IBM Security QRadar SOAR

Hi Winnie,

If you don't require the image add to be done through REST once the jpeg image is added as an attachment, then you can simply run the attachment_to_base64 function (from the utilities app) on it, this will convert it to base64, so that in the post-processor of the function you can call results.content to get the base64 string and results.content_type to get the data type (like image/jpeg).

See: https://exchange.xforce.ibmcloud.com/api/hub/extensionsNew/5d24a4af4b149938ab8f7cb462eec46a/fn_utilities-v1.0.10.pdf

Then you can add a rich text note like:

content_type = string(results.content_type.strip())
b64 = string(results.content.strip())
html_image ='<img src="data:' + content_type + ';base64,' + b64 + '">'
helper.createRichText = "Image:<br><br>" + html_image

If you require the image add to be done solely via REST, then the base64 conversion will be required to be done by the script the REST is being called from, similar to the code above.

------------------------------
Jared Fagel
Cyber Security Analyst I
Public Utility
------------------------------

Original Message:
Sent: Wed March 04, 2020 05:52 PM
From: Weiming Bai
Subject: image in rich text via RS REST API

Hi,

I have a customer is asking us to  provide references on the Resilient REST API on how to send an image in rich text to the Notes or Task Instructions (or rich text field). Currently using the resilient client and post to attach the image files as jpeg files. Would like to insert these jpegs directly to the Incident Notes.

Here is a snippet of the current attachment code:

image_ids = dt_parsed['Details']['Images']
        for image_id in image_ids:
            attachImageFile = get_image_by_image_id(image_id)
            LOG.info("attachImageFile: {}".format(attachImageFile))
            postclient.post_attachment("/incidents/{}/attachments".format(incident_id),attachmentsPath + attachImageFile)
            incidentData = "Please find IntSights Alert image file " + attachImageFile + " attached"
            postclient.post('/incidents/{}/comments'.format(incident_id),{'text' : {'format' : 'text', 'content' : incidentData}})


How could we do this?

We have found the file to be attached needs to be converted to BASE64 image data tag. Something like this https://stackoverflow.com/questions/7389567/output-images-to-html-using-python
but customer need the exact the codes.

Could we get some guide or the code example for reference?

Thank you.

Weiming (Winnie) Bai Customer Success Engineer

w: 61294075018 e: weimingb@au1.ibm.com