Skip to main content

SolarWinds

Supported versions

Supported Cortex XSOAR versions: 5.5.0 and later.

The SolarWinds integration interacts with the SWIS API to allow users to fetch alerts and events. It also provides commands to retrieve lists of alerts and events. This integration was integrated and tested with version 3.0.0 of SolarWinds Information Service (SWIS API).

SolarWinds Help#

The SolarWinds integration requires installation of SolarWinds Orion Platform which consolidates the full suite of monitoring capabilities into one platform. The following products used in this integration are managed under Orion

  • Network Performance Manager
  • Netflow Traffic Analyzer
  • Network Configuration Manager
  • IP Address Manager
  • Log Analyzer
  • Server and Application Monitor

How to install SolarWinds Orion Platform#

Follow this link to view a comprehensive guide on how to install Orion and the managed products.

Configure SolarWinds on Cortex XSOAR#

  1. Navigate to Settings > Integrations > Servers & Services.

  2. Search for SolarWinds.

  3. Click Add instance to create and configure a new integration instance.

    ParameterDescriptionRequired
    Name or IP address of the Orion serverName or IP address of the Orion server you want to connect to. Do not specify the port number. Examples: myorigin.mydomain.local, 12.153.24.2True
    Username of the accountAdmin can create users such as guests from the Orion platform and provide access permission according to need.True
    Type of incident to be fetchedNote: 'Type of incident to be fetched' and 'Incident type' should be the same to fetch similar types of incidents.False
    Maximum number of incidents per fetchThe maximum limit is 1000.False
    First fetch time intervalDate or relative timestamp to start fetching incidents from. For Alert, incidents will be fetched based on triggered date. For Event, the incidents will be fetched based on event time. ( Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc.).False
    Severity levelsFetch list of alerts as per the severity level. If not specified, it fetches all the incidents.
    Note: Severity level is only available for alerts.
    False
    Object TypesFilter alerts based on the type of property to monitor. If not specified, it will fetch all types of alerts. To list additional object types, use the query 'SELECT DISTINCT ObjectType FROM Orion.AlertConfigurations' in the swis-query command.False
    Event TypesFilter events based on the type. If not specified, it will fetch all types of events. To list additional event types, use query 'SELECT Name FROM Orion.EventTypes' in swis-query command.False
    Use system proxy settingsFalse
    Trust any certificate (not secure)False
    Incident typeFalse
    Fetch incidentsFalse
  4. Click Test to validate the URLs, token, and connection.

Commands#

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

swis-event-list#


Retrieves a list of events on the filter values provided in the command arguments.

Base Command#

swis-event-list

Input#

Argument NameDescriptionRequired
acknowledgedWhether to retrieve events that are acknowledged. If true, then retrieves all acknowledged events.
Possible values: true and false.
Optional
event_idA comma-separated ist of event IDs.
Note: event_id supports integer values (int64).
Optional
event_typeA comma-separated list of event types. For example: Warning, Informational, Node Up, etc.Optional
nodeTo retrieve events of specific nodes.Optional
sort_keyKey by which the response will be sorted.
For example: EventID, EventTime, Message, TimeStamp, EventTypeName, Node, etc. Default is EventID.
Optional
sort_orderOrder by which the response will be sorted. Possible values: ascending and descending. Default is ascending.Optional
pageThe page number from which retrieve events. By default, the per-page limit is 50 events. You can change this value in the limit argument. Default is 0.Optional
limitThe maximum number of records to be retrieved.
Note: The maximum value supported by the limit is maxValue int32. Default is 50.
Optional

Context Output#

PathTypeDescription
SolarWinds.Event.EventIDNumberEvent ID of the triggered event.
SolarWinds.Event.EventTimeDateTimestamp at which the event is triggered.
SolarWinds.Event.NetworkNodeNumberNetwork node ID of a triggered event.
SolarWinds.Event.NodeStringNetwork node of a triggered event.
SolarWinds.Event.NetObjectIDNumberNetObject ID of a triggered event.
SolarWinds.Event.NetObjectValueStringNetObject value of a triggered event.
SolarWinds.Event.EngineIDNumberEngine ID of a triggered event.
SolarWinds.Event.EventTypeNumberType of a triggered event.
SolarWinds.Event.EventTypeNameStringName of the type of a triggered event.
SolarWinds.Event.MessageStringMessage of a triggered event.
SolarWinds.Event.AcknowledgedBooleanWhether the event is acknowledged.
SolarWinds.Event.NetObjectTypeStringNetObject type of a triggered event.
SolarWinds.Event.TimestampStringLast modified time of an event. It is a counter that SQL server automatically increments when the event is updated.
SolarWinds.Event.DisplayNameStringDisplay name of an event.
SolarWinds.Event.DescriptionStringDescription of an event.
SolarWinds.Event.InstanceTypeStringInstance type of an event.
SolarWinds.Event.UriStringURI of a triggered event.
SolarWinds.Event.InstanceSiteIDNumberID of an instance site of which event is triggered.

