IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  Posting attachments to Resilient via API

    Posted 03/22/19 09:18 AM
    Hello team,

    I am currently customizing a Resilient script to integrate an attachment posting to the incident. Things go well when it comes to post a string, but as soon as I work with a file, things get more complicated:

    Here is the piece of code that does the job:

    **********************************************************************************

        yield StatusMessage("Attaching Json report to Resilient...")
        with tempfile.NamedTemporaryFile() as temp_file:

             try:

                  temp_file.write(urlscanio_report_json)

                  temp_file.close()

              #create new attachment

                 attachment_uri = "/incidents/{0}/attachments".format(urlscanio_incident_id)

                # POST the new attachment

                new_attachment = client.post_attachment(attachment_uri, temp_file.name, filename=file_name, co3_context_token=event.context)

           finally:

               os.unlink(temp_file.name)

    **********************************************************************************

    I get the following error when I put no arguments in  tempfile.NamedTemporaryFile() :

    FunctionException_: <Traceback (most recent call last): File "/usr/share/integration/components/fn_urlscanio/fn_urlscanio/components/urlscanio.py", line 134, in _urlscanio_function os.unlink(temp_file.name) File "/usr/local/lib/python2.7/tempfile.py", line 440, in __exit__ self.close() File "/usr/local/lib/python2.7/tempfile.py", line 431, in close self.unlink(self.name) OSError: [Errno 2] No such file or directory: '/tmp/tmpNbtH2X' > File "/usr/local/lib/python2.7/site-packages/circuits/core/manager.py", line 856, in processTask raise value.extract()


    Then I try it out with the following arguments:
    with tempfile.NamedTemporaryFile(mode="w+b", delete=False) as temp_file


    I get the following error:

    TypeError: argument 1 must be string or buffer, not dict > File "/usr/local/lib/python2.7/site-packages/circuits/core/manager.py", line 856, in processTask raise value.extract()


    In the piece of code abovee, I am trying to write a Json report retrieved earlier in the script (urlscanio_report_json) in a temprory zone.

    Is there a right way to write this statement?

    I am suspecting the error lies in the parameters I pass to tempfile.NamedTemporaryFile() function, but can't put a finger on whatgoes wrong. Any idea?

    Thanks in advance for the help.

    Z.S.



  • 2.  RE: Posting attachments to Resilient via API

    Posted 03/22/19 04:19 PM
    The second approach is better. If you don't set delete=False, when you call temp_file.close(), the temp file created will be removed. Then you can't use it later.

    Your second error might be caused by something else.

    Yongjian

    ------------------------------
    Yongjian Feng
    ------------------------------



  • 3.  RE: Posting attachments to Resilient via API

    Posted 03/27/19 05:21 AM
    ​Hi,

    I actually just had to replace this line:

    temp_file.write(urlscanio_report_json)

    with the following line:
    temp_file.write(str(urlscanio_report_json).encode("utf-8"))

    And it worked like a charm.

    Regards,

    Zohra SMAIL

    ------------------------------
    Zohra SMAIL
    ------------------------------



  • 4.  RE: Posting attachments to Resilient via API

    Posted 03/27/19 09:26 AM
    I see. Some unicode in the content. It is great that you can figure it now.

    ------------------------------
    Yongjian Feng
    ------------------------------