IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  Post processing result to Attachment

    Posted 04/06/20 11:47 AM
    Hi

    How can I post my post-process result to attachments ? I mean, is there a way that crates automatically a file with my content ?
    Is there any function at which I pass my results to call ?

    Thanks

    ------------------------------
    Lucian Sipos
    ------------------------------


  • 2.  RE: Post processing result to Attachment

    Posted 04/07/20 09:53 AM
    I have no direct answers that other may put below, but have a look at URL SCANIO integration (from app exchange) who is attaching the image of the website as an attachment in Resilient. It may give you ideas to respond to your questions.
    PS : do not hesitate to put back here how you succedd !

    ------------------------------
    BENOIT ROSTAGNI
    ------------------------------



  • 3.  RE: Post processing result to Attachment

    Posted 04/07/20 10:04 AM
    Edited by Lucian Sipos 04/07/20 10:04 AM
    I managed to do it from a Shell command script, something like this:

    filename = "/opt/rh/python27/root/usr/lib/python2.7/site-packages/shell_runner/scripts/MyScript/{}".format(value)
    with open(filename, "w") as sightings_file:
        sightings_file.write(result)

    create_sightings_attachment = client.post_attachment('/incidents/{}/attachments'.format(inc_id), filename, filename=value)

    # dopo averlo caricato come attachment, lo rimuovo dalla cartella principale
    os.unlink(filename)

    ------------------------------
    Lucian Sipos
    ------------------------------