IBM Security QRadar SOAR

 View Only
  • 1.  Email Attachment

    Posted Tue August 31, 2021 03:41 PM

    Does anyone know how you might be able to export a row / rows from a datatable (tab delimited if possible) and attach them to an outbound email?

    I can get the outbound email, I can get data from the data table into the outbound email, but cannot figure out how to create a file from the datatable and attach it to the email.

    Any thoughts?

    Thank you!

    Brian



    ------------------------------
    Brian Coleman
    ------------------------------


  • 2.  RE: Email Attachment

    IBM Champion
    Posted Thu September 02, 2021 12:25 PM
    Edited by Liam Mahoney Thu September 02, 2021 12:25 PM
    Brian,

    The IBM SOAR Data Table Helper Functions app / integration available on the community might be able to help you out. I'm not sure if the Get Rows function will allow you to specify a wild card / a way to return all rows in the data table.

    If not, you can create a function yourself that will interact with the IBM SOAR API to take in a data table name and then return all of the rows.

    You could then use whichever function satisfies the need within a workflow. The first step of the workflow would be the function to get the data table data, then the second step of the workflow would be the outbound email function that would iterate over the results of the first function within the pre-process script and include that data as the input to the outbound email function.

    Best of luck!

    ------------------------------
    Liam Mahoney
    ------------------------------