Documentation

Integrations

Integration classes exposed to CYBERQUEST scripts through CQ.Integrations.

Overview

The CQ.Integrations namespace exposes configured integration objects to CYBERQUEST scripts.

Available members

Access path	Exported object
`CQ.Integrations.NetAlert`	`NetAlert`
`CQ.Integrations.QRadar`	`QRadar`
`CQ.Integrations.IntegrationsNotifications`	`IntegrationsNotifications`
`CQ.Integrations.Ticketing.ServiceNow`	`ServiceNowTicketing`
`CQ.Integrations.Ticketing.ConnectWise`	`ConnectWiseTicketing`
`CQ.Integrations.Ticketing.Remedy`	`RemedyTicketing`

Usage

Access an integration through its complete CQ.Integrations path. These exports are already-created objects; do not invoke them with new.

CQ.Integrations.NetAlert.setHost("https://webapplication");
CQ.Integrations.NetAlert.setBearerToken("token");

NetAlert

CQ.Integrations.NetAlert queries traffic and alert data. Call setHost and setBearerToken before making a request.

Configuration methods

Method	Parameters	Returns
`setHost(value)`	`value` (string): API base URL.	`undefined`
`getHost()`	None.	Configured host string. Throws if no host is set.
`setBearerToken(value)`	`value` (string): bearer token without the `Bearer` prefix.	`undefined`
`validateBearerToken()`	None.	`undefined`. Throws if no bearer token is set.
`setBody(data)`	`data` (any JSON-serializable value).	`undefined`
`getOutput(response)`	`response` (`HttpResponse`).	Parsed JSON, or `{}` when unavailable.
`parseFilter(filter)`	`filter` (string).	The supplied non-empty string, otherwise `"*"`.

Query methods

Method	Parameters	Returns
`GetTraffic(data)`	`data.StartDate`, `data.EndDate`, optional `data.Filter`, and `data.maxNumberOfResults`.	Parsed API response, or `{}`.
`GetAlerts(data)`	`data.StartDate`, `data.EndDate`, optional `data.Filter`, and `data.maxNumberOfResults`.	Parsed API response, or `{}`.
`GetSingleTraffic(data)`	`data.Flow_GUID`: flow identifier.	Parsed API response for at most one flow, or `{}`.
`GetSingleAlert(data)`	`data.AlertID`: alert identifier.	Parsed API response for at most one alert, or `{}`.
`GetTrafficCountByField(data)`	Date range, optional filter, `data.Field`, and `data.maxNumberOfResults`.	Parsed API response, or `{}`.
`GetAlertCountByField(data)`	Date range, optional filter, `data.Field`, and `data.maxNumberOfResults`.	Parsed API response, or `{}`.
`GetSrcIPConnections(data)`	Date range, optional filter, and `data.maxNumberOfResults`.	Parsed API response, or `{}`.
`GetDestIPConnections(data)`	Date range, optional filter, and `data.maxNumberOfResults`.	Parsed API response, or `{}`.

const alerts = CQ.Integrations.NetAlert.GetAlerts({
  StartDate: "2026-01-01 00:00:00",
  EndDate: "2026-01-02 00:00:00",
  Filter: "SourceIP:192.0.2.10",
  maxNumberOfResults: 100
});

QRadar

CQ.Integrations.QRadar runs an Ariel query and waits for it to complete.

Method	Parameters	Returns
`setHost(value)`	`value` (string): QRadar base URL.	`undefined`
`getHost()`	None.	Configured host string. Throws if no host is set.
`setBasicAuth(username, password)`	Basic-auth username and password strings.	`undefined`
`validateAuth()`	None.	`undefined`. Throws if authentication is not configured.
`setBody(data)`	`data` (any JSON-serializable value).	`undefined`
`getOutput(response)`	`response` (`HttpResponse`).	Parsed JSON, or `{}`.
`GetData(query_expression)`	`query_expression` (string): Ariel query expression.	`IntegrationHTTPResponse`.

