Atlassian Confluence Server

Integration version: 2.0

Configure the Atlassian Confluence Server integration to work with Google Security Operations SOAR

Prerequisite steps

To authenticate to the Confluence Server, choose any of the following options:

  • Using a username and password for a dedicated account.
  • Using the personal access token (PAT).

If both authentication options are provided for the integration, PAT takes priority over the username and password.

Authentication based on username and password requires creating a dedicated account that will be used for the integration.
Authentication based on the access token requires configuring account permissions. When created, the new PAT will correspond to the current permission level of the account.

To create a token, follow these steps:

  1. In Confluence, go to Account > Account settings > Personal access tokens.
  2. Select Create token.
  3. Name the token you're creating.
  4. (Optional) For additional security, you can configure your token to automatically expire after a set number of days.
  5. Click Create.

Configure the Atlassian Confluence Server integration in Google Security Operations SOAR

Integration parameters

Parameter name Type Default Value Is mandatory Description
Api Root String https://ip_address True Specify Confluence Server Api Root to connect to.
Username String N/A False Specify a username to use for the connection. Integration supports authentication on either username + password or a personal access token.
Password Password N/A False Specify a password to use for the connection. Integration supports authentication on either username + password or a personal access token.
Personal Access Token Password N/A False Specify a token to use for the connection. Integration supports authentication on either username + password or a personal access token.
Verify SSL Checkbox Checkbox Checked False If enabled, the certificate configured for the API root is validated.

Actions

Ping

Description

Test connectivity.

Parameters

N/A

Run on

The action is not running on entities.

Action results

Script result
Script result name Value options Example
is_success True/False is_success:False

If the action is successful (there is a json in the response and the server response is 200), is_success should be set to True. Otherwise, False.

Case wall
Result type Value/Description Type (Entity/General)
Output message* The action should not fail nor stop a playbook execution:
  • If successful:
    print "Successfully connected to the Atlassian Confluence Server instance with the provided connection parameters!"
  • If both username and password, and PAT are provided:
    "Both username and password, and personal access token are provided for the integration, personal access token will be taken to connect with"

The action should fail and stop a playbook execution:
  • If both (username+password) and PAT are not provided:
    print "Failed to connect to Atlassian Confluence Server, expecting either username and password, or personal access token to connect with!"
  • If critical error, like wrong credentials or lost connectivity:
    print "Failed to connect to the Atlassian Confluence Server instance! Error is {0}".format(exception.stacktrace)
 General

List pages

Description

List pages available in the Atlassian Confluence Server instance based on the criteria provided.

Parameters

Parameter name Type Default value Is mandatory Description
Filter Key DDL Select One

DDL possible values:
  • Title
  • Space Name
  • Status
 False Specify the key that needs to be used to filter pages.
Filter Logic DDL Not Specified

DDL possible values:
  • Not Specified
  • Equal
  • Contains
 False Specify what filter logic should be applied. Filtering logic is working based on the value provided in the Filter Key parameter.
Filter Value String N/A False Specify what value should be used in the filter.
If Equal is selected, the action attempts to find the exact match among results.
If Contains is selected, the action attempts to find results that contain that substring.
If nothing is provided in this parameter, the filter will not be applied.
Filtering logic works based on the value provided in the Filter Key parameter.
Max Records To Return Int 50 False Specify how many records to return.
If nothing is provided, the action returns 50 records.

Run on

The action is not running on entities.

Action results

Script result
Script result name Value options Example
is_success True/False is_success:False

If the action runs successfully (no errors returned, server response is 200 OK), is_success should be set to True.

JSON result
{
   "results": [
       {
           "id": "98305",
           "type": "page",
           "status": "current",
           "title": "Tell people what you think in a comment (step 8 of 9)",
           "space": {
               "id": 131073,
               "key": "ds",
               "name": "Demonstration Space",
               "type": "global",
               "_links": {
                   "webui": "/display/ds",
                   "self": "http://172.30.201.45:8090/rest/api/space/ds"
               },
               "_expandable": {
                   "metadata": "",
                   "icon": "",
                   "description": "",
                   "retentionPolicy": "",
                   "homepage": "/rest/api/content/98319"
               }
           },
           "extensions": {
               "position": 7
           },
           "_links": {
               "webui": "/pages/viewpage.action?pageId=98305",
               "edit": "/pages/resumedraft.action?draftId=98305",
               "tinyui": "/x/AYAB",
               "self": "http://172.30.201.45:8090/rest/api/content/98305"
           },
           "_expandable": {
               "container": "/rest/api/space/ds",
               "metadata": "",
               "operations": "",
               "children": "/rest/api/content/98305/child",
               "restrictions": "/rest/api/content/98305/restriction/byOperation",
               "history": "/rest/api/content/98305/history",
               "ancestors": "",
               "body": "",
               "version": "",
               "descendants": "/rest/api/content/98305/descendant"
           }
       },
       ...
   ],
   "start": 0,
   "limit": 5,
   "size": 5,
   "_links": {
       "self": "http://172.30.201.45:8090/rest/api/content?expand=space",
       "next": "/rest/api/content?expand=space&limit=5&start=5",
       "base": "http://172.30.201.45:8090",
       "context": ""
   }
}
Case wall
Result type Value/Description Type (Entity/General)
Output message* The action should not fail nor stop a playbook execution:

  • If data is available(is_success = true):
print "Successfully found pages for the provided criteria in Atlassian Confluence Server".