Command Example#

!swis-event-list sort_key="EventID" sort_order="Ascending" page="1" limit="2"

Context Example#

{
"SolarWinds": {
"Event": [
{
"Acknowledged": false,
"EngineID": 1,
"EventID": 3,
"EventTime": "2021-03-31T12:02:05.6830000",
"EventType": 315,
"EventTypeName": "Notification Reset",
"InstanceSiteId": 0,
"InstanceType": "Orion.Events",
"Message": "Resetting unknown traffic notification events.",
"NetObjectID": 0,
"NetObjectType": "N",
"NetworkNode": 1,
"Node": "WIN-MV956AU5BSN",
"TimeStamp": [
"0",
"0",
"0",
"0",
"0",
"0",
"7",
"211"
],
"Uri": "swis://WIN-MV956AU5BSN./Orion/Orion.Events/EventID=3"
},
{
"Acknowledged": false,
"EngineID": 1,
"EventID": 4,
"EventTime": "2021-03-31T12:02:08.5570000",
"EventType": 300,
"EventTypeName": "The NetFlow Receiver Service Started",
"InstanceSiteId": 0,
"InstanceType": "Orion.Events",
"Message": "The NetFlow Receiver Service [WIN-MV956AU5BSN] started - listening on port(s) [2055]",
"NetObjectID": 0,
"NetObjectType": "N",
"NetworkNode": 1,
"Node": "WIN-MV956AU5BSN",
"TimeStamp": [
"0",
"0",
"0",
"0",
"0",
"0",
"7",
"212"
],
"Uri": "swis://WIN-MV956AU5BSN./Orion/Orion.Events/EventID=4"
}
]
}
}

Human Readable Output#

Events#

IDMessageTypeNodeAcknowledgedTriggered At
3Resetting unknown traffic notification events.Notification ResetWIN-MV956AU5BSNfalse31/03/2021 12:02 PM
4The NetFlow Receiver Service [WIN-MV956AU5BSN] started - listening on port(s) [2055]The NetFlow Receiver Service StartedWIN-MV956AU5BSNfalse31/03/2021 12:02 PM

swis-alert-list#


Retrieves a list of alerts based on the filter values provided in the command arguments.

Base Command#

swis-alert-list

Input#

Argument NameDescriptionRequired
alert_idA comma-separated list of alert IDs.
Note: alert_id supports integer values (int64).
Optional
typeA comma-separated list of the type of property to monitor. For example: Node, IPAM.IPRequests, Orion.DiscoveryLogs, APM: Component, IPAM Networks, Orion.NodesForecastCapacity, APM: Application, Orion.VolumesForecastCapacity, Orion.NodesForecastCapacity, etc.Optional
severityA comma-separated list of severity levels.
Possible values: Information, Warning, Critical, Serious, and Notice.
Optional
sort_keyKey by which the response will be sorted.
For example: AlertID, AlertActiveID, AlertObjectID, TriggeredDateTime, TriggeredMessage, AcknowledgedDateTime, EngineID, Name, ObjectType, etc. Default is AlertActiveID.
Optional
sort_orderOrder by which the response will be sorted. Possible values: ascending and descending. Default is ascending.Optional
pageThe page number from which to retrieve alerts. By default, the per-page limit is 50 alerts. You can change change this value in the limit argument. Default is 0.Optional
limitThe number of records to be retrieved.
Note: The maximum value supported by the limit is maxValue int32. Default is 50.
Optional

