Save Files From Playbooks or Events to IR Attachment
Saves files that selected from playbooks or events using IDs to IR Attachment.
Reader Note
Please note that this command is only applicable within an incident Playbook.
Implementation | System |
Command Category | System Utility |
Tags | INCIDENT INCIDENT ATTACHMENT |
Inputs
Parameter Name | Required/Optional | Description | Sample Data |
---|---|---|---|
ID Array | Optional | The array of IDs of files to save to IR Attachment. |
CODE
|
Table Name | Optional | The table name in which the files are. |
|
Output
Remote Command API
The D3 command API allows you to send requests to D3 SOAR to execute this utility command via REST API.
Request
POST
https:/{base_url}/{api_namespace}/api/Command/SaveToIRAttachmentFromTables
Headers
Please refer to the page Webhook Configuration Guide - Authentication Method: API Keys for more details.
Request Body
{
"Username": "<Username here>",
"Site": "<Site here>",
"CommandParams": {
"ID Array": "<ID Array here>",
"Table Name": "<Table Name here>"
}
}
Body Parameters
Parameter Name | Type | Required/Optional | Description |
---|---|---|---|
Username |
| Required | The username of your D3 SOAR account. |
Site |
| Required | The D3 SOAR site to run the remote command. |
ID Array |
| Optional | The array of IDs of files to save to IR Attachment. |
Table Name |
| Optional | The table name in which the files are. |
Sample Request
SAMPLE DATA
{
"Username": "Admin",
"Site": "Security Operations",
"CommandParams": {
"ID Array": [
"237"
],
"Table Name": "PB_FILE"
}
}
Response
Response Fields
Field Name | Type | Description |
---|---|---|
error |
| The error message if the API request has failed. |
returnData |
| The return data from the API request. |
contextData |
| The context data from the API request. |
Sample Response
{
"error": "",
"returnData": "Succeed",
"contextData": [
{
"originalFileID": 237,
"newFileID": 918,
"fileName": "IR-20200119-276920200119104501.pdf",
"description": "Summary IR Report IR-20200528-6620200527133229.pdf.",
"MD5": "a166ff37ca915314ec0d4ecbfda4c0fc",
"SHA1": "b1038aeda87dd7f4494e42006f3da99469d7973c",
"SHA256": "fa0d1f2998a2cd6a5e48e508f2e05b13ad2053ee5f3e2d56cc8e7924df5b0b74"
}
]
}