IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  How to read attachment in Resilient function ?

    Posted 01/13/23 09:37 AM
    I have incident and attachment id as inputs to function, how I can get attachment file itself parse its content?

    I know resilient_lib.get_file_attachment but my understanding is that this is for external scripts hitting resilient api

    ------------------------------
    Irek Romaniuk
    ------------------------------


  • 2.  RE: How to read attachment in Resilient function ?

    Posted 11/27/23 11:55 AM

    Did you maybe manage to figure out how to do this? I'm looking for a way to parse an attached email.



    ------------------------------
    Maria Čapkovska
    ------------------------------



  • 3.  RE: How to read attachment in Resilient function ?

    Posted 01/11/24 02:23 PM

    Do you know how to get attachment file itself parse its content? I met same requirement.



    ------------------------------
    Sheng Bo Feng
    ------------------------------

    Original Message


  • 4.  RE: How to read attachment in Resilient function ?

    Posted 01/11/24 02:23 PM

    Do you know how to get attachment file itself in SOAR script? I want to send it to sandbox for anysis.



    ------------------------------
    Sheng Bo Feng
    ------------------------------

    Original Message


  • 5.  RE: How to read attachment in Resilient function ?

    Posted 01/12/24 02:58 AM

    I'm not sure if this is what you meant, but in my email parsing script I have this snippet:

    This adds the attachments from an email in the attachments tab in the incident and then you can make a playbook with either automatic or manual activation from an attachment. I haven't tried sending an attachment to a sandbox yet but it does work with getting attachment hashes. 



    ------------------------------
    Maria Czapkowska
    ------------------------------

    Original Message


Related Content