IBM Security QRadar SOAR

 View Only
Expand all | Collapse all

Delete an Attachment by name if it exists previously

  • 1.  Delete an Attachment by name if it exists previously

    Posted Thu February 20, 2020 10:40 AM
    I have a function which uploads the screenshot of a web-page to an incident as an attachment. The name of the attachment is a unique ID which will always be the same for one web-page. The problem is that when the function runs again for a same webpage, a new file is added to the attachments with the same name instead of overwriting the previous already existing.

    What I want to do is that my function should first check whether a file of similar name already exists in the attachments, if yes, then it should delete it before uploading it again. But so far, I haven't found a way to check if an attachment already exists, by name, and then delete it.

    Can someone point me towards the REST API Endpoints to achieve the above or if there is some other workaround for achieve my objective? 

    Thanks!

    ------------------------------
    Umair Ahmed
    ------------------------------


  • 2.  RE: Delete an Attachment by name if it exists previously

    Posted Thu March 12, 2020 10:21 AM
    You can definitely work that in Rest API

    using the RestAPI command /orgs/{org_id}/incidents/{inc_id}/attachments you will get a JSON containing all attachments starting like :
    [ { "type": "incident", "id": 453, "uuid": "69f6be50-1379-4e43-9773-ae653e06fc13", "name": "url_screenshot_2722.png", "content_type": "image/png", "created": 1583493089328, "creator_id": 48, "size": 288199, "actions......
    and then compare all "name" to the one you wish to attach... or not.




    ------------------------------
    BENOIT ROSTAGNI
    ------------------------------

    Original Message