GetData returns an object with isSuccess, data, message, and errorMessage properties. On success, data contains the returned events. The method polls every 15 seconds and blocks until QRadar reports that the search is complete.

const result = CQ.Integrations.QRadar.GetData(
  "SELECT * FROM events LAST 10 MINUTES"
);

IntegrationsNotifications

CQ.Integrations.IntegrationsNotifications inherits common authentication helpers and sends email through the CYBERQUEST notification endpoint.

Authentication methods

Method	Parameters	Returns
`setBearerToken(value)`	Bearer token string without the `Bearer` prefix.	`undefined`
`setBasicAuth(username, password)`	Basic-auth username and password strings.	`undefined`
`disableAuth()`	None.	`undefined`; subsequent calls do not require configured authentication.

`SendEmail`

CQ.Integrations.IntegrationsNotifications.SendEmail(
  to,
  subject,
  message,
  host
);

Parameter	Type	Default	Description
`to`	string	Required	Email recipient passed to the notification endpoint.
`subject`	string	`""`	Email subject.
`message`	string	`""`	Email body.
`host`	string	`"webapplication"`	Hostname used in the HTTPS endpoint.

Returns an IntegrationHTTPResponse. Check its isSuccess and message properties to determine whether the endpoint accepted the request.

Ticketing

CQ.Integrations.Ticketing exposes one ready-to-use object per supported ticketing system: ServiceNow, ConnectWise, and Remedy. All three share the same shape — configure host and credentials, then call CreateTicket, which always returns an IntegrationHTTPResponse (isSuccess, data, message, errorMessage).

const ticket = CQ.Integrations.Ticketing.ServiceNow
  .setCredentialsByGUID("00000000-0000-0000-0000-000000000000")
  .setHost("https://yourinstance.service-now.com")
  .CreateTicket({
    summary: Event.AlertName,
    description: Event.Description,
    priority: "2"
  });

if (ticket.isSuccess) {
  Event.S1 = ticket.data.number;
}

ServiceNow

Method	Parameters	Returns
`setHost(value)`	`value` (string): ServiceNow instance base URL.	`this`
`getHost()`	None.	Configured host string. Throws if no host is set.
`setBasicAuth(username, password)`	Basic-auth username and password strings.	`this`
`setCredentialsByGUID(guid)`	`guid` (string): credential vault entry, resolved via `CQ.Credentials.getByGUID`.	`this`
`CreateTicket(fields)`	See below.	`IntegrationHTTPResponse`

CreateTicket({summary, description, priority, extra_fields}) creates a ticket in the incident table. extra_fields accepts urgency, impact, category, and assigned_to; all are optional and omitted from the request when not set.

ConnectWise

Method	Parameters	Returns
`setHost(value)`	`value` (string): ConnectWise instance base URL.	`this`
`getHost()`	None.	Configured host string. Throws if no host is set.
`setBasicAuth(username, password)`	Basic-auth strings; ConnectWise expects `username` already formatted as `{companyId}+{publicKey}` and `password` as the private key.	`this`
`setCredentialsByGUID(guid)`	`guid` (string): credential vault entry.	`this`
`setClientId(id)`	`id` (string): ConnectWise `clientId` header.	`this`
`CreateTicket(fields)`	See below.	`IntegrationHTTPResponse`

CreateTicket({summary, description, priority, extra_fields}) creates a service ticket. extra_fields.company_id and extra_fields.company_name are required — the call fails locally (no HTTP request is made) if either is missing. extra_fields.board_id/extra_fields.board_name are optional.

Remedy

Method	Parameters	Returns
`setHost(value)`	`value` (string): Remedy/Helix ITSM base URL.	`this`
`getHost()`	None.	Configured host string. Throws if no host is set.
`setBasicAuth(username, password)`	Username/password used to obtain an AR-JWT session token.	`this`
`setCredentialsByGUID(guid)`	`guid` (string): credential vault entry.	`this`
`CreateTicket(fields)`	See below.	`IntegrationHTTPResponse`

CreateTicket({summary, description, priority, extra_fields}) logs in automatically on first use (form-encoded, obtaining an AR-JWT token that is reused for subsequent calls) and creates an incident. extra_fields accepts urgency, impact, first_name, last_name, assigned_group, and status.