vSphere

Integration version: 4.0

Network

Access from Google Security Operations SOAR to vSphere Allow traffic over ports 443 (HTTPS) and 8443 (API over SSL), or as configured in your environment.

Configure vSphere integration in Google Security Operations SOAR

For detailed instructions on how to configure an integration in Google Security Operations SOAR, see Configure integrations.

Actions

Get System Info

Description

Get information about a VM.

Parameters

Parameter	Type	Default Value	Description
Vm Name	String	N/A	Target VM name.

Run On

This action runs on all entities.

Action Results

Script Result

Script Result Name	Value Options	Example
success	True/False	success:False

JSON Result

{
    "Guest": "Microsoft Windows 7 (64-bit)",
    "Bios UUID": "423503ea-af3c-58a8-188c-f6285cec98e5",
    "VMware Tools": "toolsNotInstalled",
    "Ip Address": "1.1.1.1",
    "State": "poweredOn",
    "Template": false,
    "Path": "[DataStore] vm/vn.vmx",
    "Name": "vm",
    "Instance UUID": "50359be7-424b-e53d-5133-3f98f0e705ef"
}

Get VM by IP

Description

Get VM name by the IP address.

Parameters

N/A

Run On

This action run on the IP Address entity.

Action Results

Entity Enrichment

Enrichment Field Name	Logic - When to apply
Guest	Returns if it exists in JSON result
Bios UUID	Returns if it exists in JSON result
VMware Tools	Returns if it exists in JSON result
Ip Address	Returns if it exists in JSON result
State	Returns if it exists in JSON result
Template	Returns if it exists in JSON result
Path	Returns if it exists in JSON result
Instance UUID	Returns if it exists in JSON result
Name	Returns if it exists in JSON result

Insights

N/A

Script Result

Script Result Name	Value Options	Example
success	True/False	success:False

JSON Result

[
    {
        "EntityResult":
        {
            "Guest": "Microsoft Windows 7 (64-bit)",
            "Bios UUID": "423503ea-af3c-58a8-188c-f6285cec98e5",
            "VMware Tools": "toolsNotInstalled",
            "Ip Address": "1.1.1.1",
            "State": "poweredOn",
            "Template": false,
            "Path": "[DataStore] vm/vn.vmx",
            "Instance UUID": "50359be7-424b-e53d-5133-3f98f0e705ef",
            "Name": "vm"
        },
        "Entity": "1.1.1.1"
    }
]

List VMs

Description

Get a list of all VMs that are registered.

Parameters

N/A

Run On

This action runs on all entities.

Action Results

Script Result

Script Result Name	Value Options	Example
success	True/False	success:False

JSON Result

[
    {
        "Guest": "Microsoft Windows 7 (64-bit)",
        "Bios UUID": "423503ea-af3c-58a8-188c-f6285cec98e5",
        "VMware Tools": "toolsNotInstalled",
        "Ip Address": "1.1.1.1",
        "State": "poweredOn",
        "Template": false,
        "Path": "[DataStore] vm/vn.vmx",
        "Name": "vm",
        "Instance UUID": "50359be7-424b-e53d-5133-3f98f0e705ef"
    }
]

Ping

Description

Verify that the user has a connection to VMWare vSphere via the user's device.

Parameters

N/A

Run On

This action runs on all entities.

Action Results

Entity Enrichment

N/A

Insights

N/A

Script Result

Script Result Name	Value Options	Example
success	True/False	success:False

JSON Result

N/A

Power Off

Description

Power off a VM.

Parameters

Parameter	Type	Default Value	Description
VM Name	String	N/A	Target VM name.

Run On

This action runs on all entities.

Action Results

Script Result

Script Result Name	Value Options	Example
success	True/False	success:False

Power On

Description

Power on a VM.

Parameters

Parameter	Type	Default Value	Description
VM Name	String	N/A	N/A

Run On

This action runs on all entities.

Action Results

Script Result

Script Result Name	Value Options	Example
success	True/False	isuccess:False

Reset

Description

Reset a VM.

Parameters

Parameter	Type	Default Value	Description
VM Name	String	N/A	The name of the target VM.

Run On

This action runs on all entities.

Action Results

Script Result

Script Result Name	Value Options	Example
success	True/False	success:False

Revert to Snapshot

Description

Revert a VM settings to a state recorded in a snapshot.

Parameters

Parameter	Type	Default Value	Description
VM Name	String	N/A	The name of the target VM.
Snapshot Name	String	N/A	The name of the target snapshot.

Run On

This action runs on all entities.

Action Results

Script Result

Script Result Name	Value Options	Example
success	True/False	success:False

Suspend

Description

Suspend a VM.

Parameters

Parameter	Type	Default Value	Description
VM Name	String	N/A	The name of the target VM.

Run On

This action runs on all entities.

Action Results

Script Result

Script Result Name	Value Options	Example
success	True/False	success:False

Take Snapshot

Description

Take a VM state snapshot.

Parameters

Parameter	Type	Default Value	Description
VM Name	String	N/A	The name of the target VM.
Snapshot Name	String	N/A	The name of the target snapshot.
Snapshot Description	String	N/A	Snapshot description value.

Run On

This action runs on all entities.

Action Results

Script Result

Script Result Name	Value Options	Example
success	True/False	success:False