topic Re: Issue with Retrieving Entry ID for Files Attached to ServiceNow Tickets in Cortex XSOAR in Cortex XSOAR Discussions

Issue with Retrieving Entry ID for Files Attached to ServiceNow Tickets in Cortex XSOAR

Wassif — Thu, 21 Dec 2023 11:04:49 GMT

We encountered a persistent issue in Cortex XSOAR when trying to retrieve the entry ID for files attached to incidents imported from a ServiceNow instance. Our objective was to access and process an Excel file attached to a ServiceNow ticket within XSOAR. Despite various attempts and methods, we were unable to successfully access the file due to difficulties in retrieving its entry ID.

By manually inspecting the ticket info, we confirmed the presence of attached files. However, in the war Room entries for the incident there was no field entryID and no way to programmatically obtain the entry ID of these attachments via scripting.

We tried to retrieve the entry ID using the getEntries, the results doesn't contain EntryID of the attached files.

We attempted to use the tags associated with ServiceNow attachments (e.g., 'FilesFromServiceNow') to identify the file entries. Unfortunately, this approach also did not yield the desired file entry IDs.

some errors:

"Error getting file path: failed to get artifact file path, invalid file (52)"
"No entry found with ID: [entryID]" "tried to upload the file manually in the war room.
"No file found with the given tag."

The main objective is to access the attached file (excel file) to the incident and extract data from it.

Re: Issue with Retrieving Entry ID for Files Attached to ServiceNow Tickets in Cortex XSOAR

Ivetto — Fri, 19 Jan 2024 21:03:07 GMT

I would definitely recommend creating a ticket with support to take a closer look at this, seems like it needs some hands on troubleshooting.

Re: Issue with Retrieving Entry ID for Files Attached to ServiceNow Tickets in Cortex XSOAR

S.Anggoro — Tue, 14 Jan 2025 06:13:34 GMT

I encountered same issue.

Anyone who solve the issue?

Re: Issue with Retrieving Entry ID for Files Attached to ServiceNow Tickets in Cortex XSOAR

Wassif — Mon, 20 Jan 2025 10:54:55 GMT

Hello, i was able to find a solution, example of the function we are using :

def function_to_read_sn_file(entry_id):
# extracts data from the service now file
file_res = demisto.executeCommand('getFilePath', {'id': entry_id}) #since cortex stores the file somewhere in its backend
if isError(file_res[0]):
return_error("Error getting file path: {}".format(file_res[0]['Contents']))

file_path = file_res[0]['Contents']['path']
with open(file_path, 'rb') as file: #you can continue doing whatever you want with the file