Zabbix

Allow integration with Zabbix api This integration was integrated and tested with version xx of Zabbix

Zabbix Playbook


Use Cases


Configure Zabbix on Demisto


  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Zabbix.
  3. Click Add instance to create and configure a new integration instance.
    • Name: a textual name for the integration instance.
    • Url
    • Credentials
  4. Click Test to validate the URLs, token, and connection.

Fetched Incidents Data


Commands


You can execute these commands from the Demisto CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

  1. zabbix-execute-command
  2. test-module
  3. zabbix-hostgroup-get
  4. zabbix-host-get
  5. zabbix-trigger-get
  6. zabbix-event-get

1. zabbix-execute-command


Execute command on Zabbix API

Required Permissions

FILL IN REQUIRED PERMISSIONS HERE

Base Command

zabbix-execute-command

Input
Argument NameDescriptionRequired
methodMethod to call on Zabbix APIRequired
paramsJSON with params to send with callOptional
Context Output
PathTypeDescription
Zabbix.ExecuteUnknownresult
Command Example
Context Example
{
"Zabbix.Execute": [
{
"jmx_available": "0",
"tls_connect": "1",
"maintenance_type": "0",
"ipmi_errors_from": "0",
"ipmi_username": "",
"snmp_disable_until": "0",
"ipmi_authtype": "-1",
"ipmi_disable_until": "0",
"lastaccess": "0",
"snmp_error": "",
"tls_psk": "",
"ipmi_privilege": "2",
"jmx_error": "",
"status": "0",
"maintenanceid": "0",
"snmp_available": "0",
"proxy_address": "",
"tls_psk_identity": "",
"available": "2",
"description": "",
"tls_accept": "1",
"auto_compress": "1",
"host": "Zabbix server",
"disable_until": "1588621755",
"ipmi_password": "",
"templateid": "0",
"tls_issuer": "",
"ipmi_available": "0",
"maintenance_status": "0",
"snmp_errors_from": "0",
"ipmi_error": "",
"proxy_hostid": "0",
"hostid": "10084",
"name": "Zabbix server",
"jmx_errors_from": "0",
"jmx_disable_until": "0",
"flags": "0",
"error": "Get value from agent failed: cannot connect to [[127.0.0.1]:10050]: [111] Connection refused",
"maintenance_from": "0",
"tls_subject": "",
"errors_from": "1585321618"
}
]
}
Human Readable Output

zabbix-execute-command

auto_compressavailabledescriptiondisable_untilerrorerrors_fromflagshosthostidipmi_authtypeipmi_availableipmi_disable_untilipmi_erroripmi_errors_fromipmi_passwordipmi_privilegeipmi_usernamejmx_availablejmx_disable_untiljmx_errorjmx_errors_fromlastaccessmaintenance_frommaintenance_statusmaintenance_typemaintenanceidnameproxy_addressproxy_hostidsnmp_availablesnmp_disable_untilsnmp_errorsnmp_errors_fromstatustemplateidtls_accepttls_connecttls_issuertls_psktls_psk_identitytls_subject
121588621755Get value from agent failed: cannot connect to [[127.0.0.1]:10050]: [111] Connection refused15853216180Zabbix server10084-1000200000000Zabbix server00000011

2. test-module


Test if module is working

Required Permissions

FILL IN REQUIRED PERMISSIONS HERE

Base Command

test-module

Input
Argument NameDescriptionRequired
Context Output

There is no context output for this command.