  • If data is not available (is_success=false)
print "No pages were found for the provided criteria in Atlassian Confluence Server"

  • If "Filter Value" is empty (is_success=true):
The filter was not applied, because parameter "Filter Value" has an empty value.

The action should fail and stop a playbook execution:

  • If Filter Key == "Select One" and Filter Logic "Equal" or "Contains":
Error executing action "{action name}". Reason: you need to select a field from the Filter Key parameter.

  • If invalid value is provided for Max Records to Return:
Error executing action "{action name}". Reason: "Invalid value was provided for "Max Records to Return": <provided value>. Positive number should be provided".

  • If fatal error, like wrong credentials, no connection to server, other:
"Error executing action "{action name}". Reason: {0}''.format(error.Stacktrace)

  • If both username+password and PAT are not provided:
print "Failed to connect to Atlassian Confluence Server, expecting either username and password, or personal access token to connect with!"		 General
Case Wall Table Name: Available Confluence Pages
Columns:
  • ID
  • Title
  • Space
  • Status
  • Created
 General

Get page by ID

Description

Get Atlassian Confluence Server page by ID.

Parameters

Parameter name Type Default value Is mandatory Description
Page ID String N/A True Specify the page ID to return.
Expand CSV body.storage False Specify the expand parameter to return additional information about the page. Parameter accepts multiple values as a comma-separated list.
By default, the content of the page is fetched with body.storage.

Run on

The action is not running on entities.

Action results

Script result
Script result name Value options Example
is_success True/False is_success:False

If the action runs successfully (page is returned, server response is 200 OK), is_success should be set to True.

JSON result
{
   "id": "98380",
   "type": "page",
   "status": "current",
   "title": "111",
   "body": {
       "storage": {
           "value": "<p>test page</p><p>11</p><p>aa</p><p>aa</p><p>aa</p><p><br /></p><p><br /></p>",
           "representation": "storage",
           "_expandable": {
               "content": "/rest/api/content/98380"
           }
       },
       "_expandable": {
           "editor": "",
           "view": "",
           "export_view": "",
           "styled_view": "",
           "anonymous_export_view": ""
       }
   },
   "extensions": {
       "position": "none"
   },
   "_links": {
       "webui": "/display/SIEM/111",
       "edit": "/pages/resumedraft.action?draftId=98380&draftShareId=cf8b3a21-8e36-4a83-a696-51fcb4428d1c",
       "tinyui": "/x/TIAB",
       "collection": "/rest/api/content",
       "base": "http://172.30.201.45:8090",
       "context": "",
       "self": "http://172.30.201.45:8090/rest/api/content/98380"
   },
   "_expandable": {
       "container": "/rest/api/space/SIEM",
       "metadata": "",
       "operations": "",
       "children": "/rest/api/content/98380/child",
       "restrictions": "/rest/api/content/98380/restriction/byOperation",
       "history": "/rest/api/content/98380/history",
       "ancestors": "",
       "version": "",
       "descendants": "/rest/api/content/98380/descendant",
       "space": "/rest/api/space/SIEM"
   }
}
Case wall
Result type Value/Description Type (Entity/General)
Output message* The action should not fail nor stop a playbook execution:

  • If page is found (is_success = true):
print "Successfully fetched page information with id: <id>"

  • If data is not available (is_success=false):
print "The following page id was not found in the Atlassian Confluence Server: <page id>"

The action should fail and stop a playbook execution:

  • If fatal error, like wrong credentials, no connection to server, other:
"Error executing action "<Action name>". Reason: {0}''.format(error.Stacktrace)

  • If both username + password and PAT are not provided:
print "Failed to connect to Atlassian Confluence Server, expecting either username and password, or personal access token to connect with!"		 General

Get child pages

Description

Get child pages for the Atlassian Confluence Server page.

Parameters

Parameter name Type Default value Is mandatory Description
Page ID String N/A True Specify the page ID to return.
Max records to return Int 10 True Specify the limit of child pages to return.

Run on

The action is not running on entities.

Action results

Script result
Script result name Value options Example
is_success True/False is_success:False

If the action runs successfully (page is returned, server response is 200 OK), is_success should be set to True.

