IBM Security QRadar SOAR

 View Only

Adding a list of attachments via API

  • 1.  Adding a list of attachments via API

    Posted Tue August 02, 2022 07:50 AM
    Hello everyone,

    we have a system that gives us list of base64 encoded files for SOAR to attach to incidents. The JSON would look like this:

    {
      attach_list:
        {
          attach_name: "file1.eml",
          attach_com: "some text",
          attach_cont: <base64 string>
        }
        {
          attach_name: "file2.docx",
          attach_com: ...
        }
    }

    Is there any way to get this data into an SOAR incident via the API?
    I already tried to make SOAR do a API call to the other system, but this system can't be accessed this way.

    ------------------------------
    Benjamin Walden
    ------------------------------