topic Re: Add a screenshot to indicator layout using rasterize url in Cortex XSOAR Discussions

Add a screenshot to indicator layout using rasterize url

NickyR — Wed, 22 Feb 2023 01:29:58 GMT

Currently using rasterize url to add screenshots to incidents, any way to do the same for indicators?

Thanks for any help

Re: Add a screenshot to indicator layout using rasterize url

asawyer — Fri, 14 Apr 2023 23:43:08 GMT

Hi @NickyR – There is no straightforward way to do this for indicators, because indicators do not have an investigation (with a War Room, ability to store files, etc.) like incidents do.

However, it is possible to work around this by combining an indicator general purpose dynamic section script in the indicator layout with `rasterize` screenshots pulled from incidents. The workflow would be:

Run rasterization of URLs in incidents
Tag rasterize results with tag "rasterize"
Create an indicator general purpose dynamic section script and add a section to run it in the URL indicator layout
The general purpose dynamic section script does the following:
1. Get incident IDs associated with the indicator
2. Iterate over those incident IDs to see if they have any entries tagged with "rasterize". (Be mindful of the risk of overloading the server if some indicators are associated with an excessive number of incidents. The attached sample code cuts off after 10 incidents max for this reason.)
3. If yes, grab the rasterization screenshot from the incident and display it using markdown

Please see the attached sample code for the general purpose dynamic section script. Be sure to test on dev first and use at your own risk!

Re: Add a screenshot to indicator layout using rasterize url

NickyR — Wed, 19 Apr 2023 19:37:19 GMT

@asawyer you're incredible. Already had tags going for this with little to no tweaks in that script it worked perfectly. I really appreciate your response and helping me out! Thank you

Re: Add a screenshot to indicator layout using rasterize url

NickyR — Thu, 20 Apr 2023 14:12:46 GMT

@asawyer so this works cause I had the rasterization run in the playbook per incident so that file is stored can can be retrieved. But say I want to get a screenshot/rasterize in this script to display content every time that script is ran(after the incident is closed), not just from the incident but the present content of the site, you have a rough idea how to approach?

Re: Add a screenshot to indicator layout using rasterize url

NickyR — Tue, 25 Apr 2023 01:29:13 GMT

Think I got it! Basically just created a single step playbook with rasterize URL. Within the automation script I would reopen the case and then setPlaybook to that new basic playbook and grab that tagged png entity.

Re: Add a screenshot to indicator layout using rasterize url

asawyer — Mon, 01 May 2023 23:53:38 GMT

Nice! With the limitation of indicators not having an investigation like incidents do, I think that is the cleanest possible approach.