New in 51.0.5.0 Connectors and functions

To create integrations for the SOAR Platform application with little or no coding, you can build connector functions by importing OpenAPI spec 3.0 files.

A function is a playbook component that sends data to a remote function processor through a message destination or REST API endpoint via a HTTP or HTTPs request.

AppExchange functions
AppExchange functions invoke remote code, which completes an action and then returns the results to the playbook. App functions come from the installation of a SOAR app from the IBM AppExchange or customer-written apps. You can access app functions from the AppExchange tab from the playbook function library menu for a specific playbook.
Connector functions
A connector is a collection of functions that are imported from the OpenAPI specification of a vendor into the SOAR Platform. Connector functions invoke the OpenAPI endpoint via a HTTPs request and return the results to the playbook. You can access connector functions from the Connectors tab on the main Playbook page, or from the playbook function library menu for a specific playbook.

You can use both connector functions and AppExchange functions together in a playbook, as they are complementary. You can use the connector feature to quickly add functions to your playbooks through the OpenAPI spec import and further enhance playbooks that use AppExchange functions.

To use both app and connector functions, you must deploy an App Host on which to run them.

Creating connector functions for playbooks

You can use connectors to build integrations for the SOAR Platform application, with little or no coding required.

Before you begin

You must have an OpenAPI spec 3.0 .yaml or .json file available on the system that contains the functions that you want to import. For importing as connector functions, only OpenAPI spec 3.0 files are supported currently.

Before importing into the SOAR Platform, you can view and edit the OpenAPI spec using the swagger editor at https://editor.swagger.io.

If there are problems with the OpenAPI spec, importing will fail. Correct any problems outside of the SOAR Platform and retry the import.

Make sure that the OpenAPI spec 3.0 files that you are importing meet the following requirements:
  1. Make sure there are no external references that point to external documents.
  2. Make sure that a schema is provided for path parameters, such as header and query parameters.
  3. Server parameters must be fully defined.
  4. Server URLs must be fully qualified, including the schema, for example http:// or https://, and cannot contain variables.
  5. Request parameters cannot specify media types, such as application or .json.
  6. Authentication methods are limited to API key, bearer, or basic authentication.

Some functions in successfully imported OpenAPI spec files will be disabled if the function definition contains one or more of following items. Correct these problems outside of the SOAR Platform and retry the import:

  • HEAD HTTP operation.
  • oneOf and anyOf schema types.
  • Request body with media types other than application or .json.
  • Missing path parameters.

About this task

Connectors provide a simple way to add functions to the SOAR Platform. Using connectors, you can quickly build integrations, with little or minimal coding required.

From the Connectors tab, you can import Open API Spec files, parse the data, and then create connector functions to use in your playbooks. You must configure security credentials for the function to authenticate against the REST API endpoints.

Exporting or importing playbooks with connector functions is not supported currently and connector functions do not work in MSSP organizations.

Procedure

  1. To start adding a connector, complete one of the following actions:
    • From the Playbooks > Connectors tab, click Add connector functions > Import connector APIs.
    • From a playbook canvas, click the Functions icon () in the playbook library, click the Connectors tab, and then click Add connector functions > Import connector APIs.
  2. From the Import connector page, click in the Upload file area.
  3. Search for and select a .yaml or .json file that contains the functions.
  4. Click Upload and then Next.
    The system parses the data in the file and renders the data onscreen.
  5. From the Connector Details page, enter a folder name for the data in the file and enter a description.
  6. From the Functions section, select the functions that you want to import. By default, all of the functions are selected. To omit any function, deselect it.
  7. From the authentication section, click Configure to create a security profile for the function to authenticate against the REST API endpoints. If you do not configure a security profile, a half blue circle icon is displayed for the connector. Complete the following steps to configure authentication:
    1. From the Security scheme drop-down menu, select an authentication scheme. The supported authentication schemes are API Key, Bearer, Basic authentication, and None. Depending on the Security scheme you select, other configuration fields are displayed.
    2. Complete any fields that appear for the security scheme that you selected. All fields that are displayed are required fields.
    3. From the Server URL drop-down menu, select the URL for which the function needs to authenticate.
    4. Enter your key or username and password for authentication.
    5. Save your changes.
    A green icon is shown for the connector to indicate that it is correctly configured.
    Note: If you subsequently change the security configuration, values you entered for the username and password do not persist, so you must reenter them.
  8. Click Save to save and return to the Connectors tab, where the functions you imported are shown in the list under the folder name that you provided.
  9. To view information about the function, select the function from the list.
  10. Click the edit icon to edit the function.
    From the Edit Function page, edit the function details, request parameters, and response data as required.
  11. To add a function to the playbook, drag it to the canvas, or click the + icon.
  12. From the canvas, click the function to open the function configuration window.

