IBM Security QRadar SOAR

Hi,

I need to get the content of a pdf file in string format. I didn't find an application or Python code that helped me with this case. Can they help me?

Thanks, regards!

Hi,

I need to get the content of a pdf file in string format. I didn't find an application or Python code that helped me with this case. Can they help me?

Thanks, regards!

Greetings,

There is no package ready to extract PDF information into a file, sadly.

But, you could obtain the contents of a PDF file (or any attachment, really) using the REST API Functionality:

https://exchange.xforce.ibmcloud.com/hub/extension/b1e4814282b33a826f36c72cf1bc4751

First, query to get all Incident Attachments using:

​/orgs​/{org_id}​/incidents​/{inc_id}​/attachments

Obtain the ID of the desired attachment, and then get the content using:

​/orgs​/{org_id}​/incidents​/{inc_id}​/attachments​/{attach_id}​/contents

Anyways you should be careful with this approach. Malicious code can be injected into PDF files and then executed upon reading it's contents. I'm not entirely sure if this can be triggered with GET actions specifically for PDS, but nonetheless you should still be cautious if you are going to read external /unsecure files.

Cheers!

Hi,

I need to get the content of a pdf file in string format. I didn't find an application or Python code that helped me with this case. Can they help me?

Thanks, regards!

Hello Pol, I was testing with the indicated function. I cannot obtain the content of the PDF file in plain text, but I can obtain it in JSON. I am attaching screenshots of the Playbook error and the configuration of the "Call REST API" function.

Thanks and regards!

Greetings,

There is no package ready to extract PDF information into a file, sadly.

But, you could obtain the contents of a PDF file (or any attachment, really) using the REST API Functionality:

https://exchange.xforce.ibmcloud.com/hub/extension/b1e4814282b33a826f36c72cf1bc4751

First, query to get all Incident Attachments using:

​/orgs​/{org_id}​/incidents​/{inc_id}​/attachments

Obtain the ID of the desired attachment, and then get the content using:

​/orgs​/{org_id}​/incidents​/{inc_id}​/attachments​/{attach_id}​/contents

Anyways you should be careful with this approach. Malicious code can be injected into PDF files and then executed upon reading it's contents. I'm not entirely sure if this can be triggered with GET actions specifically for PDS, but nonetheless you should still be cautious if you are going to read external /unsecure files.

Cheers!

Hi,

I need to get the content of a pdf file in string format. I didn't find an application or Python code that helped me with this case. Can they help me?

Thanks, regards!