IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Expand all | Collapse all

(IBM Soar v35) Exporting attachments via API

  • 1.  (IBM Soar v35) Exporting attachments via API

    Posted Mon February 14, 2022 04:34 PM

    We're trying to export attachments related to incidents via REST API from IBM SOAR/Resilient to another tool. But it seems that the /orgs/{org_id}/incidents/{inc_id}/attachments/{attach_id}/contents API endpoint only takes the "content-type": "application/json" header. How would we be able to export attachemnt files that are not text based from SOAR/Resilient to somewhere else via only REST API?


    #SupportMigration
    #Support
    #QradarSOAR


  • 2.  RE: (IBM Soar v35) Exporting attachments via API

    Posted Tue March 08, 2022 04:41 PM

    You need to perform a GET on the /contents API. This will allow you to read a content-type/octet-stream and write it to file.


    #Support
    #SupportMigration
    #QradarSOAR