topic Re: Filenames with slashes not updating in Cortex XSOAR Discussions

Filenames with slashes not updating

Jersey_Mankowski — Mon, 16 May 2022 20:55:10 GMT

Greetings,

So I have been pulling rasterized images with the names of the URLs attached into XSOAR and attempting to pipe them into some ServiceNow tickets, but character restrictions are giving the system issues on what files to call during the upload process.

The files are stored as the proper URL context, but filenames cannot have slashes in them, so the file names are being edited with underscores in place of the slashes when the files are generated or when you attempt to download said file, but in XSOAR it still thinks of the file as being named with proper URL context including the slashes, so when I go to upload them in other tasks the files are not found.

I have attempted to replace characters via conditional tasks after the images are generated but the system is limiting me on what contexts I can use to identify them, and I can't seem to pull anything in to transform.

Any ideas?

Re: Filenames with slashes not updating

asawyer — Wed, 25 May 2022 00:41:27 GMT

Hi @Jersey_Mankowski,

It looks like you are passing in the URL to the `file_name` input to `rasterize`. The default filename for the `rasterize` result is simply "url.png". Could you try leaving the `file_name` input blank or passing in a different value instead of the URL?

Re: Filenames with slashes not updating

Jersey_Mankowski — Thu, 26 May 2022 14:18:12 GMT

Hey @asawyer

The plan is to get the url address in the filename so that when It gets move around or exported to tickets you can tell where the image was from.

Rasterize is working fine with default naming.

Re: Filenames with slashes not updating

asawyer — Thu, 26 May 2022 21:38:51 GMT

Hey @Jersey_Mankowski – Ah, I'm tracking now. There are a couple of complications here. The first is the replacement of certain characters, as you mentioned in your original post, and the other is a restriction on filename length (on both the XSOAR and ServiceNow side).

The see what XSOAR changed the filename to, download the result of rasterize and view the filename.

From my testing, the maximum filename length for ServiceNow is 255 characters. So to pass in a valid file_name arg value to servicenow-upload-file:

1. Replace at least the slashes with underscores, so the value is not misinterpreted as a URL (Replace transformer)

2. Truncate the value to 251 characters max to leave room for the file extension – You can do this using the RegexGroups transformer with regex: ^(.{,251})

3. Concat the ".png" file extension

Please give that a try and let us know if it works!

Re: Filenames with slashes not updating

Jersey_Mankowski — Fri, 27 May 2022 16:32:43 GMT

Hey @asawyer

I like what you are thinking, and that could be half of it, but with the new transforms I have been seeing an error in the RE.py lib, and some other errors with the replace, I did get it to go through as expected but it's still failing to upload the file and says it does not exist, even when looking up by artifact.

For reference I am doing the file_name transformations in the !servicenow-upload-file task. I have also tried a replace on the slashes to underscore directly after the rasterize, but it would never find anything. I feel like the automatic file renaming by the system is getting these images corrupted or lost somehow, but it's hard to confirm that when I can go download the artifacts.

Re: Filenames with slashes not updating

asawyer — Fri, 27 May 2022 23:56:44 GMT

Hey @Jersey_Mankowski – Re: your third screenshot, I get the same error if I don't pass in the file_name arg.

For the example from your last post, could you share the following so we can troubleshoot further?:

1. Screenshots of the exact values and transformers you are using to create the file_name arg, that are leading to the transformer (replace and regex) errors

2. Filename of the rasterize output file when you download it onto your local filesystem

Re: Filenames with slashes not updating

Jersey_Mankowski — Thu, 02 Jun 2022 14:07:29 GMT

So the regex errors are only happening occasionally. Also, I added the 'underscore to hyphen' transform after just having the 'slash to underscore' transform to try and double up and maybe get the system to realize the renaming function since it always seems to look for the file name with the slashes in it and fails the upload when it can't find the file. I also tried it only with the slash transform and was seeing the same results.

Re: Filenames with slashes not updating

asawyer — Tue, 14 Jun 2022 00:55:47 GMT

Hi @Jersey_Mankowski – In your first screenshot with the error, the file_name arg was not passed. From my testing, that arg must be passed in order for the servicenow-upload-file command to succeed. Could you try running the command again with the file_name arg?

Re: Filenames with slashes not updating

Jersey_Mankowski — Wed, 15 Jun 2022 15:34:55 GMT

I am not sure I understand. The second image shows the file_name arguments, also the upload task is looking for the file based on the filename.

What am I missing?

Re: Filenames with slashes not updating

asawyer — Wed, 15 Jun 2022 19:32:17 GMT

The second image shows the file_name arg, but the first does not, indicating no file_name arg was actually passed to that command in that first screenshot.

I replicated your example and the following worked for me:

First, I saved the URL to context key url using the Set command:

Then I ran the servicenow-upload-file command, applying the transformers discussed above to the file_name arg value, as shown in the screenshots below:

!servicenow-upload-file id=<SERVICENOW_SYS_ID> file_id=<FILE_ENTRY_ID> file_name=<URL_WITH_TRANSFORMERS> using=<SERVICENOW_INSTANCE_NAME>

Please give that a try and let me know if that works for you.

Re: Filenames with slashes not updating

Jersey_Mankowski — Fri, 17 Jun 2022 18:04:00 GMT

Hey @asawyer,

So I finally got it to work. By moving the re-naming steps into the rasterize process instead of the SN upload process they are finally posing into the ticket with the the full names.

Thanks for all of your help!