Command Example
Human Readable Output

ok

3. zabbix-hostgroup-get


Get host groups

Required Permissions

FILL IN REQUIRED PERMISSIONS HERE

Base Command

zabbix-hostgroup-get

Input
Argument NameDescriptionRequired
params_graphidsReturn only host groups that contain hosts or templates with the given graphs.Optional
params_groupidsReturn only host groups with the given host group IDs.Optional
params_hostidsReturn only host groups that contain the given hosts.Optional
params_maintenanceidsReturn only host groups that are affected by the given maintenances.Optional
params_monitored_hostsReturn only host groups that contain monitored hosts.Optional
params_real_hostsReturn only host groups that contain hosts.Optional
params_templated_hostsReturn only host groups that contain templates.Optional
params_templateidsReturn only host groups that contain the given templates.Optional
params_triggeridsReturn only host groups that contain hosts or templates with the given triggers.Optional
params_with_applicationsReturn only host groups that contain hosts with applications.Optional
params_with_graphsReturn only host groups that contain hosts with graphs.Optional
params_with_hosts_and_templatesReturn only host groups that contain hosts or templates.Optional
params_with_httptestsReturn only host groups that contain hosts with web checks.Optional
params_with_itemsReturn only host groups that contain hosts or templates with items.Optional
params_with_monitored_httptestsReturn only host groups that contain hosts with enabled web checks.Optional
params_with_monitored_itemsReturn only host groups that contain hosts or templates with enabled items.Optional
params_with_monitored_triggersReturn only host groups that contain hosts with enabled triggers. All of the items used in the trigger must also be enabled.Optional
params_with_simple_graph_itemsReturn only host groups that contain hosts with numeric items.Optional
params_with_triggersReturn only host groups that contain hosts with triggers.Optional
Context Output
PathTypeDescription
Zabbix.Hostgroup.groupidstringID of the host group
Zabbix.Hostgroup.namestringName of the host group
Zabbix.Hostgroup.flagsnumberOrigin of the host group
Zabbix.Hostgroup.internalnumberWhether the group is used internally by the system.
Command Example
Context Example
{
"Zabbix.Hostgroup": [
{
"internal": "0",
"flags": "0",
"groupid": "4",
"name": "Zabbix servers"
}
]
}
Human Readable Output

