IBM Security QRadar SOAR

 View Only

  • 1.  Remove all attachments from an incident

    Posted Wed November 30, 2022 12:42 PM
    Friends, I am needing to remove all attachments from an incident when running a playbook.

    The only way I can think of is to do it using the REST API towards the same SOAR searching by attached id and incident id first a GET and then a DEL.

    Any better ideas?

    ------------------------------
    Juan Cruz Del Col
    ------------------------------


  • 2.  RE: Remove all attachments from an incident

    Posted Wed December 07, 2022 01:54 PM
    Any suggestions?

    ------------------------------
    Juan Cruz Del Col
    ------------------------------

    Original Message


  • 3.  RE: Remove all attachments from an incident

    Posted Thu December 08, 2022 08:39 AM
    Using the REST API is the only way I can think of to do this. A script in the playbook does not have functionality like that.

    ------------------------------
    Richard Swierk
    ------------------------------

    Original Message