={"Age":20}````

Context Example#

{
"AzureStorageTable": {
"Table": {
"Entity": [
{
"Age": 20,
"PartitionKey": "xsoar-partition",
"RowKey": "xsoar-row",
"Timestamp": "2021-11-28T13:23:18"
}
],
"name": "xsoar"
}
}
}

Human Readable Output#

Entity Fields for xsoar Table:#

AgePartition KeyRow KeyTimestamp
20xsoar-partitionxsoar-row2021-11-28T13:23:18

azure-storage-table-entity-update#


Update an existing entity in a table. The Update Entity command does not replace the existing entity.

Base Command#

azure-storage-table-entity-update

Input#

Argument NameDescriptionRequired
table_nameEntity table name.Required
partition_keyUnique identifier for the partition within a given table.Required
row_keyUnique identifier for an entity within a given partition.Required
entity_fieldsEntity fields in JSON format: { "Key1": Value1, "Key2": Value2}.Required

Context Output#

There is no context output for this command.

Command Example#

``!azure-storage-table-entity-update table_name="xsoar" partition_key="xsoar-partition" row_key="xsoar-row" entity_fields={"Address":"New York"}````

Human Readable Output#

Entity in xsoar table successfully updated.

azure-storage-table-entity-replace#


Replace an existing entity in a table. The Replace Entity command replace the entire entity and can be used to remove properties.

Base Command#

azure-storage-table-entity-replace

Input#

Argument NameDescriptionRequired
table_nameTable name.Required
partition_keyUnique identifier for the partition within a given table.Required
row_keyUnique identifier for an entity within a given partition.Required
entity_fieldsEntity records in JSON format: { "Key1": Value1, "Key2": Value2}.Required

Context Output#

There is no context output for this command.

Command Example#

``!azure-storage-table-entity-replace table_name="xsoar" partition_key="xsoar-partition" row_key="xsoar-row" entity_fields={"City": "TLV" }````

Human Readable Output#

Entity in xsoar table successfully replaced.

azure-storage-table-entity-query#


Query Entities in a table.

Base Command#

azure-storage-table-entity-query

Input#

Argument NameDescriptionRequired
table_nameEntity table name.Required
partition_keyUnique identifier for the partition within a given table. If specified, 'row_key' argument must also be specified.Optional
row_keyUnique identifier for an entity within a given partition. If specified, 'partition_key' argument must also be specified.Optional
filterFilter Entities query expression.
Information about Query expression structure can be found here: https://docs.microsoft.com/en-us/rest/api/storageservices/querying-tables-and-entities#constructing-filter-strings.
Optional
selectComma-separated Entity properties to return. If not specified - all fields will be retrieved.Optional
limitNumber of entities to retrieve. Default is 50.
This argument is will be ignored when 'partition_key' or 'row_key' arguments are provided. Default is 50.
Optional
pagePage number. Default is 1.
This argument is will be ignored when 'partition_key' or 'row_key' arguments are provided. Default is 1.
Optional

Context Output#

PathTypeDescription
AzureStorageTable.Table.nameStringEntity table Name.

Command Example#

!azure-storage-table-entity-query table_name="xsoar"

Context Example#

{
"AzureStorageTable": {
"Table": {
"Entity": [
{
"Address": "New York",
"City": "TLV",
"PartitionKey": "xsoar-partition",
"RowKey": "xsoar-row",
"Timestamp": "2021-11-28T13:23:27"
}
],
"name": "xsoar"
}
}
}

Human Readable Output#

Entity Fields for xsoar table:#

Current page size: 50 Showing page 1 out others that may exist |Address|City|Partition Key|Row Key|Timestamp| |---|---|---|---|---| | New York | TLV | xsoar-partition | xsoar-row | 2021-11-28T13:23:27 |

azure-storage-table-entity-delete#


Delete an existing entity in a table.

Base Command#

azure-storage-table-entity-delete

Input#

Argument NameDescriptionRequired
table_nameEntity table name.Required
partition_keyUnique identifier for the partition within a given table.Required
row_keyUnique identifier for an entity within a given partition.Required

Context Output#

There is no context output for this command.

Command Example#

!azure-storage-table-entity-delete table_name="xsoar" partition_key="xsoar-partition" row_key="xsoar-row"

Human Readable Output#

Entity in xsoar table successfully deleted.