F5 BIG-IP iControl API Integration

August 26, 2025 ยท View on GitHub

Overview

This integration allows you to interact with F5 BIG-IP devices using the iControl REST API. It provides actions to manage network objects like data groups (address lists, port lists) and iRules.

Configuration

The configuration for this integration (BIG-IP address, username, password) is managed within the SOAR platform's Marketplace tab. The actions utilize these pre-configured settings.

Actions

Add IP To Data Group

Add IP addresses to an internal data group in F5 BIG-IP.

Arguments:

  • case_id (string, required): The ID of the case.
  • alert_group_identifiers (List[string], required): Identifiers for the alert groups.
  • data_group_name (string, required): Specify the name of the data group to which you want to add IP addresses.
  • target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on. Supports IP address entities.
  • scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

  • dict: A dictionary containing the result of the action execution.

Create Data Group

Create an internal data group in F5 BIG-IP.

Arguments:

  • case_id (string, required): The ID of the case.
  • alert_group_identifiers (List[string], required): Identifiers for the alert groups.
  • type (List[str], required): Specify the type for the data group (e.g., ip, string).
  • name (string, required): Specify the name of the data group that needs to be created.
  • target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on.
  • scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

  • dict: A dictionary containing the result of the action execution.

Add IP To Address List

Add IP addresses to an address list in F5 BIG-IP.

Arguments:

  • case_id (string, required): The ID of the case.
  • alert_group_identifiers (List[string], required): Identifiers for the alert groups.
  • address_list_name (string, required): Specify the name of the address list to which you want to add IP addresses.
  • target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on. Supports IP address entities.
  • scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

  • dict: A dictionary containing the result of the action execution.

Add Port To Port List

Add ports to a port list in F5 BIG-IP.

Arguments:

  • case_id (string, required): The ID of the case.
  • alert_group_identifiers (List[string], required): Identifiers for the alert groups.
  • port_list_name (string, required): Specify the name of the port list to which you want to add ports.
  • ports (string, required): Specify a comma-separated list of ports that need to be added.
  • target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on.
  • scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

  • dict: A dictionary containing the result of the action execution.

Remove Port From Port List

Remove ports from a port list in F5 BIG-IP.

Arguments:

  • case_id (string, required): The ID of the case.
  • alert_group_identifiers (List[string], required): Identifiers for the alert groups.
  • port_list_name (string, required): Specify the name of the port list from which you want to remove ports.
  • ports (string, required): Specify a comma-separated list of ports that need to be removed.
  • target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on.
  • scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

  • dict: A dictionary containing the result of the action execution.

Create iRule

Create an iRule in F5 BIG-IP.

Arguments:

  • case_id (string, required): The ID of the case.
  • alert_group_identifiers (List[string], required): Identifiers for the alert groups.
  • name (string, required): Specify the name of the iRule that needs to be created.
  • rule (string, required): Specify the rule (TCL script content) that needs to be executed.
  • target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on.
  • scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

  • dict: A dictionary containing the result of the action execution.

List Address Lists

List available address lists in F5 BIG-IP.

Arguments:

  • case_id (string, required): The ID of the case.
  • alert_group_identifiers (List[string], required): Identifiers for the alert groups.
  • filter_logic (List[str], optional): Specify what filter logic should be applied (e.g., Equal, Contains).
  • filter_value (string, optional): Specify what value should be used in the filter. Filtering is based on the address list name.
  • max_address_lists_to_return (string, optional): Specify how many address lists to return. Default: 50.
  • target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on.
  • scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

  • dict: A dictionary containing the result of the action execution, including the list of address lists.

Update iRule

Update an existing iRule in F5 BIG-IP.

Arguments:

  • case_id (string, required): The ID of the case.
  • alert_group_identifiers (List[string], required): Identifiers for the alert groups.
  • name (string, required): Specify the name of the iRule that needs to be updated.
  • rule (string, required): Specify the new rule (TCL script content) that needs to be executed.
  • target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on.
  • scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

  • dict: A dictionary containing the result of the action execution.

Remove IP From Address List

Remove IP addresses from an address list in F5 BIG-IP.

Arguments:

  • case_id (string, required): The ID of the case.
  • alert_group_identifiers (List[string], required): Identifiers for the alert groups.
  • address_list_name (string, required): Specify the name of the address list from which you want to remove IP addresses.
  • target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on. Supports IP address entities.
  • scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

  • dict: A dictionary containing the result of the action execution.

Delete iRule

Delete an iRule in F5 BIG-IP.

Arguments:

  • case_id (string, required): The ID of the case.
  • alert_group_identifiers (List[string], required): Identifiers for the alert groups.
  • name (string, required): Specify the name of the iRule that needs to be deleted.
  • target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on.
  • scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

  • dict: A dictionary containing the result of the action execution.

Ping

Test connectivity to the F5 BIG-IP with parameters provided at the integration configuration page on the Marketplace tab.

