Publisher: Splunk
Connector Version: 2.0.10
Product Vendor: VMware
Product Name: vSphere
Minimum Product Version: 6.2.1
This app implements investigative, containment and VM management actions on VMware ESXi or vCenter server
This app uses the pysphere module, which is licensed under the New BSD License. Copyright (c) 2012, Sebastian Tello All rights reserved.
This table lists the configuration variables required to operate vSphere. These variables are specified when configuring a vSphere asset in Splunk SOAR.
| VARIABLE | REQUIRED | TYPE | DESCRIPTION |
|---|---|---|---|
| server | required | string | Server IP/Hostname |
| verify_server_cert | optional | boolean | Verify server certificate |
| username | required | string | Administrator username |
| password | required | password | Administrator password |
test connectivity - Validate the asset configuration for connectivity. This action logs into the device to check the connection and credentials
list vms - Get the list of registered VMs
get system info - Get information about a VM
start vm - Start a stopped or suspended VM
revert vm - Revert VM to a named snapshot if name is specified, otherwise revert to the current snapshot
stop vm - Stop a VM
suspend vm - Suspend a VM
snapshot vm - Take a snapshot of the VM
Validate the asset configuration for connectivity. This action logs into the device to check the connection and credentials
Type: test
Read only: True
No parameters are required for this action
No Output
Get the list of registered VMs
Type: investigate
Read only: True
No parameters are required for this action
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.status | string | ||
| action_result.data.*.ip | string | ip |
|
| action_result.data.*.state | string | ||
| action_result.data.*.vm_full_name | string | ||
| action_result.data.*.vm_hostname | string | host name |
|
| action_result.data.*.vm_name | string | ||
| action_result.data.*.vmx_path | string | vm |
|
| action_result.summary.running_vms | numeric | ||
| action_result.summary.total_vms | numeric | ||
| action_result.message | string | ||
| summary.total_objects | numeric | ||
| summary.total_objects_successful | numeric |
Get information about a VM
Type: investigate
Read only: True
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| ip_hostname | required | Hostname/IP address to get info of | string | host name ip |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.status | string | ||
| action_result.parameter.ip_hostname | string | host name ip |
|
| action_result.data.*.ip | string | ip |
|
| action_result.data.*.state | string | ||
| action_result.data.*.vm_full_name | string | ||
| action_result.data.*.vm_hostname | string | host name |
|
| action_result.data.*.vm_name | string | ||
| action_result.data.*.vmx_path | string | vm |
|
| action_result.summary.found_endpoint | boolean | ||
| action_result.summary.total_vms_searched | numeric | ||
| action_result.message | string | ||
| summary.total_objects | numeric | ||
| summary.total_objects_successful | numeric |
Start a stopped or suspended VM
Type: correct
Read only: False
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| vmx_path | required | VMX file path | string | vm |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.status | string | ||
| action_result.parameter.vmx_path | string | vm |
|
| action_result.data | string | ||
| action_result.summary | string | ||
| action_result.message | string | ||
| summary.total_objects | numeric | ||
| summary.total_objects_successful | numeric |
Revert VM to a named snapshot if name is specified, otherwise revert to the current snapshot
Type: contain
Read only: False
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| vmx_path | required | VMX file path | string | vm |
| snapshot | optional | Snapshot name (case sensitive) to revert to | string |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.status | string | ||
| action_result.parameter.snapshot | string | ||
| action_result.parameter.vmx_path | string | vm |
|
| action_result.data | string | ||
| action_result.summary | string | ||
| action_result.message | string | ||
| summary.total_objects | numeric | ||
| summary.total_objects_successful | numeric |
Stop a VM
Type: contain
Read only: False
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| vmx_path | required | VMX file path | string | vm |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.status | string | ||
| action_result.parameter.vmx_path | string | vm |
|
| action_result.data | string | ||
| action_result.summary | string | ||
| action_result.message | string | ||
| summary.total_objects | numeric | ||
| summary.total_objects_successful | numeric |
Suspend a VM
Type: contain
Read only: False
The start vm action can be used to resume a suspended vm.
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| vmx_path | required | VMX file path | string | vm |
| download | optional | Download suspend file to the vault | boolean |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.status | string | ||
| action_result.parameter.download | boolean | ||
| action_result.parameter.vmx_path | string | vm |
|
| action_result.data.*.host | string | ip |
|
| action_result.data.*.name | string | ||
| action_result.data.*.size | string | ||
| action_result.data.*.type | string | ||
| action_result.data.*.vault_id | string | vault id os memory dump vm suspend file |
|
| action_result.data.*.vmx_path | string | vm |
|
| action_result.summary | string | ||
| action_result.message | string | ||
| summary.total_objects | numeric | ||
| summary.total_objects_successful | numeric |
Take a snapshot of the VM
Type: generic
Read only: False
| PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS |
|---|---|---|---|---|
| vmx_path | required | VMX file path | string | vm |
| download | optional | Download snapshot file to the vault | boolean |
| DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES |
|---|---|---|---|
| action_result.status | string | ||
| action_result.parameter.download | boolean | ||
| action_result.parameter.vmx_path | string | vm |
|
| action_result.data.*.host | string | ip |
|
| action_result.data.*.name | string | ||
| action_result.data.*.size | string | ||
| action_result.data.*.type | string | ||
| action_result.data.*.vault_id | string | vault id os memory dump vm snapshot file |
|
| action_result.data.*.vmx_path | string | vm |
|
| action_result.summary | string | ||
| action_result.message | string | ||
| action_result.message | string | ||
| summary.total_objects | numeric | ||
| summary.total_objects_successful | numeric |
Auto-generated Splunk SOAR Connector documentation.
Copyright 2025 Splunk Inc.
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.