More info on the Alert action GET Request

I'd like to get more information on the GET request alert action. Will this store results in a "macro" variable for our use? How do we access the data Orion will get back from the GET request? Where is the data stored in the DB should I need to massage the data returned? Anything else that I should be aware of or that's cool to do with this action?

Thank you.

Find more posts tagged with

alert_actions

get

Accepted answers

All comments

gregthompson

Same here, trying to see how to use the GET request to pull data from an external site first, then a POST to follow it using the data from the GET.

sum_giais

I haven't personally used the send GET/POST request action but I always thought the intention of the action was to send/push data elsewhere. I didn't think the action could store or utilize any data returned.

sum_giais

Am very curious... digging

sum_giais

What's the output of the SWQL query below look like from the "Orion.AlertHistory" table. I don't have something I can get a valid post to etc. so I've got no "data" to look at in SWQL studio but perhaps you or anyone else does?

SELECT

-- COMMENT: Identify our fields/columns to extract from the table entities
     ah.TimeStamp
    ,ah.AlertHistoryID
    ,ah.AlertActiveID
    ,ah.Message
    ,ah.Description
    ,ah.DisplayName
    ,ah.EventType
    ,ah.AccountID
    ,ah.ActionID

-- COMMENT: Define our source table entity
FROM Orion.AlertHistory AS ah

-- COMMENT: Below is limiting output to last 24 hours
WHERE HOURDIFF(ah.TimeStamp, GETUTCDATE()) < 24

-- COMMENT: Below is ordering by the datetime field "ah.TimeStamp" in descending order
ORDER BY ah.TimeStamp DESC

From setting up a failed one (best I can do right now.) this is what I can see in the "Message" field from the SWQL query above but not sure how/if it changes much when successful.

[{"Key":"ActionTitle","Value":"SendHTTPS POST"},{"Key":"ErrorMessage","Value":"Failed to execute HTTP request"}]

I'll add that even if it's not possible with the action -- I bet it could be scripted in PowerShell or other scripting languages to send a GET/POST and parse the response, then do XYZ after.

gregthompson

Even if you use something free like https://www.boredapi.com/api/activity whether post or get, it seems no result comes back...