NAPT
All scripts
operations
Expert
ongoing

SOAR Network Event Router

Event ingestion (syslog/SNMP/Kafka/webhook) → correlation → enrichment → ServiceNow incident or Jira ticket or PagerDuty alert, with dedup and escalation logic.

ServiceNow
Jira
PagerDuty
Slack
Open in GeneratorOpen in Platform
You're viewing a preview

The full script, parameters, and execution console are available with a free account.

Sign in free to access

Already have access? Sign in →

Capabilities

  • Multi-source ingestion
  • Event correlation
  • Enrichment (CMDB lookup)
  • ServiceNow incident creation
  • Jira ticket creation
  • PagerDuty alert
  • Dedup + escalation

Required inputs

Parameters the script accepts. Defaults shown; some are vendor- or context-gated.

ParameterTypeDefaultNotes
Dedup window (s)
dedup_window
number300—
Min severity to route
severity_floor
stringwarning—
Default target
default_target
stringservicenow—

Hint 1 — Name your vendors and OS versions

Mention the exact platforms you run (ServiceNow, Jira, PagerDuty, …) so the generated operations logic uses the right CLI/NETCONF syntax.

Hint 2 — State your real thresholds

Provide concrete values for Dedup window (s), Min severity to route, Default target instead of the defaults — they shape what counts as a fault.

Hint 3 — Prioritize the checks you need

This tool can multi-source ingestion and event correlation. Ask for the subset relevant to your incident to keep output focused.

Hint 4 — Describe your inventory format

Tell the assistant whether your device list is CSV, YAML, or JSON and which columns it has, so parsing matches your data.

Sample inventory schema

Authoritative shape of the device/policy data this script consumes.

No bundled inventory sample. The script accepts standard device lists (CSV/YAML) with hostname, mgmt IP, vendor, and credentials.

Expected output

Reference terminal output the script should produce — used as a stylistic and structural target.

terminal
[2026-06-12] INFO  SOAR router listening (syslog+webhook)...
  Rx 'BGP neighbor down' from core-rtr-01 (severity=critical)
  Enriched: CI=core-rtr-01, owner=net-core, site=MUM
  Dedup: no match in 300s window → routing
  → ServiceNow INC0098421 created · PagerDuty PD-9920 triggered
  Rx duplicate event → suppressed (dedup)
Summary: 1 incident · 1 page · 1 suppressed