IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Remove all attachments from an incident

    Posted Wed November 30, 2022 12:42 PM
    Friends, I am needing to remove all attachments from an incident when running a playbook.

    The only way I can think of is to do it using the REST API towards the same SOAR searching by attached id and incident id first a GET and then a DEL.

    Any better ideas?

    ------------------------------
    Juan Cruz Del Col
    ------------------------------


  • 2.  RE: Remove all attachments from an incident

    Posted Wed December 07, 2022 01:54 PM
    Any suggestions?

    ------------------------------
    Juan Cruz Del Col
    ------------------------------

    Original Message


  • 3.  RE: Remove all attachments from an incident

    Posted Thu December 08, 2022 08:39 AM
    Using the REST API is the only way I can think of to do this. A script in the playbook does not have functionality like that.

    ------------------------------
    Richard Swierk
    ------------------------------

    Original Message


Related Content