zabbix-hostgroup-get

flagsgroupidinternalname
040Zabbix servers

4. zabbix-host-get


Get hosts

Required Permissions

FILL IN REQUIRED PERMISSIONS HERE

Base Command

zabbix-host-get

Input
Argument NameDescriptionRequired
params_groupidsReturn only hosts that belong to the given groups.Optional
params_applicationidsReturn only hosts that have the given applications.Optional
params_dserviceidsReturn only hosts that are related to the given discovered services.Optional
params_graphidsReturn only hosts that have the given graphs.Optional
params_hostidsReturn only hosts with the given host IDs.Optional
params_httptestidsReturn only hosts that have the given web checks.Optional
params_interfaceidsReturn only hosts that use the given interfaces.Optional
params_itemidsReturn only hosts that have the given items.Optional
params_maintenanceidsReturn only hosts that are affected by the given maintenances.Optional
params_monitored_hostsReturn only monitored hosts.Optional
params_proxy_hostsReturn only proxies.Optional
params_proxyidsReturn only hosts that are monitored by the given proxies.Optional
params_templated_hostsReturn both hosts and templates.Optional
params_templateidsReturn only hosts that are linked to the given templates.Optional
params_triggeridsReturn only hosts that have the given triggers.Optional
params_with_itemsReturn only hosts that have items.Optional
params_with_applicationsReturn only hosts that have applications.Optional
params_with_graphsReturn only hosts that have graphs.Optional
params_with_httptestsReturn only hosts that have web checks.Optional
params_with_monitored_httptestsReturn only hosts that have enabled web checks.Optional
params_with_monitored_itemsReturn only hosts that have enabled items.Optional
params_with_monitored_triggersReturn only hosts that have enabled triggers. All of the items used in the trigger must also be enabled.Optional
params_with_simple_graph_itemsReturn only hosts that have items with numeric type of information.Optional
params_with_triggersReturn only hosts that have triggers.Optional
params_withInventoryReturn only hosts that have inventory data.Optional
Context Output
PathTypeDescription
Zabbix.Host.hostidstringID of the host.
Zabbix.Host.hoststringTechnical name of the host.
Zabbix.Host.availablenumberAvailability of Zabbix agent.
Zabbix.Host.descriptionstringDescription of the host.
Zabbix.Host.disable_untildateThe next polling time of an unavailable Zabbix agent.
Zabbix.Host.errorstringError text if Zabbix agent is unavailable.
Zabbix.Host.errors_fromdateTime when Zabbix agent became unavailable.
Zabbix.Host.flagsnumberOrigin of the host.
Zabbix.Host.inventory_modenumber(writeonly) Host inventory population mode.
Zabbix.Host.ipmi_authtypenumberIPMI authentication algorithm.
Zabbix.Host.ipmi_availablenumberAvailability of IPMI agent.
Zabbix.Host.ipmi_disable_untildateThe next polling time of an unavailable IPMI agent.
Zabbix.Host.ipmi_errorstringError text if IPMI agent is unavailable.
Zabbix.Host.ipmi_errors_fromdateTime when IPMI agent became unavailable.
Zabbix.Host.ipmi_passwordstringIPMI password.
Zabbix.Host.ipmi_privilegenumberIPMI privilege level.
Zabbix.Host.ipmi_usernamestringIPMI username.
Zabbix.Host.jmx_availablenumberAvailability of JMX agent.
Zabbix.Host.jmx_disable_untildateThe next polling time of an unavailable JMX agent.
Zabbix.Host.jmx_errorstringError text if JMX agent is unavailable.
Zabbix.Host.jmx_errors_fromdateTime when JMX agent became unavailable.
Zabbix.Host.maintenance_fromdateStarting time of the effective maintenance.
Zabbix.Host.maintenance_statusnumberEffective maintenance status.
Zabbix.Host.maintenance_typenumberEffective maintenance type.
Zabbix.Host.maintenanceidstringID of the maintenance that is currently in effect on the host.
Zabbix.Host.namestringVisible name of the host.
Zabbix.Host.proxy_hostidstringID of the proxy that is used to monitor the host.
Zabbix.Host.snmp_availablenumberAvailability of SNMP agent.
Zabbix.Host.snmp_disable_untildateThe next polling time of an unavailable SNMP agent.
Zabbix.Host.snmp_errorstringError text if SNMP agent is unavailable.
Zabbix.Host.snmp_errors_fromdateTime when SNMP agent became unavailable.
Zabbix.Host.statusnumberStatus and function of the host.
Zabbix.Host.tls_connectnumberConnections to host.
Zabbix.Host.tls_acceptnumberConnections from host.
Zabbix.Host.tls_issuerstringCertificate issuer.
Zabbix.Host.tls_subjectstringCertificate subject.
Zabbix.Host.tls_psk_identitystringPSK identity. Required if either tls_connect or tls_accept has PSK enabled.
Zabbix.Host.tls_pskstringThe preshared key, at least 32 hex digits. Required if either tls_connect or tls_accept has PSK enabled.
Command Example
Context Example
{
"Zabbix.Host": [
{
"jmx_available": "0",
"tls_connect": "1",
"maintenance_type": "0",
"ipmi_errors_from": "0",
"ipmi_username": "",
"snmp_disable_until": "0",
"ipmi_authtype": "-1",
"ipmi_disable_until": "0",
"lastaccess": "0",
"snmp_error": "",
"tls_psk": "",
"ipmi_privilege": "2",
"jmx_error": "",
"status": "0",
"maintenanceid": "0",
"snmp_available": "0",
"proxy_address": "",
"tls_psk_identity": "",
"available": "2",
"description": "",
"tls_accept": "1",
"auto_compress": "1",
"host": "Zabbix server",
"disable_until": "1588621755",
"ipmi_password": "",
"templateid": "0",
"tls_issuer": "",
"ipmi_available": "0",
"maintenance_status": "0",
"snmp_errors_from": "0",
"ipmi_error": "",
"proxy_hostid": "0",
"hostid": "10084",
"name": "Zabbix server",
"jmx_errors_from": "0",
"jmx_disable_until": "0",
"flags": "0",
"error": "Get value from agent failed: cannot connect to [[127.0.0.1]:10050]: [111] Connection refused",
"maintenance_from": "0",
"tls_subject": "",
"errors_from": "1585321618"
}
]
}
Human Readable Output

zabbix-host-get

auto_compressavailabledescriptiondisable_untilerrorerrors_fromflagshosthostidipmi_authtypeipmi_availableipmi_disable_untilipmi_erroripmi_errors_fromipmi_passwordipmi_privilegeipmi_usernamejmx_availablejmx_disable_untiljmx_errorjmx_errors_fromlastaccessmaintenance_frommaintenance_statusmaintenance_typemaintenanceidnameproxy_addressproxy_hostidsnmp_availablesnmp_disable_untilsnmp_errorsnmp_errors_fromstatustemplateidtls_accepttls_connecttls_issuertls_psktls_psk_identitytls_subject
121588621755Get value from agent failed: cannot connect to [[127.0.0.1]:10050]: [111] Connection refused15853216180Zabbix server10084-1000200000000Zabbix server00000011

