IBM Security QRadar SOAR

 View Only
Expand all | Collapse all

Query on incident attachments contents API : /orgs/{org_id}/incidents/{inc_id}/attachments/{attachment_id}/contents

  • 1.  Query on incident attachments contents API : /orgs/{org_id}/incidents/{inc_id}/attachments/{attachment_id}/contents

    Posted Thu June 02, 2022 02:11 AM
    I am working on a custom AppHost app, in one of the function I need to download one attachment file from resilient. Found "/orgs/{org_id}/incidents/{inc_id}/attachments/{attachment_id}/contents" API to do that, was successfully able to test that through interactive API and noticed that in the API's respone body, we have "Download file" link. 

    So now, my query is when I use this API in my custom AppHost app's function, where will this file gets downloaded? I mainly looking for the downloaded file's path.
    Please let me know if there is any documentation or example that I can refer.

    Thank you in advance. 


    ------------------------------
    Meghana Medasani
    ------------------------------


  • 2.  RE: Query on incident attachments contents API : /orgs/{org_id}/incidents/{inc_id}/attachments/{attachment_id}/contents

    Posted Fri June 03, 2022 08:03 AM
    Hi Meghana,

    Take a look at our resilient-lib package for useful functions. Specifically, we have functions get_file_attachment and get_file_attachment_metadata. You find other useful methods here as well as other methods in the resilient package you can import into your apps: https://pages.github.ibm.com/Resilient/resilient-python-api/pages/resilient-lib/resilient-lib.html.

    Good luck

    ------------------------------
    Mark Scherfling
    ------------------------------

    Original Message