Hi Jasmine,
Yes, I solved it because I did the import different.
I did not do
from resilient_lib import get_file_attachment
but did
import resilient_lib as res_lib
an then in the code
res_lib.get_file_attachment(....)
For whatever reason this worked then :)
Best,
Achim
------------------------------
Achim Quehenberger
------------------------------
Original Message:
Sent: Tue September 29, 2020 12:42 PM
From: Jasmine
Subject: artifacts as input for functions?
Hey @Jared Fagel,
Yes I have mentioned Achim :) for this error
But I still get the error:NameError: name 'get_file_attachment' is not defined
that I see that he has solved the issue.
Best
------------------------------
Jasmine
------------------------------
Original Message:
Sent: Tue September 29, 2020 12:24 PM
From: Jared Fagel
Subject: artifacts as input for functions?
Hey @Jasmine,
I believe if you look at my post above, you'll see the answer is yes.
------------------------------
Jared Fagel
Cyber Security Analyst I
Public Utility
Original Message:
Sent: Tue September 29, 2020 12:06 PM
From: Jasmine
Subject: artifacts as input for functions?
@Achim Quehenberger Hi,
Did you import?from resilient_lib import get_file_attachment
------------------------------
Jasmine
Original Message:
Sent: Wed June 17, 2020 08:41 AM
From: Achim Quehenberger
Subject: artifacts as input for functions?
Update: Solved!
Hm... i installed the package resilient-lib
I coded the file like you mentioned above...
But I still get the error:
NameError: name 'get_file_attachment' is not defined
------------------------------
Achim Quehenberger
Original Message:
Sent: Tue June 16, 2020 07:09 AM
From: Achim Quehenberger
Subject: artifacts as input for functions?
UPDATE: solved
Another question... how do I find out the ID of an artifact?
I see the id for incidents on the dashboard. But how do I know what id an artifact has belonging to an incident?
------------------------------
Achim Quehenberger
Original Message:
Sent: Tue June 02, 2020 11:08 AM
From: Jared Fagel
Subject: artifacts as input for functions?
Hi @Achim Quehenberger,
You'll want to pass the incident ID and attachment ID, and then in your integration server function code do something like:
from resilient_lib import get_file_attachment # Will return a byte-string of the file (raw)
from cStringIO import StringIO # If you need the attachment as a file object
# Get the file by its incident and attachment ID
file_data = get_file_attachment(self.rest_client(), incident_id, artifact_id=None, task_id=None, attachment_id=attachment_id)
file_object = StringIO(file_data) # Need to test this if using, might need tweaks such as encoding.
------------------------------
Jared Fagel
Cyber Security Analyst I
Public Utility
Original Message:
Sent: Tue June 02, 2020 02:41 AM
From: Achim Quehenberger
Subject: artifacts as input for functions?
Hello Ben,
the import on the integration server is not the issue. The issue is, how to get a malware sample as parameter from the plattform to the integration server where my script will be running which sends the sample then to a remote sandbox.
------------------------------
Achim Quehenberger
Original Message:
Sent: Fri May 29, 2020 08:27 AM
From: Ben Lurie
Subject: artifacts as input for functions?
You should be able to import whatever you want on the integration server. If you post screenshots or details of the errors you are seeing it may help.
You definitely cannot import that using an in product script.
Ben
------------------------------
Ben Lurie