5. zabbix-trigger-get


Get triggers

Required Permissions

FILL IN REQUIRED PERMISSIONS HERE

Base Command

zabbix-trigger-get

Input
Argument NameDescriptionRequired
params_triggeridsReturn only triggers with the given IDs.Optional
params_groupidsReturn only triggers that belong to hosts from the given host groups.Optional
params_templateidsReturn only triggers that belong to the given templates.Optional
params_hostidsReturn only triggers that belong to the given hosts.Optional
params_itemidsReturn only triggers that contain the given items.Optional
params_applicationidsReturn only triggers that contain items from the given applications.Optional
params_functionsReturn only triggers that use the given functions.Optional
params_groupReturn only triggers that belong to hosts from the host group with the given name.Optional
params_hostReturn only triggers that belong to host with the given name.Optional
params_inheritedIf set to true return only triggers inherited from a template.Optional
params_templatedIf set to true return only triggers that belong to templates.Optional
params_monitoredReturn only enabled triggers that belong to monitored hosts and contain only enabled items.Optional
params_activeReturn only enabled triggers that belong to monitored hosts.Optional
params_maintenanceIf set to true return only enabled triggers that belong to hosts in maintenance.Optional
params_withUnacknowledgedEventsReturn only triggers that have unacknowledged events.Optional
params_withAcknowledgedEventsReturn only triggers with all events acknowledged.Optional
params_withLastEventUnacknowledgedReturn only triggers with the last event unacknowledged.Optional
params_skipDependentSkip triggers in a problem state that are dependent on other triggers. Note that the other triggers are ignored if disabled, have disabled items or disabled item hosts.Optional
params_lastChangeSinceReturn only triggers that have changed their state after the given time (use timestamp format).Optional
params_lastChangeTillReturn only triggers that have changed their state before the given time (use timestamp format).Optional
params_only_trueReturn only triggers that have recently been in a problem state.Optional
params_min_severityReturn only triggers with severity greater or equal than the given severity.Optional
params_evaltypeRules for tag searching.Optional
params_tagsReturn only triggers with given tags. Exact match by tag and case-sensitive or case-insensitive search by tag value depending on operator value.Optional
Context Output
PathTypeDescription
Zabbix.Trigger.triggeridstringID of the trigger.
Zabbix.Trigger.descriptionstringName of the trigger.
Zabbix.Trigger.expressionstringReduced trigger expression.
Zabbix.Trigger.commentsstringAdditional description of the trigger.
Zabbix.Trigger.errorstringError text if there have been any problems when updating the state of the trigger.
Zabbix.Trigger.flagsnumberOrigin of the trigger.
Zabbix.Trigger.lastchangedateTime when the trigger last changed its state.
Zabbix.Trigger.prioritynumberSeverity of the trigger.
Zabbix.Trigger.statenumberState of the trigger.
Zabbix.Trigger.statusnumberWhether the trigger is enabled or disabled.
Zabbix.Trigger.templateidstringID of the parent template trigger.
Zabbix.Trigger.typenumberWhether the trigger can generate multiple problem events.
Zabbix.Trigger.urlstringURL associated with the trigger.
Zabbix.Trigger.valuenumberWhether the trigger is in OK or problem state.
Zabbix.Trigger.recovery_modenumberOK event generation mode.
Zabbix.Trigger.recovery_expressionstringReduced trigger recovery expression.
Zabbix.Trigger.correlation_modenumberOK event closes.
Zabbix.Trigger.correlation_tagstringTag for matching.
Zabbix.Trigger.manual_closenumberAllow manual close.
Command Example
Context Example
{
"Zabbix.Trigger": [
{
"status": "0",
"value": "1",
"recovery_mode": "0",
"description": "Zabbix agent on {HOST.NAME} is unreachable for 5 minutes",
"state": "0",
"url": "",
"type": "0",
"templateid": "10047",
"lastchange": "1585321941",
"comments": "",
"priority": "3",
"correlation_tag": "",
"flags": "0",
"triggerid": "13491",
"error": "",
"correlation_mode": "0",
"expression": "{12900}=1",
"recovery_expression": "",
"manual_close": "0"
}
]
}
Human Readable Output

zabbix-trigger-get

commentscorrelation_modecorrelation_tagdescriptionerrorexpressionflagslastchangemanual_closepriorityrecovery_expressionrecovery_modestatestatustemplateidtriggeridtypeurlvalue
0Zabbix agent on {HOST.NAME} is unreachable for 5 minutes{12900}=10158532194103000100471349101