Arguments:

  • case_id (string, required): The ID of the case.
  • alert_group_identifiers (List[string], required): Identifiers for the alert groups.
  • target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on.
  • scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

  • dict: A dictionary containing the result of the action execution.

Delete Data Group

Delete an internal data group in F5 BIG-IP.

Arguments:

  • case_id (string, required): The ID of the case.
  • alert_group_identifiers (List[string], required): Identifiers for the alert groups.
  • name (string, required): Specify the name of the data group that needs to be deleted.
  • target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on.
  • scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

  • dict: A dictionary containing the result of the action execution.

Create Address List

Create an address list in F5 BIG-IP. Note: address list requires at least one IP address entity in scope during creation.

Arguments:

  • case_id (string, required): The ID of the case.
  • alert_group_identifiers (List[string], required): Identifiers for the alert groups.
  • name (string, required): Specify the name of the address list that needs to be created.
  • target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on. Requires at least one IP address entity.
  • scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

  • dict: A dictionary containing the result of the action execution.

List Port Lists

List available port lists in F5 BIG-IP.

Arguments:

  • case_id (string, required): The ID of the case.
  • alert_group_identifiers (List[string], required): Identifiers for the alert groups.
  • filter_logic (List[str], optional): Specify what filter logic should be applied (e.g., Equal, Contains).
  • filter_value (string, optional): Specify what value should be used in the filter. Filtering is based on the port list name.
  • max_port_lists_to_return (string, optional): Specify how many port lists to return. Default: 50.
  • target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on.
  • scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

  • dict: A dictionary containing the result of the action execution, including the list of port lists.

Create Port List

Create a port list in F5 BIG-IP.

Arguments:

  • case_id (string, required): The ID of the case.
  • alert_group_identifiers (List[string], required): Identifiers for the alert groups.
  • name (string, required): Specify the name of the port list that needs to be created. Note: name shouldn't contain whitespace. This is F5 BIG-IP limitation.
  • ports (string, required): Specify a comma-separated list of ports that will be a part of the new port list.
  • target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on.
  • scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

  • dict: A dictionary containing the result of the action execution.

Delete Port List

Delete a port list in F5 BIG-IP.

Arguments:

  • case_id (string, required): The ID of the case.
  • alert_group_identifiers (List[string], required): Identifiers for the alert groups.
  • name (string, required): Specify the name of the port list that needs to be deleted.
  • target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on.
  • scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

  • dict: A dictionary containing the result of the action execution.

Delete Address List

Delete an address list in F5 BIG-IP.

Arguments:

  • case_id (string, required): The ID of the case.
  • alert_group_identifiers (List[string], required): Identifiers for the alert groups.
  • name (string, required): Specify the name of the address list that needs to be deleted.
  • target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on.
  • scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

  • dict: A dictionary containing the result of the action execution.

List iRules

List available iRules in F5 BIG-IP.

Arguments:

  • case_id (string, required): The ID of the case.
  • alert_group_identifiers (List[string], required): Identifiers for the alert groups.
  • filter_logic (List[str], optional): Specify what filter logic should be applied (e.g., Equal, Contains).
  • filter_value (string, optional): Specify what value should be used in the filter. Filtering is based on the iRule name.
  • max_i_rules_to_return (string, optional): Specify how many iRules to return. Default: 50.
  • target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on.
  • scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

  • dict: A dictionary containing the result of the action execution, including the list of iRules.

List Data Groups

List available internal data groups in F5 BIG-IP.

Arguments:

  • case_id (string, required): The ID of the case.
  • alert_group_identifiers (List[string], required): Identifiers for the alert groups.
  • filter_logic (List[str], optional): Specify what filter logic should be applied (e.g., Equal, Contains).
  • filter_value (string, optional): Specify what value should be used in the filter. Filtering is based on the data group name.
  • max_data_groups_to_return (string, optional): Specify how many data groups to return. Default: 50.
  • target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on.
  • scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

  • dict: A dictionary containing the result of the action execution, including the list of data groups.

Remove IP From Data Group

Remove IP addresses from an internal data group in F5 BIG-IP.

Arguments:

  • case_id (string, required): The ID of the case.
  • alert_group_identifiers (List[string], required): Identifiers for the alert groups.
  • data_group_name (string, required): Specify the name of the data group from which you want to remove IP addresses.
  • target_entities (List[TargetEntity], optional): Optional list of specific target entities (Identifier, EntityType) to run the action on. Supports IP address entities.
  • scope (string, optional): Defines the scope for the action. Defaults to "All entities".

Returns:

  • dict: A dictionary containing the result of the action execution.

Notes

  • Ensure the F5 BIG-IP iControl API integration is properly configured in the SOAR Marketplace tab.
  • Some actions only support internal data groups.
  • Creating an address list requires at least one IP address entity in scope.
  • Port list names cannot contain whitespace due to F5 BIG-IP limitations.