...
Humio is a live observability platform that enables data aggregation, exploration, reporting and analysis from a range of sources. The purpose-built logging tool features innovative data storage and in-memory search/query engine technologies.
Connect Humio with Devo SOAR
Navigate to Automations > Integrations.
Search for Humio.
Click Details, then the + icon. Enter the required information in the following fields.
Label: Enter a connection name.
Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.
Verify SSL: Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate).
Remote Agent: Run this integration using the Devo SOAR Remote Agent.
API Key: The API Key to connect to the Humio.
After you've entered all the details, click Connect.
Actions for Humio
Execute Query
Query the data from Humio, retrieves the list of events/activities based on filter criteria.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
|---|---|---|
Start Time | Column name from parent table holding value for start time, expressed as epoch milliseconds (Default is Batch start time). Example: 1588676868908. | Optional |
End Time | Column name from parent table holding value for the end time, expressed as epoch milliseconds (Default is Batch end time). Example: 1588676868908. | Optional |
Jinja Template for Repository | Jinja-templated text containing the value for repository. | |
Example: {{repo_prefix_column_name}}-{{repo_suffix_column_name}}. | Optional | |
Jinja Template for Query String | Jinja-templated text containing the query string to use. | |
Example: This is {{query_column_name}}. | Optional | |
Is Live | Select option for is live, that sets whether this query is live (Default is 'False'). Live queries are continuously updated. | Optional |
Time Zone Offset Minutes | Column name from the parent table to lookup value for time zone offset minutes (default is 0). | Optional |
Jinja Template for Arguments | Jinja-templated query containing comma-separated values of arguments. | |
Example: {{arguments_column_name1}}, {{arguments_column_name2}}. | Optional |
Output
A JSON object containing multiple rows of result:
has_error: True/False
error: message/null
result: List of events/activities.
...
Query Job
Issue a query job to Humio, retrieves the list of events/activities based on filter criteria.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
|---|---|---|
Start Time | Column name from parent table holding value for start time, expressed as epoch milliseconds (Default is Batch start time). Example: 1588676868908. | Optional |
End Time | Column name from parent table holding value for the end time, expressed as epoch milliseconds (Default is Batch end time). Example: 1588676868908. | Optional |
Jinja Template for Repository | Jinja-templated text containing the value for repository. Example: {{repo_prefix_column_name}}-{{repo_suffix_column_name}}. | Optional |
Jinja Template for Query String | Jinja-templated text containing the query string to use. Example: This is {{query_column_name}}. | Optional |
Is Live | Select option for is live, that sets whether this query is live (Default is 'False'). Live queries are continuously updated. | Optional |
Time Zone Offset Minutes | Column name from the parent table to lookup value for time zone offset minutes (Default is 0). | Optional |
Jinja Template for Arguments | Jinja-templated query containing comma-separated values of arguments. Example: {{arguments_column_name1}}, {{arguments_column_name2}}. | Optional |
Output
A JSON object containing multiple rows of result:
has_error: True/False
error: message/null
result: Job ID.
...
Poll
Issue poll command to Humio.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
|---|---|---|
Jinja Template for Repository | Jinja-templated text containing the value for repository. | |
Example: {{repo_prefix_column_name}}-{{repo_suffix_column_name}}. | Required | |
Job ID | Column name from parent table to lookup value for ID. | |
Example: This is {{id_column_name}}. | Required |
Output
A JSON object containing multiple rows of result:
has_error: True/False
error: message/null
result: Poll_Result.
...
Delete Job
Issue a job delete command to Humio.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
|---|---|---|
Jinja Template for Repository | Jinja-templated text containing the value for repository. | |
Example: {{repo_prefix_column_name}}-{{repo_suffix_column_name}}. | Required | |
Job ID | Column name from parent table to lookup value for ID. | |
Example: This is {{id_column_name}}. | Required |
Output
A JSON object containing multiple rows of result:
has_error: True/False
error: message/null
result: Success/Failure message.
...
List Alerts
Issue list alerts from Humio retrieves the list of alerts.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Desccription | Required |
|---|---|---|
Jinja Template for Repository: | Jinja-templated text containing the value for repository. | |
Example: {{repo_prefix_column_name}}-{{repo_suffix_column_name}}. | Required |
Output
A JSON object containing multiple rows of result:
has_error: True/False
error: message/null
result: List of alerts.
...
Get Alert By ID
Get alert by ID from Humio retrieves the alert details.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
|---|---|---|
Jinja Template for Repository | Jinja-templated text containing the value for repository. | |
Example: {{repo_prefix_column_name}}-{{repo_suffix_column_name}}. | Required | |
Alert ID | Column name from parent table to lookup value for alert ID. | |
Example: This is {{id_column_name}}. | Required |
Output
A JSON object containing multiple rows of result:
has_error: True/False
error: message/null
result: Alert details.
...
Create Alert
Create an alert in Humio.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
|---|---|---|
Start Time | Column name from parent table holding value for start time, expressed as epoch milliseconds (Default is Batch start time). Example: 1588676868908. | |
Jinja Template for Repository | Jinja-templated text containing the value for repository. | |
Example: {{repo_prefix_column_name}}-{{repo_suffix_column_name}}. | ||
Name | Column name from the parent table to lookup value for the name of the alert. | |
Example: This is {{name_column_name}}. | ||
Jinja Template for Query String | Jinja-templated query containing the query string to use. | |
Example: This is {{query_column_name}}. | ||
Jinja Template for Notifiers | Jinja-templated query containing comma-separated values of notifier ids. | |
Example: {{column1}}, {{column2}}. | ||
Jinja Template for Description | Jinja-templated query containing the description. | |
Example: This is {{description_column_name}}. | ||
Throttle Time Millis | Column name from the parent table to lookup value for time millis interval (default is 0). | |
Silenced | Select a value for silenced (default is FALSE). | |
Jinja Template for Labels | Jinja-templated query containing comma-separated values of labels (default is empty value). | |
Example: This is {{labels_column_name}}. |
Output
A JSON object containing multiple rows of result:
has_error: True/False
error: message/null
result: Success/Failure message.
...
Delete Alert
Delete alert by ID from Humio.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
|---|---|---|
Jinja Template for Repository | Jinja-templated text containing the value for repository. | |
Example: {{repo_prefix_column_name}}-{{repo_suffix_column_name}}. | Required | |
Alert ID | Column name from parent table to lookup value for alert ID. | |
Example: This is {{id_column_name}}. | Required |
Output
A JSON object containing multiple rows of result:
has_error: True/False
error: message/null
result: Success/Failure message.
...
Release Notes
v2.0.6- Bug fix: Not processing more than a certain number of rowsv2.0.0- Updated architecture to support IO via filesystem
...