JSON result
{
   "results": [
       {
           "id": "98383",
           "type": "page",
           "status": "current",
           "title": "test child page!",
           "extensions": {
               "position": "none"
           },
           "_links": {
               "webui": "/pages/viewpage.action?pageId=98383",
               "edit": "/pages/resumedraft.action?draftId=98383&draftShareId=799fd068-5053-4889-9120-c1a3c970fdbd",
               "tinyui": "/x/T4AB",
               "self": "http://172.30.201.45:8090/rest/api/content/98383"
           },
           "_expandable": {
               "container": "/rest/api/space/SIEM",
               "metadata": "",
               "operations": "",
               "children": "/rest/api/content/98383/child",
               "restrictions": "/rest/api/content/98383/restriction/byOperation",
               "history": "/rest/api/content/98383/history",
               "ancestors": "",
               "body": "",
               "version": "",
               "descendants": "/rest/api/content/98383/descendant",
               "space": "/rest/api/space/SIEM"
           }
       }
   ],
   "start": 0,
   "limit": 1,
   "size": 1,
   "_links": {
       "self": "http://172.30.201.45:8090/rest/api/content/98380/child/page",
       "base": "http://172.30.201.45:8090",
       "context": ""
   }
}
Case wall
Result type Value/Description Type (Entity/General)
Output message* The action should not fail nor stop a playbook execution:

if data is available (is_success = true):
print "Successfully found child pages for the provided Atlassian Confluence Server page id: <page_id>".

If data is not available (is_success=false)
print "No child pages were found for the provided Atlassian Confluence Server page id <page_id>"

The action should fail and stop a playbook execution:

  • If invalid value is provided for Max Records to Return:
Error executing action "{action name}". Reason: "Invalid value was provided for "Max Records to Return": <provided value>. Positive number should be provided".

  • If fatal error, like wrong credentials, no connection to server, other:
"Error executing action "{action name}". Reason: {0}''.format(error.Stacktrace)
  • If both username + password and PAT are not provided:
print "Failed to connect to Atlassian Confluence Server, expecting either username and password, or personal access token to connect with!"		 General

Get page comments

Description

Get comments for the Atlassian Confluence Server page.

Parameters

Parameter name Type Default value Is mandatory Description
Page ID String N/A True Specify the page ID to return.
Expand CSV body.storage False Specify the expand parameter to return additional information about the page. Parameter accepts multiple values as a comma-separated list.
By default, the content of the page is fetched with body.storage.
Max records to return Int 10 True Specify the limit of child pages to return.

Run on

The action is not running on entities.

Action results

Script result
Script result name Value options Example
is_success True/False is_success:False

If the action runs successfully (comments are returned, server response is 200 OK), is_success should be set to True.

JSON result
{
   "results": [
       {
           "id": "98387",
           "type": "comment",
           "status": "current",
           "title": "Re: 111",
           "body": {
               "storage": {
                   "value": "<p>comment1</p>",
                   "representation": "storage",
                   "_expandable": {
                       "content": "/rest/api/content/98387"
                   }
               },
               "_expandable": {
                   "editor": "",
                   "view": "",
                   "export_view": "",
                   "styled_view": "",
                   "anonymous_export_view": ""
               }
           },
           "extensions": {
               "location": "footer",
               "_expandable": {
                   "resolution": ""
               }
           },
           "_links": {
               "webui": "/display/SIEM/111?focusedCommentId=98387#comment-98387",
               "self": "http://203.0.113.1:8090/rest/api/content/98387"
           },
           "_expandable": {
               "container": "/rest/api/content/98380",
               "metadata": "",
               "operations": "",
               "children": "/rest/api/content/98387/child",
               "restrictions": "/rest/api/content/98387/restriction/byOperation",
               "history": "/rest/api/content/98387/history",
               "ancestors": "",
               "version": "",
               "descendants": "/rest/api/content/98387/descendant",
               "space": "/rest/api/space/SIEM"
           }
       },
       ...
   ],
   "start": 0,
   "limit": 10,
   "size": 2,
   "_links": {
       "self": "http://203.0.113.1:8090/rest/api/content/98380/child/comment?expand=body.storage",
       "base": "http://203.0.113.1:8090",
       "context": ""
   }
}
Case wall
Result type Value/Description Type (Entity/General)
Output message* The action should not fail nor stop a playbook execution:

  • If data is available(is_success = true):
print "Successfully fetched page comments for the provided Atlassian Confluence Server page id: <page_id>".

  • If data is not available (is_success=false)
print "No page comments were found for the provided Atlassian Confluence Server page id <page_id>"

The action should fail and stop a playbook execution:

  • If invalid value is provided for Max Records to Return:
Error executing action "{action name}". Reason: "Invalid value was provided for "Max Records to Return": <provided value>. Positive number should be provided".

  • If fatal error, like wrong credentials, no connection to server, other:
"Error executing action "{action name}". Reason: {0}''.format(error.Stacktrace)

  • If both username + password and PAT are not provided:
print "Failed to connect to Atlassian Confluence Server, expecting either username and password, or personal access token to connect with!"		 General