topic Re: Custom Web server on XSOAR in Cortex XSOAR Discussions

Custom Web server on XSOAR

Antanas — Thu, 16 Mar 2023 12:15:52 GMT

Hi,

I'ld like to run a simple web server on demand, which would listen for POST requests and put the data posted in a file (or context).

So far I achieved similar by modifying community integration XSOAR-Web-Server, which use long lasting instance mode and creates web server using Python Bottle. Server is started by an integration in a simple oneliner:

run(host='0.0.0.0', port=listen_port, debug=True)

I then deal with POST requests with:

@route('post-uri', method='POST')

def post-uri():

... # write to a file /tmp/data.txt locally

After web server received all the posts, I get the data form the XSOAR file system container ../diff/tmp/data.txt.

Is there a way to access the data from the container using the commands in that integration? Cause at the time the data is collected, there are no incidents associated with it. If i create a new command and try to access /tmp/data.txt - it seem to be executed in different container and does not have access to that file.

Re: Custom Web server on XSOAR

MBeauchamp2 — Thu, 16 Mar 2023 14:35:07 GMT

I think you'd be better off using something like the Generic Webhook integration to receive the post request, and then have the created Incident write the data to a file.

The POST would need to be JSON, but you could then map the data to a field, or drop it to labels. Then have your automation create the file and return it to the war room using the fileResult method (check the script helper)

https://xsoar.pan.dev/docs/reference/integrations/generic-webhook

Re: Custom Web server on XSOAR

Antanas — Wed, 29 Mar 2023 07:11:45 GMT

Thanks @MBeauchamp2 for reply. The problem with your suggestion is that I will get 1 incident per 1 POST. But I'ld like to aggregate all the posts (e.g. 1000 of them) within the timeframe in 1 incident.

Re: Custom Web server on XSOAR

MBeauchamp2 — Wed, 29 Mar 2023 14:17:57 GMT

Then I'd use a preprocessing script to handle that part. And have it add an entry to the first Incident.