Context Output#

PathTypeDescription
SolarWinds.Alert.AlertActiveIDNumberActive ID of the triggered alert.
SolarWinds.Alert.AlertObjectIDNumberObject ID of the triggered alert.
SolarWinds.Alert.AcknowledgedBooleanWhether the alert is acknowledged.
SolarWinds.Alert.AcknowledgedByStringName of the person who acknowledged the alert.
SolarWinds.Alert.AcknowledgedDateTimeDateTimestamp when the alert was acknowledged.
SolarWinds.Alert.AcknowledgedNoteStringAcknowledge note of the alert.
SolarWinds.Alert.TriggeredDateTimeDateTimestamp when the alert was triggered.
SolarWinds.Alert.TriggeredMessageStringMessage of the triggered alert.
SolarWinds.Alert.NumberOfNotesNumberNumber of notes of the alert.
SolarWinds.Alert.LastExecutedEscalationLevelNumberLast executed escalation level for the alert.
SolarWinds.Alert.DisplayNameStringDisplay name of the alert.
SolarWinds.Alert.AlertDescriptionStringDescription of the alert.
SolarWinds.Alert.InstanceTypeStringType of instance of the alert.
SolarWinds.Alert.UriStringURI of the alert.
SolarWinds.Alert.InstanceSiteIdNumberSite ID of the instance.
SolarWinds.Alert.AlertIDNumberID of the alert.
SolarWinds.Alert.EntityUriStringURI for the object that triggered the alert.
SolarWinds.Alert.EntityTypeStringType of the object that triggered the alert.
SolarWinds.Alert.EntityCaptionStringThe display name for the triggering object.
SolarWinds.Alert.EntityDetailsUrlStringRelative URL for the details view for the triggering object.
SolarWinds.Alert.EntityNetObjectIdStringNetObject ID of the entity.
SolarWinds.Alert.RelatedNodeUriStringURI of the related node
SolarWinds.Alert.RelatedNodeIdNumberID of the related node.
SolarWinds.Alert.RelatedNodeDetailsUrlStringURL which contains node details.
SolarWinds.Alert.RelatedNodeCaptionStringCaption of the related node.
SolarWinds.Alert.RealEntityUriStringURI of the real entity.
SolarWinds.Alert.RealEntityTypeStringType of the real entity.
SolarWinds.Alert.TriggeredCountNumberNumber of times the alert was triggered.
SolarWinds.Alert.LastTriggeredDateTimeDateTimestamp when the alert was last triggered.
SolarWinds.Alert.ContextStringContext of the alert.
SolarWinds.Alert.AlertNoteStringNote of the alert.
SolarWinds.Alert.AlertMessageStringMessage of the alert.
SolarWinds.Alert.AlertRefIDStringUnique identifier of the alert.
SolarWinds.Alert.NameStringName of the alert.
SolarWinds.Alert.ConfigurationDescriptionStringConfiguration description of the alert.
SolarWinds.Alert.ObjectTypeStringObject type of the alert.
SolarWinds.Alert.EnabledBooleanWhether the alert is enabled.
SolarWinds.Alert.FrequencyNumberFrequency of the alert.
SolarWinds.Alert.TriggerStringCondition due to which the alert was triggered.
SolarWinds.Alert.ResetStringReset condition for the alert. When the condition is met, the alert is removed from active alerts.
SolarWinds.Alert.SeverityNumberSeverity of the alert.
SolarWinds.Alert.NotifyEnabledBooleanWhether it is notified enabled.
SolarWinds.Alert.NotificationSettingsStringSettings of the notifications for the alerts.
SolarWinds.Alert.LastEditDateTimestamp when the alert was last edited.
SolarWinds.Alert.CreatedByStringName of the person who created the alert.
SolarWinds.Alert.CategoryStringCategory of the alert.
SolarWinds.Alert.CannedBooleanWhether the alert is canned.
SolarWinds.Alert.ResponsibleTeamStringTeam that is responsible for the alert.

