IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  artifacts as input for functions?

    Posted 05/28/20 05:46 AM
    Hi everybody,

    I'm just writing a pyhton script for forwarding malware samples to a remote sandbox. I have now just one problem.

    When I want to implement the script on the integration server... how do I get the malware sample from the Resilient plattform to the integration server. The out of the box input types are only fields.
    Then I thought ... well ok, base64 encode the file forward it as "text" and then the script on the integration server can decode it again... but... when I'm importing base64 Python library I get the "illegal import" error as importing the base64 library is forbidden.

    Is this already an topic for further releases? Or is there any other workaround to pass artifacts or attachments to functions?

    Best,
    Achim

    ------------------------------
    Achim Quehenberger
    ------------------------------


  • 2.  RE: artifacts as input for functions?

    Posted 05/29/20 08:28 AM
    You should be able to import whatever you want on the integration server. If you post screenshots or details of the errors you are seeing it may help.

    You definitely cannot import that using an in product script.

    Ben

    ------------------------------
    Ben Lurie
    ------------------------------



  • 3.  RE: artifacts as input for functions?

    Posted 06/02/20 02:42 AM
    Hello Ben,

    the import on the integration server is not the issue. The issue is, how to get a malware sample as parameter from the plattform to the integration server where my script will be running which sends the sample then to a remote sandbox.

    ------------------------------
    Achim Quehenberger
    ------------------------------



  • 4.  RE: artifacts as input for functions?

    Posted 06/02/20 11:08 AM
    Hi @Achim Quehenberger,

    You'll want to pass the incident ID and attachment ID, and then in your integration server function code do something like:

    from resilient_lib import get_file_attachment  # Will return a byte-string of the file (raw)
    from cStringIO import StringIO # If you need the attachment as a file object


    # Get the file by its incident and attachment ID
    file_data = get_file_attachment(self.rest_client(), incident_id, artifact_id=None, task_id=None, attachment_id=attachment_id)
    file_object = StringIO(file_data) # Need to test this if using, might need tweaks such as encoding.
    ​​​

    ------------------------------
    Jared Fagel
    Cyber Security Analyst I
    Public Utility
    ------------------------------



  • 5.  RE: artifacts as input for functions?

    Posted 06/16/20 07:09 AM
    Edited by Achim Quehenberger 06/16/20 07:11 AM
    UPDATE: solved

    Another question... how do I find out the ID of an artifact?

    I see the id for incidents on the dashboard. But how do I know what id an artifact has belonging to an incident?

    ------------------------------
    Achim Quehenberger
    ------------------------------



  • 6.  RE: artifacts as input for functions?

    Posted 06/17/20 08:42 AM
    Edited by Achim Quehenberger 06/19/20 04:10 AM
    Update: Solved!

    Hm... i installed the package resilient-lib
    I coded the file like you mentioned above...

    But I still get the error:
    NameError: name 'get_file_attachment' is not defined


    ------------------------------
    Achim Quehenberger
    ------------------------------



  • 7.  RE: artifacts as input for functions?

    Posted 09/29/20 12:06 PM
    @Achim Quehenberger  Hi,

    Did you import?from resilient_lib import get_file_attachment ​



    ------------------------------
    Jasmine
    ------------------------------



  • 8.  RE: artifacts as input for functions?

    Posted 09/29/20 12:24 PM
    Hey @Jasmine,

    I believe if you look at my post above, you'll see the answer is yes.​

    ------------------------------
    Jared Fagel
    Cyber Security Analyst I
    Public Utility
    ------------------------------



  • 9.  RE: artifacts as input for functions?

    Posted 09/29/20 12:42 PM
    Hey @Jared Fagel,

    Yes I have mentioned Achim :) for this error
    But I still get the error: NameError: name 'get_file_attachment' is not defined​
    that I see that he has solved the issue. 


    Best​​

    ------------------------------
    Jasmine
    ------------------------------



  • 10.  RE: artifacts as input for functions?

    Posted 09/30/20 01:58 AM
    Hi Jasmine,

    Yes, I solved it because I did the import different.

    I did not do
    from resilient_lib import get_file_attachment

    but did
    import resilient_lib as res_lib

    an then in the code 
    res_lib.get_file_attachment(....)

    For whatever reason this worked then :)

    Best,
    Achim

    ------------------------------
    Achim Quehenberger
    ------------------------------