topic How to upload CSV string containing \n to XSOAR? in Cortex XSOAR Discussions

How to upload CSV string containing \n to XSOAR?

T.Jagielski — Wed, 18 Sep 2024 15:50:17 GMT

Hello all,

We're writing a custom playbook in that queries Splunk and returns data. The data we receive back from Splunk (via a self-written XSOAR automation, in Python) gets returned as an XML field containing a string that represents a flat CSV file. The \n character sequence (newline) gets added by Splunk to delimit each new line. When prototyping this code via a test incident and using the FileCreateAndUploadV2 command, it errors when the data parameter contains this escape sequence. What is the best way to wrangle the CSV data into an attachment?

Best!

Re: How to upload CSV string containing \n to XSOAR?

T.Jagielski — Thu, 19 Sep 2024 13:42:50 GMT

Update: Part of this issue has been resolved by not using the war room to prototype anymore. The command still persists with the invalid escape sequence error when including \n, however this is not true when using shift+enter to manually insert a linebreak into the markdown field.

Since this will live in an automation, there's been success with using Python string literals to include linebreaks and submit them to the FileCreateAndUploadV2 command, which is then executed using demisto.executeCommand().

Re: How to upload CSV string containing \n to XSOAR?

T.Jagielski — Mon, 23 Sep 2024 09:47:31 GMT

PEBKAC -- Found that passing in the data= argument to the FileCreateAndUploadV2 command can be arbitrary when used from within an automation. The string we passed to it be formatted in whichever way necessary. Getting a CSV with or without newlines is accepted when done via Python scripting. This works as intended for us now.