IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Remove all attachments from an incident

    Posted 11/30/22 12:42 PM
    Friends, I am needing to remove all attachments from an incident when running a playbook.

    The only way I can think of is to do it using the REST API towards the same SOAR searching by attached id and incident id first a GET and then a DEL.

    Any better ideas?

    ------------------------------
    Juan Cruz Del Col
    ------------------------------


  • 2.  RE: Remove all attachments from an incident

    Posted 12/07/22 01:54 PM
    Any suggestions?

    ------------------------------
    Juan Cruz Del Col
    ------------------------------



  • 3.  RE: Remove all attachments from an incident

    Posted 12/08/22 08:39 AM
    Using the REST API is the only way I can think of to do this. A script in the playbook does not have functionality like that.

    ------------------------------
    Richard Swierk
    ------------------------------

    Original Message


Related Content