topic Re: XSOAR - How to pull file from context in playbook in Cortex XSOAR Discussions

XSOAR - How to pull file from context in playbook

TexasHoosier — Wed, 01 Sep 2021 17:03:57 GMT

Hello,

I am trying to pull a file from the context. I tried pulling the 'EntryId' for the file, but the playbook returned an error saying there was not a file at that file path. Is it possible to pull a file from the context, and if so, how can it be done?

Re: XSOAR - How to pull file from context in playbook

DougCouch — Wed, 01 Sep 2021 20:42:12 GMT

Hi!

Just checking where you tried to pull the EntryID from? Did you use ${File.EntryID} as the input to your task? Here's an example:

For more granularity and to not fetch all of the files in the incident you can add a filter into the entry like this:

That fetches the EntryID for a File with txt in the Name.

I hope this helps!

Re: XSOAR - How to pull file from context in playbook

TexasHoosier — Wed, 01 Sep 2021 20:48:44 GMT

Hi Doug!

I solved it with a Python script. I found the command demisto.getFilePath(entryID), which returns a dictionary containing the file name and path. The path to the file is incident#_EntryID. So if the incident number is 12345 and the entry id is 14@23456 then the path is 12345_14@23456.

Re: XSOAR - How to pull file from context in playbook

Abu_Satorp — Tue, 01 Mar 2022 05:11:24 GMT

Hi Thanks,

Nice. and I am trying add this "ID" of the context data in to playbook task . but i m not able to find this. will you able to help here to identifying the same ?