IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

Successful curl POST to attach a file to an incident

  • 1.  Successful curl POST to attach a file to an incident

    Posted Mon February 27, 2023 01:33 AM

    This is just a small note to myself when experienced the same again.

    When I use curl to post an attachment to an incident via API, parameter must be the file. I used many hours to learn this.

    curl -k -u id:secret -X POST -F file1=@./filename.yml https://cases-rest.hostname/rest/orgs/201/incidents/2324/attachments fails with {"success":false,"title":null,"message":"Internal Server Error","hints":[],"error_code":"generic"}

    curl -k -u id:secret -X POST -F file=@./filename.yml https://cases-rest.hostname/rest/orgs/201/incidents/2324/attachments succeeds.

    # resilient lib's post_attachment() does this correctly of course. I used Burp Suite proxy to see the difference and still used many hours to notice...



    ------------------------------
    Katsuyuki Hirayama
    ------------------------------


Related Content