IBM Security QRadar

 View Only
  • 1.  URLScan.io no report

    Posted Wed July 15, 2020 05:13 AM
    Hi All,
    After the action successfully ran this is what in the description of the artifact:
    URLScan Report: None

    And also where can I implement the  Base64 to Attachment function with the followng pre‑processing script?:
    inputs.base64content = workflow.properties.urlscanio.png_file
    inputs.content_type = "image/png"
    inputs.file_name = "url_screenshot_{}.png".format(artifact.id)
    inputs.incident_id = str(incident.id)

    Thank you.

    Adam


    ------------------------------
    Adam
    ------------------------------


  • 2.  RE: URLScan.io no report

    Posted Thu July 16, 2020 04:39 AM
    Actually the screenshots appear as attachments but in the Description is  URLScan Report: None.

    ------------------------------
    Adam
    ------------------------------



  • 3.  RE: URLScan.io no report

    Posted Fri July 17, 2020 09:50 AM
    Hi Adam,

    What version if fn_urlscanio are you using? URLScan.io does not update the artifact description by default. The python code creates an attachment on the incident. If you want, you could utilize the results object in the post-processing script to update the incident description. You could pass any of the fields in this result to base64 to attachment, like "png_base64content."

    # The result contains,
    # {
    #   "png_url": the URL of the screenshot image
    #   "png_base64content": the base64-encoded screenshot (PNG)
    #   "report_url": the URL of the JSON report_url
    #   "report": the JSON report, which will contain lots of detail of the page analysis (see urlscan.io for details).
    # }​


    ------------------------------
    Brian Reid
    ------------------------------



  • 4.  RE: URLScan.io no report

    Posted Mon September 14, 2020 01:24 PM
    Bumping an old post but im having a similar issue. The documentation for this integration from the app exchange site includes some instruction to add the "Report URL" to the artifact's description, which i instead pointed to a custom field, and it worked fine up until the latest update (released May 2020). Now whenever the action completes, the report url doesnt appear anymore. 

    Any thoughts?

    ------------------------------
    Wub a lub a dub dub!
    ------------------------------



  • 5.  RE: URLScan.io no report

    Posted Mon September 14, 2020 04:46 PM
    Hi William,

    Are there any errors in the app.log when you run the integration?
    Can you share the output?

    Can you share any code that you have changed?

    AnnMarie

    ------------------------------
    AnnMarie Norcross
    ------------------------------



  • 6.  RE: URLScan.io no report

    Posted Tue April 12, 2022 01:45 PM
    Hi Team 

    I'm facing the same issue where the URLSCANIO report is not generating. I currently running a version 1.1.5 on App-Host

    ------------------------------
    Fawad Majid
    ------------------------------