Notifier Plugin for Ticket Orchestrator

This document will provide the technical documentation required to configure the Notifier plugin v1.2.0 with the Ticket Orchestrator module of the Netskope Cloud Exchange platform. This plugin is used to send notifications to various platforms.

Prerequisites

To complete this configuration, you need:

• A Netskope tenant (or multiple, for example, production and development/test instances).
• A Netskope Cloud Exchange tenant with the the Tenant plugin and Ticket Orchestrator plugin already configured.
• Generate and Install SSL Certificates in Cloud Exchange.
• An account in the appropriate Notifier platform(s), like Slack, PagerDuty, etc., and for Gmail, you need access to smtp.gmail.com and its port 465.

from notifiers import get_notifier
p = get_notifier('pushover')
p.required
{'required': ['user', 'message', 'token']}
>>> p.notify(user='foo', token='bar', message='test')
<NotificationResponse,provider=Pushover,status=Success>

from notifiers.utils import requests as notifier_requests
notifier_requests.get = partial(
       notifier_requests.get, proxies=self.proxy
)
notifier_requests.post = partial(
       notifier_requests.post, proxies=self.proxy
)

Workflow

Watch a Video

Click play to watch a video.

Notifier for Email (SMTP)

Configure the Notifier Plugin for Email (SMTP)

1. In Cloud Exchange, go to Settings > Plugin Store.
2. Search for and select the Notifier v1.2.0 (CTO) plugin box.

   

4. Enter the Basic Information:
   • Configuration Name: Unique name for the configuration.
   • Sync Interval: Leave Default.
   • Use System Proxy: Enable if the proxy is required for communication.

   

5. Click Next.
6. Enter the Platform parameter:
   • Platform Name: An appropriate name, like Email (SMTP).

   

7. Click Next.
8. Enter the Configuration Parameters:
   • To: One or more comma-separated email addresses.
   • From: The from address to use in the email.
   • Host: Host of the SMTP server.
   • Port: Select the port number to use.
   • Username: Type the username of the SMTP server if relevant.
   • Password: Type the password of the SMTP server if relevant. Follow the steps provided in the document to get the password.(https://support.google.com/mail/thread/182882752/application-specific-password-required?hl=en&authuser=3)
   • Tls: Select if TLS is required.
   • SSL: Select if SSL is required.
   • Html: Select if the email should be parsed as an HTML file.
   • Login: Select to trigger the login to the server.

   

   

9. Click Save.

   

Configure a Ticket Orchestrator Business Rule for Email (SMTP)

1. Go to Business Rules and click Create New Rule.
2. Add rule name, select your query for the business rule, and then click Save.

   

Configure a Ticket Orchestrator Queue for Email (SMTP)

1. Go to Ticket Orchestrator > Queues.
2. Click Add Queue Configuration.
3. Enter the Queue Configuration parameters:
   • Business Rule: Select a Business Rule.
   • Configuration: Notifier Configuration created previously
   • Queues: For the Email Notifier plugin, it should be a “Notification” queue.
   • Map Fields: Add/Map appropriate values between alerts and notifications under the Map Field section. Alert’s attributes can be accessed via “$” in the custom message field. For the Email Notifier Plugin, the following three options are available:
     • Message: Message of the email.
     • Subject: Subject of the email.
     • To: comma-separated email addresses, a default set to $user field from alerts.

   

   

4. Click Save.

   

5. Based on the business rule(s), Notifications for incoming alerts will be sent automatically to the email address. To create notifications for historical alerts, click Sync on the configured queue, enter the Time period (in days), and then click Fetch. It’ll show the number of alerts that are eligible for sending notifications.
6. Click Sync to send the notification(s).

   

Notifier for Gmail

Configure the Notifier Plugin for Gmail

1. In Cloud Exchange, go to Settings > Plugin Store.
2. Search for and select the Notifier v1.2.0 (CTO) plugin box.

   

4. Enter the Basic Information:
   • Configuration Name: Unique name for the configuration.
   • Sync Interval: Leave Default.
   • Use System Proxy: Enable if proxy is required for communication.

   

5. Click Next.
6. Enter the Platform parameter:
   • Platform Name: Enter an appropriate name, like Gmail.

   

7. Click Next.
8. Enter the Configuration Parameters:
   • To: One or more comma separated email addresses.
   • From: The from address to use in email.
   • Host: Host of the SMTP server.
   • Port: Select port number to use.
   • Username: Type username, if relevant.
   • Password: Type password, if relevant.
   • Tls: Select if TLS is required.
   • Ssl: Select if SSL is required.
   • Html: Select if email should be parsed as an HTML file.
   • Login: Select to Trigger login to the server.

   

   

9. Click Save.

   

Configure a Ticket Orchestrator Business Rule for Gmail

1. Go to Business Rules and click Create New Rule.
2. Add a name, select your query for the business rule, and click Save.

   

Configure a Ticket Orchestrator Queue for Gmail

1. Go to Ticket Orchestrator > Queues.
2. Click Add Queue Configuration.
3. Enter the Queue Configuration parameters:
   • Business Rule: Select a Business Rule.
   • Configuration: Notifier Configuration created previously.
   • Queues: For the Gmail Notifier plugin, it should be a Notification queue.
   • Map Fields: Add/Map appropriate values between alerts and notification under the Map Field section. Alert’s attributes can be accessed via “$” in the custom message field. For the Gmail Notifier Plugin, The following three options are available:
     • Message: Message of the email.
     • Subject: Subject of the email.
     • To: Comma separated email addresses, a default set to $user field from alerts.