Command Example#

!swis-alert-list sort_key="AlertActiveID" sort_order="ascending" page="1" limit="2"

Context Example#

{
"SolarWinds": {
"Alert": [
{
"AlertActiveID": 4,
"AlertID": 91,
"AlertMessage": "${N=SwisEntity;M=FirstName} ${N=SwisEntity;M=LastName} has requested ${N=SwisEntity;M=RequestAddressCount} IP address(es) at ${N=SwisEntity;M=RequestDate}\n Contact details: ${N=SwisEntity;M=Phone}, ${N=SwisEntity;M=Email}\n Comments: ${N=SwisEntity;M=Comment}",
"AlertObjectID": 3,
"AlertRefID": "227c01da-1e64-44f2-807b-e6c7d2898ae5",
"Canned": true,
"ConfigurationDescription": "This alert writes to the event log when Request IP Address is created.",
"Context": "null",
"Enabled": true,
"EntityCaption": "IP Request (test test)",
"EntityNetObjectId": "IPAMIPREQ:2",
"EntityType": "IPAM.IPRequests",
"EntityUri": "swis://WIN-MV956AU5BSN./Orion/IPAM.IPRequests/IPRequestId=2",
"Frequency": 60,
"InstanceSiteId": 0,
"InstanceType": "Orion.AlertActive",
"LastEdit": "2021-03-31T12:03:59.7466667Z",
"LastTriggeredDateTime": "2021-04-06T12:53:07.9200000Z",
"Name": "IP Address Request",
"NotifyEnabled": true,
"ObjectType": "IPAM.IPRequests",
"RealEntityType": "IPAM.IPRequests",
"RealEntityUri": "swis://WIN-MV956AU5BSN./Orion/IPAM.IPRequests/IPRequestId=2",
"Reset": "<ArrayOfAlertConditionShelve xmlns=\"http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Models.Alerting\" xmlns:i=\"http://www.w3.org/2001/XMLSchema-instance\"><AlertConditionShelve><AndThenTimeInterval i:nil=\"true\"/><ChainType>ResetCustom</ChainType><ConditionTypeID>Core.Dynamic</ConditionTypeID><Configuration>&lt;AlertConditionDynamic xmlns=\"http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Alerting.Plugins.Conditions.Dynamic\" xmlns:i=\"http://www.w3.org/2001/XMLSchema-instance\"&gt;&lt;ExprTree xmlns:a=\"http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Models.Alerting\"&gt;&lt;a:Child&gt;&lt;a:Expr&gt;&lt;a:Child&gt;&lt;a:Expr&gt;&lt;a:Child i:nil=\"true\"/&gt;&lt;a:NodeType&gt;Field&lt;/a:NodeType&gt;&lt;a:Value&gt;IPAM.IPRequests|State&lt;/a:Value&gt;&lt;/a:Expr&gt;&lt;a:Expr&gt;&lt;a:Child i:nil=\"true\"/&gt;&lt;a:NodeType&gt;Constant&lt;/a:NodeType&gt;&lt;a:Value&gt;3&lt;/a:Value&gt;&lt;/a:Expr&gt;&lt;/a:Child&gt;&lt;a:NodeType&gt;Operator&lt;/a:NodeType&gt;&lt;a:Value&gt;=&lt;/a:Value&gt;&lt;/a:Expr&gt;&lt;/a:Child&gt;&lt;a:NodeType&gt;Operator&lt;/a:NodeType&gt;&lt;a:Value&gt;AND&lt;/a:Value&gt;&lt;/ExprTree&gt;&lt;Scope i:nil=\"true\" xmlns:a=\"http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Models.Alerting\"/&gt;&lt;TimeWindow i:nil=\"true\"/&gt;&lt;/AlertConditionDynamic&gt;</Configuration><ConjunctionOperator>None</ConjunctionOperator><IsInvertedMinCountThreshold>false</IsInvertedMinCountThreshold><NetObjectsMinCountThreshold i:nil=\"true\"/><ObjectType>IPAM IP Requests</ObjectType><SustainTime i:nil=\"true\"/></AlertConditionShelve></ArrayOfAlertConditionShelve>",
"Severity": 2,
"Trigger": "<ArrayOfAlertConditionShelve xmlns=\"http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Models.Alerting\" xmlns:i=\"http://www.w3.org/2001/XMLSchema-instance\"><AlertConditionShelve><AndThenTimeInterval i:nil=\"true\"/><ChainType>Trigger</ChainType><ConditionTypeID>Core.Dynamic</ConditionTypeID><Configuration>&lt;AlertConditionDynamic xmlns=\"http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Alerting.Plugins.Conditions.Dynamic\" xmlns:i=\"http://www.w3.org/2001/XMLSchema-instance\"&gt;&lt;ExprTree xmlns:a=\"http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Models.Alerting\"&gt;&lt;a:Child&gt;&lt;a:Expr&gt;&lt;a:Child&gt;&lt;a:Expr&gt;&lt;a:Child