IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

Adding a list of attachments via API

  • 1.  Adding a list of attachments via API

    Posted 08/02/22 07:50 AM
    Hello everyone,

    we have a system that gives us list of base64 encoded files for SOAR to attach to incidents. The JSON would look like this:

    {
      attach_list:
        {
          attach_name: "file1.eml",
          attach_com: "some text",
          attach_cont: <base64 string>
        }
        {
          attach_name: "file2.docx",
          attach_com: ...
        }
    }

    Is there any way to get this data into an SOAR incident via the API?
    I already tried to make SOAR do a API call to the other system, but this system can't be accessed this way.

    ------------------------------
    Benjamin Walden
    ------------------------------


Related Content