topic Re: Retrieve screenshots from Notes section in Cortex XSOAR Discussions

Retrieve screenshots from Notes section

adocasar — Thu, 07 Aug 2025 10:27:44 GMT

Hi!

We are trying to give more importance to XSOAR within our SOC processes. As part of the changes we are introducing, we want all alert documentation to be done from now on in the 'Notes' section of each XSOAR incident.

The issue we are facing is that when we include screenshots as part of the evidence in the Notes, those images do not appear to be saved within the Incident Context in XSOAR. From what we can see, they are stored in a path such as:
xsoar/markdown/image/260282_8333f277-6a1e-4182-8cb3-037c2c865950.png.

We don’t know how to retrieve these images to, for example, attach them to the Jira/Service Now ticket associated with the alert. Is there a way to set these images into the incident context?

Please, find attached the error we are getting when we try to retrieve images from the mentioned path.

Regards

Re: Retrieve screenshots from Notes section

ricardo.j.mateus — Fri, 08 Aug 2025 15:57:55 GMT

Hey Adocasar!

I have a few questions:

In your script can you execute the ssh command with 'ls'? This can give an idea of where you are in the directory and you can work from that result to that path.
Do you have permissions to access that folder and file? If you don't that might be the reason that message shows up.
An alternative solution might be to use XSOAR api calls like https://api-yourfqdn/public_api/v1/incidents/get_incidents in order to check the notes and see if you can retrieve the screenshots from there.

Best regards.

Re: Retrieve screenshots from Notes section

pagnihot — Sun, 14 Sep 2025 18:13:06 GMT

If the idea is to upload it to Jira

jira-issue-upload-file

Use above automation to upload the files to jira.

Or use the mirroring options.