   

   

4. Click Save.

   

5. Based on the business rule(s), Notifications for incoming alerts will be sent automatically to the email address. To create notifications for historical alerts, click Sync on the configured queue, enter the Time period (in days), and then click Fetch. It’ll show the number of alerts that are eligible for sending notifications.  
6. Click Sync to send the notification(s).

   

Notifier for Slack

Get your Slack Webhook URL

1. To get a slack webhook URL, first sign in to your Slack account and then navigate to https://api.slack.com/messaging/webhooks and click on Create your Slack app button. If you already have a slack application, navigate to step 1.3.

   

2. The following dialog will show up. Select From Scratch.

   

3. Enter the name of your application in App Name, and select the workspace in which you want to create the application. Click Create App.

   

4. Under Add features and functionality, click Incoming Webhooks.

   

5. Toggle the switch on the top right corner (if not already “On”) to activate incoming webhooks in your application.

   

6. Click Add new Webhook to Workspace.

   

7. Select the channel in which you want your application to post the notifications and then click Allow.

   

8. Click Copy to get the newly generated webhook URL. This will be used while creating the Notifier plugin configuration.

   

9. Click Interactivity and Shortcuts.
10. Toggle the switch on the top right corner (if not already On) to activate shortcuts in your application, and paste the CE Incoming Webhook URL from Configure the Notifier Plugin for Slack.

    

11. Click Create New Shortcut and select On messages.

    

12. Click Next and provide the Details of the Shortcut. You have to create 3 different shortcuts with Callback ID: create_severity, create_assignee, and create_status, respectively.

    

    

Configure the Notifier Plugin for Slack

1. In Cloud Exchange, go to Settings > Plugin Store.
2. Search for and select the Notifier v1.2.0 (CTO) plugin box.

   

4. Enter the Basic Information:
   • Configuration Name: Unique name for the configuration.
   • Sync Interval: Leave Default.
   • Use System Proxy: Enable if proxy is required for communication.

   

5. Click Next.
6. Enter the Platform parameter:
   • Platform Name: Enter an appropriate name, like Slack (Webhooks).

   

7. Click Next.
8. Enter the Configuration Parameters:
   • Webhook Url: (webhook_url) the webhook URL to use. Register one at https://my.slack.com/services/new/incoming-webhook/.
   • Icon Url: (icon_url) override bot icon with image URL.
   • Icon Emoji: (icon_emoji) override bot icon with emoji name.
   • Username: (username) override the displayed bot name.
   • Channel: (channel) override default channel or private message.
   • Unfurl Links: (unfurl_links) avoid automatic attachment creation from URLs.
   • Enable CE Incoming Webhook: Enable/Disable CE Incoming Webhook.
   • CE Incoming Webhook URL: CE Incoming Webhook URL to accept incoming request from the Slack platform.
   • Signing Secret: Used to verify incoming webhook request’s payload from the Slack platform.
   • Verification Token: Used to verify incoming webhook request from the Slack platform.

   

   

6. Click Save.

   

Configure a Ticket Orchestrator Business Rule for Slack

1. Go to Business Rules and click Create New Rule.
2. Add a rule name, select your query for the business rule, and click Save.

   

Configure a Ticket Orchestrator Queue for Slack

1. Go to Ticket Orchestrator > Queues.
2. Click Add Queue Configuration.
3. Enter the Queue parameters:
   • Business Rule: Select a Business Rule.
   • Configuration: Notifier Configuration created previously.
   • Queues: For the Slack Notifier plugin, it should be a Notification queue.
   • Click Add to add more field mappings.

   

   

4. Click Save.

   

5. Based on the business rule(s), Notifications for incoming alerts will be sent automatically to Slack. To create notifications for historical alerts, click Sync on the configured queue, enter the Time period (in days), and then click Fetch. It’ll show the number of alerts that are eligible for sending notifications. 
6. Click Sync to send the notification(s).

   

   Note For updating incidents on the Netskope Tenant, this plugin supports updating Status, Severity, and Assignee fields on Netskope Tenant. And for updating them, it is mandatory to map all the fields in Queue Configuration.

Validate the Notifier Plugin

In order to validate the workflow, you must have Netskope Alerts/Events.

1. Go to Ticket Orchestrator > Alerts/Events.

   

   

2. To verify the logs, go to Settings > Logging and search with the filter like,
   message Like “<configuration_name>”.

   

3. To verify the status of the notifications in Cloud Exchange, go to Ticket Orchestrator > Tickets.

   

4. To view the message(s) sent to Slack, go to your configured Slack channel.

   

Troubleshooting the Notifier Plugin

Alert/Event have a value for Status/Severity fields, but notification is created with “Other”

It might be possible that the ticket created with the Alert/Event fetched from Netskope is showing Other in Status/Severity fields. It might be due to the default mapping of the plugin, as it uses the static mapping and if the field value does not match the mapping, it will show as Other.

What to do:

Log in to your Netskope Tenant, and verify the severity/status value of the particular alert/event.