i:nil=\"true\"/&gt;&lt;a:NodeType&gt;Field&lt;/a:NodeType&gt;&lt;a:Value&gt;IPAM.IPRequests|State&lt;/a:Value&gt;&lt;/a:Expr&gt;&lt;a:Expr&gt;&lt;a:Child i:nil=\"true\"/&gt;&lt;a:NodeType&gt;Constant&lt;/a:NodeType&gt;&lt;a:Value&gt;2&lt;/a:Value&gt;&lt;/a:Expr&gt;&lt;/a:Child&gt;&lt;a:NodeType&gt;Operator&lt;/a:NodeType&gt;&lt;a:Value&gt;=&lt;/a:Value&gt;&lt;/a:Expr&gt;&lt;/a:Child&gt;&lt;a:NodeType&gt;Operator&lt;/a:NodeType&gt;&lt;a:Value&gt;AND&lt;/a:Value&gt;&lt;/ExprTree&gt;&lt;Scope i:nil=\"true\" xmlns:a=\"http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Models.Alerting\"/&gt;&lt;TimeWindow i:nil=\"true\"/&gt;&lt;/AlertConditionDynamic&gt;</Configuration><ConjunctionOperator>None</ConjunctionOperator><IsInvertedMinCountThreshold>false</IsInvertedMinCountThreshold><NetObjectsMinCountThreshold i:nil=\"true\"/><ObjectType>IPAM IP Requests</ObjectType><SustainTime i:nil=\"true\"/></AlertConditionShelve></ArrayOfAlertConditionShelve>",
"TriggeredCount": 2,
"TriggeredDateTime": "2021-04-06T12:53:07.2300000Z",
"TriggeredMessage": "test test has requested 1 IP address(es) at 4/6/2021 4:54:24 PM\n Contact details: , dummy@dummy.com\n Comments: ",
"Uri": "swis://WIN-MV956AU5BSN./Orion/Orion.AlertActive/AlertActiveID=4,AlertObjectID=3"
},
{
"AlertActiveID": 7,
"AlertID": 112,
"AlertMessage": "Network Discovery Failed",
"AlertObjectID": 5,
"AlertRefID": "eac27bca-77f7-40a5-a359-4069e96bc88e",
"Canned": true,
"ConfigurationDescription": "This alert will send an email if Network Discovery fails.",
"Context": "{\"PropertiesValues\":{\".DiscoveryLogID\":5,\".FinishedTimeStamp\":\"2021-04-06T14:44:14Z\",\".ProfileID\":2,\".AutoImport\":true,\".Result\":3,\".ResultDescription\":\"Import Failed\",\".BatchID\":\"20881db3-ed49-4f4e-8356-e50f0ac5e4e0\",\".ErrorMessage\":\"Unknown Error\",\".InstanceType\":\"Orion.DiscoveryLogs\",\"Uri\":\"swis://WIN-MV956AU5BSN./Orion/Orion.DiscoveryLogs/DiscoveryLogID=5\",\"DisplayName\":\"Import Failed\"}}",
"Enabled": true,
"EntityCaption": "Import Failed",
"EntityNetObjectId": ":",
"EntityType": "Orion.DiscoveryLogs",
"EntityUri": "swis://WIN-MV956AU5BSN./Orion/Orion.DiscoveryLogs/DiscoveryLogID=5",
"Frequency": 60,
"InstanceSiteId": 0,
"InstanceType": "Orion.AlertActive",
"LastEdit": "2021-03-31T12:04:06.0133333Z",
"LastTriggeredDateTime": "2021-04-06T15:01:22.3570000Z",
"Name": "Network Discovery Failed",
"NotificationSettings": "<AlertNotificationSetting xmlns=\"http://schemas.solarwinds.com/2008/Core\" xmlns:i=\"http://www.w3.org/2001/XMLSchema-instance\"><Enabled>true</Enabled><NetObjectType>Orion.DiscoveryLogs</NetObjectType><Severity>Informational</Severity><Subject>Network Discovery Failed</Subject><_properties xmlns:a=\"http://schemas.microsoft.com/2003/10/Serialization/Arrays\"/></AlertNotificationSetting>",
"NotifyEnabled": true,
"ObjectType": "Orion.DiscoveryLogs",
"RealEntityType": "Orion.DiscoveryLogs",
"RealEntityUri": "swis://WIN-MV956AU5BSN./Orion/Orion.DiscoveryLogs/DiscoveryLogID=5",
"Reset": "<ArrayOfAlertConditionShelve xmlns=\"http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Models.Alerting\" xmlns:i=\"http://www.w3.org/2001/XMLSchema-instance\"><AlertConditionShelve><AndThenTimeInterval i:nil=\"true\"/><ChainType>ResetWhenTriggered</ChainType><ConditionTypeID i:nil=\"true\"/><Configuration i:nil=\"true\"/><ConjunctionOperator>None</ConjunctionOperator><IsInvertedMinCountThreshold>false</IsInvertedMinCountThreshold><NetObjectsMinCountThreshold i:nil=\"true\"/><ObjectType i:nil=\"true\"/><SustainTime i:nil=\"true\"/></AlertConditionShelve></ArrayOfAlertConditionShelve>",
