Humio is a live observability platform that enables data aggregation, exploration, reporting and analysis from a range of sources. The purpose-built logging tool features innovative data storage and in-memory search/query engine technologies.

Connect Humio with Devo SOAR

Navigate to Automations > Integrations.
Search for Humio.
Click Details, then the + icon. Enter the required information in the following fields.
Label: Enter a connection name.
Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.
Verify SSL: Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate).
Remote Agent: Run this integration using the Devo SOAR Remote Agent.
API Key: The API Key to connect to the Humio.
After you've entered all the details, click Connect.

Actions for Humio

Execute Query

Query the data from Humio, retrieves the list of events/activities based on filter criteria.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required

Input Name	Description	Required
Start Time	Column name from parent table holding value for start time, expressed as epoch milliseconds (Default is Batch start time). Example: 1588676868908.	Optional
End Time	Column name from parent table holding value for the end time, expressed as epoch milliseconds (Default is Batch end time). Example: 1588676868908.	Optional
Jinja Template for Repository	Jinja-templated text containing the value for repository.
Example: {{repo_prefix_column_name}}-{{repo_suffix_column_name}}.	Optional
Jinja Template for Query String	Jinja-templated text containing the query string to use.
Example: This is {{query_column_name}}.	Optional
Is Live	Select option for is live, that sets whether this query is live (Default is 'False'). Live queries are continuously updated.	Optional
Time Zone Offset Minutes	Column name from the parent table to lookup value for time zone offset minutes (default is 0).	Optional
Jinja Template for Arguments	Jinja-templated query containing comma-separated values of arguments.
Example: {{arguments_column_name1}}, {{arguments_column_name2}}.	Optional

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: List of events/activities.

Query Job

Issue a query job to Humio, retrieves the list of events/activities based on filter criteria.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required

Input Name	Description	Required
Start Time	Column name from parent table holding value for start time, expressed as epoch milliseconds (Default is Batch start time). Example: 1588676868908.	Optional
End Time	Column name from parent table holding value for the end time, expressed as epoch milliseconds (Default is Batch end time). Example: 1588676868908.	Optional
Jinja Template for Repository	Jinja-templated text containing the value for repository. Example: {{repo_prefix_column_name}}-{{repo_suffix_column_name}}.	Optional
Jinja Template for Query String	Jinja-templated text containing the query string to use. Example: This is {{query_column_name}}.	Optional
Is Live	Select option for is live, that sets whether this query is live (Default is 'False'). Live queries are continuously updated.	Optional
Time Zone Offset Minutes	Column name from the parent table to lookup value for time zone offset minutes (Default is 0).	Optional
Jinja Template for Arguments	Jinja-templated query containing comma-separated values of arguments. Example: {{arguments_column_name1}}, {{arguments_column_name2}}.	Optional

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Job ID.

Poll

Issue poll command to Humio.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required

Input Name	Description	Required
Jinja Template for Repository	Jinja-templated text containing the value for repository.
Example: {{repo_prefix_column_name}}-{{repo_suffix_column_name}}.	Required
Job ID	Column name from parent table to lookup value for ID.
Example: This is {{id_column_name}}.	Required

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Poll_Result.

Delete Job

Issue a job delete command to Humio.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required

Input Name	Description	Required
Jinja Template for Repository	Jinja-templated text containing the value for repository.
Example: {{repo_prefix_column_name}}-{{repo_suffix_column_name}}.	Required
Job ID	Column name from parent table to lookup value for ID.
Example: This is {{id_column_name}}.	Required

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Success/Failure message.

List Alerts

Issue list alerts from Humio retrieves the list of alerts.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Desccription	Required

Input Name	Desccription	Required
Jinja Template for Repository:	Jinja-templated text containing the value for repository.
Example: {{repo_prefix_column_name}}-{{repo_suffix_column_name}}.	Required

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: List of alerts.

Get Alert By ID

Get alert by ID from Humio retrieves the alert details.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required

Input Name	Description	Required
Jinja Template for Repository	Jinja-templated text containing the value for repository.
Example: {{repo_prefix_column_name}}-{{repo_suffix_column_name}}.	Required
Alert ID	Column name from parent table to lookup value for alert ID.
Example: This is {{id_column_name}}.	Required

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Alert details.

Create Alert

Create an alert in Humio.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required

Input Name	Description	Required
Start Time	Column name from parent table holding value for start time, expressed as epoch milliseconds (Default is Batch start time). Example: 1588676868908.
Jinja Template for Repository	Jinja-templated text containing the value for repository.
Example: {{repo_prefix_column_name}}-{{repo_suffix_column_name}}.
Name	Column name from the parent table to lookup value for the name of the alert.
Example: This is {{name_column_name}}.
Jinja Template for Query String	Jinja-templated query containing the query string to use.
Example: This is {{query_column_name}}.
Jinja Template for Notifiers	Jinja-templated query containing comma-separated values of notifier ids.
Example: {{column1}}, {{column2}}.
Jinja Template for Description	Jinja-templated query containing the description.
Example: This is {{description_column_name}}.
Throttle Time Millis	Column name from the parent table to lookup value for time millis interval (default is 0).
Silenced	Select a value for silenced (default is FALSE).
Jinja Template for Labels	Jinja-templated query containing comma-separated values of labels (default is empty value).
Example: This is {{labels_column_name}}.

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Success/Failure message.

Delete Alert

Delete alert by ID from Humio.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Input Name	Description	Required

Input Name	Description	Required
Jinja Template for Repository	Jinja-templated text containing the value for repository.
Example: {{repo_prefix_column_name}}-{{repo_suffix_column_name}}.	Required
Alert ID	Column name from parent table to lookup value for alert ID.
Example: This is {{id_column_name}}.	Required

Output

A JSON object containing multiple rows of result:

has_error: True/False
error: message/null
result: Success/Failure message.

Release Notes

v2.0.6 - Bug fix: Not processing more than a certain number of rows
v2.0.0 - Updated architecture to support IO via filesystem