Editing a connector

You can edit a connector that you previously imported.

About this task

When you edit a connector, you cannot import new functions, but you can select functions not previously selected and you can remove functions.

Procedure

  1. From the Playbooks > Connectors tab, click the connector that you want to edit.
  2. From the Edit connector page, you can make the following changes:
    Connector details and description
    You can change the connector folder name where the imported function is stored and you can change the description.
    Security section
    You configure or change the security profile.
    Functions
    You can add any functions that you imported previously that are not currently selected, and you can remove functions. You cannot import new functions.
    Runtime
    Associate the connector with a running App Host.
    Additional settings
    Configure how the connector interacts with the API and handles requests.
  3. Save your changes.

Deleting a connector

You can easily delete a connector from the Playbooks > Connectors tab.

Procedure

  1. Go to the Playbooks > Connectors tab.
  2. For the connector that you want to delete, click the overflow menu () and then Delete.
  3. Click Delete to confirm.

Associating connectors with an App Host

You must use connectors with an App Host and configure the connector to use the App Host.

Before you begin

The App Host must be paired and running. If the App Host is down or you need to troubleshoot, refer to the App Host deployment guide and Troubleshooting App Host problems.

About this task

You can associate multiple connectors with the same App Host but a connector can be associated with only one App Host at a time. You can switch a connector between multiple App Hosts. If the primary App Host is down, you can switch to a secondary App Host. For example, if you have three connectors, one connector can be deployed to App Host A and connectors two and three can be deployed to different App Hosts.

Configure the App Host to use with connectors from the Playbook > Connectors tab.

Procedure

  1. Go to the Playbooks > Connectors tab.
  2. Click the connector that you want to configure with the App Host.
  3. From the Runtime section, select an active App Host and save.

Adding functions to playbooks

You can access functions in the library from the Functions > Connectors or Functions > AppExchange tab on the Playbook canvas window.

About this task

If you are adding a connector function that you imported, go the Connectors tab, and search for and select the function.

If you are adding a function from an app or a function that you created, go to the AppExchange tab, where the library categorizes the functions by the app that installed them. Functions that are not associated with an app are grouped in the Other category. If you need to install a new app, click Install new app to open the Apps tab on the Administrator settings page. For more information, see Managing SOAR apps.

To add a function to a playbook, complete the following steps.

Procedure

  1. In the Playbook canvas window, click the Functions icon () in the playbook library.
  2. Complete one of the following, depending on whether you want to add a connector function or a function from an app or other function:
    • To add a connector function, from the Connector tab, search for and select the function.
    • To add a function from an app or a function that you created, click the AppExchange tab and expand the app name to see its functions. To see functions that are not associated with an app, expand the Other category.
    Tip: Click the Open filters icon to filter the list of functions.
  3. To view information about the function, select the function from the list.
  4. To add a function to the playbook, drag it to the canvas, or click the + icon.
  5. On the canvas, select the function to open the function configuration window.
  6. Under Function output, type a name in the Output name field.

    You can use to this name to make the function output available to scripts that start later in the playbook.

  7. For the functions inputs, determine the method for delivering inputs:
    For connector functions, to define inputs, expand the Request parameters section, and select the Form or Raw tab. Use the Raw tab to use a script to enter function inputs using playbook data.
    • If you select the Form tab, enter values for each field. To select the input field directly from the playbook schema, click the Choose from schema icon ( ), and browse through the list to find the object that you want to use. Click the + icon to add the path to the input field. The object or property type must match the input field type. If it does not, a validation message appears under the input field.

    • Use the Raw tab to set a JSON payload as function Request body.
    For non-connector functions:
    • To manually define the inputs, click the Fields tab and type a value in each input field.

      To select the input field directly from the playbook schema, click the Choose from schema icon ( ), and browse through the list to find the object that you want to use. Click the + icon to add the path to the input field.

      The object or property type must match the input field type. If it does not, a validation message appears under the input field.

    • To use a script to programmatically define the inputs, click the Script tab.

      If a script is present, click Edit script to update it.

      To add objects directly from the playbook schema, click the View playbook schema icon ( ), and browse through the list to find the object that you want to use. Click the + icon to add the path to the script builder.

      For information about building scripts, see Input scripts.

  8. To duplicate or remove the function, on the playbook canvas, right-click on the function and select Duplicate mode or Remove.

Downloading connector log files

You can download connector log files to help troubleshooting or identify any problems.

Procedure

  1. Go to the Playbooks > Connectors tab.
  2. Click the overflow menu () and then Download logs.
  3. From the Download logs modal, select a time range for the logs that you want to download, either for all time available, or for a specific time range.
  4. From the Advanced settings section, you can change the log source from the current container to a previous container, if available.
  5. Click Download logs to download.