"Severity": 0,
"Trigger": "<ArrayOfAlertConditionShelve xmlns=\"http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Models.Alerting\" xmlns:i=\"http://www.w3.org/2001/XMLSchema-instance\"><AlertConditionShelve><AndThenTimeInterval i:nil=\"true\"/><ChainType>Trigger</ChainType><ConditionTypeID>Core.Dynamic</ConditionTypeID><Configuration>&lt;AlertConditionDynamic xmlns=\"http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Alerting.Plugins.Conditions.Dynamic\" xmlns:i=\"http://www.w3.org/2001/XMLSchema-instance\"&gt;&lt;ExprTree xmlns:a=\"http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Models.Alerting\"&gt;&lt;a:Child&gt;&lt;a:Expr&gt;&lt;a:Child&gt;&lt;a:Expr&gt;&lt;a:Child/&gt;&lt;a:NodeType&gt;Constant&lt;/a:NodeType&gt;&lt;a:Value&gt;True&lt;/a:Value&gt;&lt;/a:Expr&gt;&lt;a:Expr&gt;&lt;a:Child/&gt;&lt;a:NodeType&gt;Constant&lt;/a:NodeType&gt;&lt;a:Value&gt;0&lt;/a:Value&gt;&lt;/a:Expr&gt;&lt;a:Expr&gt;&lt;a:Child/&gt;&lt;a:NodeType&gt;Constant&lt;/a:NodeType&gt;&lt;a:Value&gt;0&lt;/a:Value&gt;&lt;/a:Expr&gt;&lt;a:Expr&gt;&lt;a:Child&gt;&lt;a:Expr&gt;&lt;a:Child&gt;&lt;a:Expr&gt;&lt;a:Child i:nil=\"true\"/&gt;&lt;a:NodeType&gt;Field&lt;/a:NodeType&gt;&lt;a:Value&gt;Orion.DiscoveryLogs|Result&lt;/a:Value&gt;&lt;/a:Expr&gt;&lt;a:Expr&gt;&lt;a:Child i:nil=\"true\"/&gt;&lt;a:NodeType&gt;Constant&lt;/a:NodeType&gt;&lt;a:Value&gt;1&lt;/a:Value&gt;&lt;/a:Expr&gt;&lt;/a:Child&gt;&lt;a:NodeType&gt;Operator&lt;/a:NodeType&gt;&lt;a:Value&gt;=&lt;/a:Value&gt;&lt;/a:Expr&gt;&lt;a:Expr&gt;&lt;a:Child&gt;&lt;a:Expr&gt;&lt;a:Child i:nil=\"true\"/&gt;&lt;a:NodeType&gt;Field&lt;/a:NodeType&gt;&lt;a:Value&gt;Orion.DiscoveryLogs|Result&lt;/a:Value&gt;&lt;/a:Expr&gt;&lt;a:Expr&gt;&lt;a:Child i:nil=\"true\"/&gt;&lt;a:NodeType&gt;Constant&lt;/a:NodeType&gt;&lt;a:Value&gt;3&lt;/a:Value&gt;&lt;/a:Expr&gt;&lt;/a:Child&gt;&lt;a:NodeType&gt;Operator&lt;/a:NodeType&gt;&lt;a:Value&gt;=&lt;/a:Value&gt;&lt;/a:Expr&gt;&lt;a:Expr&gt;&lt;a:Child&gt;&lt;a:Expr&gt;&lt;a:Child i:nil=\"true\"/&gt;&lt;a:NodeType&gt;Field&lt;/a:NodeType&gt;&lt;a:Value&gt;Orion.DiscoveryLogs|Result&lt;/a:Value&gt;&lt;/a:Expr&gt;&lt;a:Expr&gt;&lt;a:Child i:nil=\"true\"/&gt;&lt;a:NodeType&gt;Constant&lt;/a:NodeType&gt;&lt;a:Value&gt;4&lt;/a:Value&gt;&lt;/a:Expr&gt;&lt;/a:Child&gt;&lt;a:NodeType&gt;Operator&lt;/a:NodeType&gt;&lt;a:Value&gt;=&lt;/a:Value&gt;&lt;/a:Expr&gt;&lt;/a:Child&gt;&lt;a:NodeType&gt;Operator&lt;/a:NodeType&gt;&lt;a:Value&gt;OR&lt;/a:Value&gt;&lt;/a:Expr&gt;&lt;/a:Child&gt;&lt;a:NodeType&gt;Event&lt;/a:NodeType&gt;&lt;a:Value&gt;[createEvent].Orion.DiscoveryLogs|event&lt;/a:Value&gt;&lt;/a:Expr&gt;&lt;/a:Child&gt;&lt;a:NodeType&gt;Operator&lt;/a:NodeType&gt;&lt;a:Value&gt;AND&lt;/a:Value&gt;&lt;/ExprTree&gt;&lt;Scope i:nil=\"true\" xmlns:a=\"http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Models.Alerting\"/&gt;&lt;TimeWindow i:nil=\"true\"/&gt;&lt;/AlertConditionDynamic&gt;</Configuration><ConjunctionOperator>None</ConjunctionOperator><IsInvertedMinCountThreshold>false</IsInvertedMinCountThreshold><NetObjectsMinCountThreshold i:nil=\"true\"/><ObjectType>Orion.DiscoveryLogs</ObjectType><SustainTime i:nil=\"true\"/></AlertConditionShelve></ArrayOfAlertConditionShelve>",
"TriggeredCount": 1,
"TriggeredDateTime": "2021-04-06T15:01:22.2170000Z",
"TriggeredMessage": "Network Discovery Failed",
"Uri": "swis://WIN-MV956AU5BSN./Orion/Orion.AlertActive/AlertActiveID=7,AlertObjectID=5"
}
]
}
}