6. zabbix-event-get


Get events

Required Permissions

FILL IN REQUIRED PERMISSIONS HERE

Base Command

zabbix-event-get

Input
Argument NameDescriptionRequired
params_eventidsReturn only events with the given IDs.Optional
params_groupidsReturn only events created by objects that belong to the given host groups.Optional
params_hostidsReturn only events created by objects that belong to the given hosts.Optional
params_objectidsReturn only events created by the given objects.Optional
params_applicationidsReturn only events created by objects that belong to the given applications. Applies only if object is trigger or item.Optional
params_sourceReturn only events with the given type.Optional
params_objectReturn only events created by objects of the given type.Optional
params_acknowledgedIf set to true return only acknowledged events.Optional
params_suppressedtrue - return only suppressed events;Optional
params_severitiesReturn only events with given event severities. Applies only if object is trigger.Optional
params_evaltypeRules for tag searching.Optional
params_tagsReturn only events with given tags. Exact match by tag and case-insensitive search by value and operator.Optional
params_eventid_fromReturn only events with IDs greater or equal to the given ID.Optional
params_eventid_tillReturn only events with IDs less or equal to the given ID.Optional
params_time_fromReturn only events that have been created after or at the given time (use timestamp format).Optional
params_time_tillReturn only events that have been created before or at the given time (use timestamp format).Optional
params_problem_time_fromReturns only events that were in the problem state starting with problem_time_from. Applies only if the source is trigger event and object is trigger. Mandatory if problem_time_till is specified (use timestamp format).Optional
params_problem_time_tillReturns only events that were in the problem state until problem_time_till. Applies only if the source is trigger event and object is trigger. Mandatory if problem_time_from is specified (use timestamp format).Optional
params_valueReturn only events with the given values.Optional
Context Output
PathTypeDescription
Zabbix.Event.eventidstringID of the event.
Zabbix.Event.sourcenumberType of the event.
Zabbix.Event.objectnumberType of object that is related to the event.
Zabbix.Event.objectidstringID of the related object.
Zabbix.Event.acknowledgednumberWhether the event has been acknowledged.
Zabbix.Event.clockdateTime when the event was created.
Zabbix.Event.nsnumberNanoseconds when the event was created.
Zabbix.Event.namestringResolved event name.
Zabbix.Event.valuenumberState of the related object.
Zabbix.Event.severitynumberEvent current severity.
Zabbix.Event.r_eventidstringRecovery event ID
Zabbix.Event.c_eventidstringID of the event that was used to override (close) current event under global correlation rule. See correlationid to identify exact correlation rule.
Zabbix.Event.correlationidstringID of the correlation rule that generated closing of the problem.
Zabbix.Event.useridstringUser ID if the event was manually closed.
Zabbix.Event.suppressednumberWhether the event is suppressed.
Command Example

!zabbix-event-get params_time_from="1583020800"

Context Example
{
"Zabbix.Event": [
{
"eventid": "12",
"name": "Zabbix agent on Zabbix server is unreachable for 5 minutes",
"objectid": "13491",
"clock": "1585321941",
"c_eventid": "0",
"userid": "0",
"object": "0",
"acknowledged": "0",
"value": "1",
"source": "0",
"ns": "248457478",
"suppressed": "0",
"r_eventid": "0",
"correlationid": "0",
"severity": "3"
},
{
"eventid": "13",
"name": "Zabbix task manager processes more than 75% busy",
"objectid": "13560",
"clock": "1585589604",
"c_eventid": "0",
"userid": "0",
"object": "0",
"acknowledged": "0",
"value": "1",
"source": "0",
"ns": "554931714",
"suppressed": "0",
"r_eventid": "15",
"correlationid": "0",
"severity": "3"
},
{
"eventid": "15",
"name": "Zabbix task manager processes more than 75% busy",
"objectid": "13560",
"clock": "1585589664",
"c_eventid": "0",
"userid": "0",
"object": "0",
"acknowledged": "0",
"value": "0",
"source": "0",
"ns": "596351852",
"suppressed": "0",
"r_eventid": "0",
"correlationid": "0",
"severity": "0"
}
]
}
Human Readable Output

zabbix-event-get

acknowledgedc_eventidclockcorrelationideventidnamensobjectobjectidr_eventidseveritysourcesuppresseduseridvalue
001585321941012Zabbix agent on Zabbix server is unreachable for 5 minutes248457478013491030001
001585589604013Zabbix task manager processes more than 75% busy5549317140135601530001
001585589664015Zabbix task manager processes more than 75% busy596351852013560000000

Additional Information

Using execute_command you can do anything available on Zabbix API.

You can use the oficcial API documentation on https://www.zabbix.com/documentation/current/manual/api

Known Limitations

No current known limitations

Troubleshooting

Verify if the user has the necessary permissions to execute the operation