Devo delivers real-time operational and business value from analytics on streaming and historical data to operations, IT, security and business teams.

Connect Devo with Devo SOAR

1. Navigate to Automations > Integrations.

2. Search for Devo.

3. Click Details, then the + icon. Enter the required information in the following fields.

4. Label: Enter a connection name.

5. Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.

6. Verify SSL: Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate).

7. Remote Agent: Run this integration using the Devo SOAR Remote Agent.

8. URL: Devo server URL.

   • Devo cloud URLs for these two regions:

   • USA: https://apiv2-us.devo.com

   • EU: https://apiv2-eu.devo.com

9. Permission: Select permission. Devo has different tokens for read and write access.

10. API Token: API Token to connect to devo instance.

    • This is the OAuth token. Make sure for read, it has permission to read all tables that is, the target table should be '***' and for write, Http Send should be allowed.

Actions for Devo

Run Query

Run query in Devo instance.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:

• Templated Query: from demo.ecommerce.data {{query}}

• Explode Results: No

• Add Info Fields: Yes

• Start Time: startT

• End Time: endT

• Limit: 10000

Send Events

Send Events to Devo instance. This action will send one event per row in the parent table.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing multiple rows of result:
{"success": true, "error": null, "has_error": false}

List Triggered Alerts

List triggered Alerts.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

``` {json}{ "result":[ { "id":12123, "domain":"test", "priority":3, "context":"my.test_alert.test.SecOpsAwsFromLocation", "category":"my.context", "srcPort":null, "srcIp":null, "srcHost":null, "dstIp":null, "dstPort":null, "dstHost":null, "protocol":null, "username":null, "application":null, "engine":"cloud-custom-aws-eu-1s", "extraData":"{\"data\":\"null\"}" "alertDate":null, "creationDate":null, "status":0, "ack_status_date":null, "createDate":16623455423400, "updateDate":null, "scaled":false, "digest":"33003299580asdffa788b1", "uniquedigest":"e5a56asdfa1f23acdd32", "contexto":null, "postAlertAction":null, "contextLabel":null, "contextSubscription":null, "shouldSend":false, "recoveryId":null, "skipAntiflooding":false, "useCreationDate":false, "alertOwner":null, "fullExtraData":null, "alertType":"Analytics", "alertMitreTactics":"Initial+Access", "alertMitreTechniques":"Valid+Accounts", "alertPriority":"2", "alertDefinition":{ "id":"1245", "creationDate":2342347000, "name":"SecAwsActivityFromLocation", "message":"", "description":"$action_count actions from $country, IP $entity_sourceIP", "categoryId":"35", "subcategory":"lib.my.test.SectOpse1", "subcategoryId":"35", "isActive":false, "isFavorite":false, "isAlertChain":false, "alertCorrelationContext":{ "id":"37763", "nameId":"my.test_alert.test.SecAwsActivityFromLocation", "ownerEmail":"testuser@example.com", "querySourceCode":"some query", "priority":3, "correlationTrigger":{ "kind":"each", "externalPeriod":6300000, "externalOffset":0, "internalPeriod":1200000, "internalOffset":3500000 } }, "actionPolicyId":[

], "error":null, "has_error":false }

Update Alert's Status

Update triggered alert status by ID.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

``` {json}{ "result": "updated successfully", "error": null, "has_error": false }

Get All Annotations of the Indicated Alerts

Get all the annotations of the indicated alerts.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

``` {json}{ "result": [ { "idAlert": 1234, "comments": [ { "id": 43534, "author": { "id": 456746765, "user": { "id": "5sdfgsdfg13-dfg-4175-b14e-6dsfgdfg", "email": "abc.def@devo.com", "username": "ABC DEF", "telephone": "", "pwd": "**", "status": 0, "validation_token": "**", "defaultDomain": null, "updateDate": 1674473568000, "creationDate": 1673343905000, "otpSecret": "**", "loginAttempts": 0, "recoveryAttempts": 0 }, "domain": { "id": "7asdf0-9ac9-44dc-8457-asdff1d", "name": "sandbox", "status": 0, "type": 13, "updateDate": 1660758392000, "creationDate": 1600427606000, "subscribed": 1, "daysLeft": 0, "showLanding": true, "reseller": { "id": 68, "name": "sandbox", "preferences": null, "contactInformation": null, "pricePlans": null, "updateDate": 1644340455000, "creationDate": 1600372678000, "permPolicy": null, "menuView": "some json text", "limits": null, "groupId": null, "webPreferences": null, "authRestrictions": false }, "groupId": null, "alertsLastReseted": 1660758392000, "authRestrictions": false }, "lastTimeLogged": 1674456891000, "status": 0, "creationDate": 1673343905000, "updateDate": 1674464652000, "pwd": "**", "validationToken": "**", "roleCustom": null, "rolesCustom": null, "externalId": null, "owner": false, "alertsLastVisited": 1674464652000 }, "msg": "Hello", "ack": "{\"ackUserList\":[\"5fasdf-26fe-4175-b14e-68aasdfc6\"]}", "creationDate": 1674464131000, "updateDate": 1674464131000, "elementType": "alert", "elementId": "134535234", "domain": "domain detailed json", "title": "Test", "status": null, "task": false }, ] } ], "error": null, "has_error": false }

Update an Alert Annotation

Update a triggered alert annotation.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

``` {json}{ "result": "updated successfully", "error": null, "has_error": false }

Send a Single Event

Send Event to Devo instance. This action will send one event per row.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

JSON containing the following items:

{json}{ "success": true, "error": null, "has_error": false }

Release Notes

• v4.3.4- Jinja issue fixed in Send Events action.

• v4.3.0- AddedMessage Host IPoptional input field inSend a Single EventandSend Events action.

• v4.2.1 - Added Response type optional input field in Run Query action.

• v4.1.0 - Added 1 new action: Send a Single Event.

• v4.0.0 - Updated architecture to support IO via filesystem

• v3.3.2 - Added 6 new actions: Update Alert's Status, Update Alert's Status in Bulk, Get All Annotations of the Indicated Alerts, Add an Annotation to an Alert, Update an Alert Annotation and Delete the Specified Alert Annotations.

• v3.2.1 - Added 2 new actions: Get Triggered Alert and List Triggered Alerts.