Human Readable Output#

Alerts#

Active Alert IDAlert NameTriggered MessageEntity CaptionTriggered AtSeverityTypeConfiguration Description
4IP Address Requesttest test has requested 1 IP address(es) at 4/6/2021 4:54:24 PM
Contact details: , dummy@dummy.com
Comments:
IP Request (test test)06/04/2021 12:53 PMCRITICALIPAM.IPRequestsThis alert writes to the event log when Request IP Address is created.
7Network Discovery FailedNetwork Discovery FailedImport Failed06/04/2021 03:01 PMINFORMATIONOrion.DiscoveryLogsThis alert will send an email if Network Discovery fails.

swis-query#


Executes a query request.
Click here to navigate to the guidelines to generate a query. SolarWinds Information Service schema can be found here.

Base Command#

swis-query

Input#

Argument NameDescriptionRequired
queryThe SWQL query to be executed.Required

Context Output#

There is no context output for this command.

Command Example#

!swis-query query="SELECT AlertActiveID, TriggeredDateTime FROM Orion.AlertActive ORDER BY AlertActiveID DESC WITH ROWS 1 To 3"

Context Example#

{
"SolarWinds": {
"Query": [
{
"AlertActiveID": 18543,
"TriggeredDateTime": "2021-04-20T06:39:32.4330000Z"
},
{
"AlertActiveID": 18542,
"TriggeredDateTime": "2021-04-19T18:45:11.7730000Z"
},
{
"AlertActiveID": 18541,
"TriggeredDateTime": "2021-04-19T18:44:10.5730000Z"
}
]
}
}

Human Readable Output#

Query Result#

Alert Active IDTriggered Date Time
185432021-04-20T06:39:32.4330000Z
185422021-04-19T18:45:11.7730000Z
185412021-04-19T18:44:10.5730000Z