IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Attachment from remote computer

    Posted 05/31/22 02:56 AM
    Hello,

    There is a way how I can add an attachment from remote computer (Windows) to the incident? I asks about existed function or way to do it, not about development my own script/method.

    I use Utility Function (Shell Command) to execute some PowerShell scripts on remote computer and regarding to documentation results of the execution can be added to incident as file attachments, artifacts, data tables and etc. Maybe is possible to add an attachment this way and no modify the file artifacts?



    ------------------------------
    Alexey Fedorov
    ------------------------------


  • 2.  RE: Attachment from remote computer

    Posted 06/01/22 07:35 AM
    Hi Alexey,

    There is nothing specific to the Shell Command function for creating file attachments, artifacts, etc. However, the results of the shell command are returned to the workflow/playbook and from there you could parse the content and use the scripting commands such as incident.addAttachment() or incident.addArtifact(). This does require script development on your part, which I don't see any alternative.

    Hope this helps,
    Mark

    ------------------------------
    Mark Scherfling
    ------------------------------



  • 3.  RE: Attachment from remote computer

    Posted 06/01/22 08:02 AM
    Hello Mark,

    I found an alternative:

    1. Shell Function: PowerShell Get-Content and convert to ToBase64String.
    2. Base64 to Attachment Function

    Totally I have docx file attachment to my incident.

    ------------------------------
    Alexey Fedorov
    ------------------------------



  • 4.  RE: Attachment from remote computer

    Posted 06/21/22 07:36 AM
    Hello Mark,

    The output result of Shell Command can't exceed 5 Mb. Sometimes I need to attach file more than 10 Mb and even 30 Mb.
    Is it possible to increase a size of output result of Shell Command or maybe you can recommend another way how I can add attachments from remote computer automatically?

    ------------------------------
    Alexey Fedorov
    ------------------------------