topic Re: how to use demisto-api-download in a Automation in Cortex XSOAR Discussions

how to use demisto-api-download in a Automation

kbratt — Mon, 13 Jun 2022 23:07:49 GMT

I am trying to use the built in demisto-api-download autmation to download a file from our hosted xsoar instance

I am struggling to figure out how to format my command in the automation. From the documentation these are the inputs :

Arguments Description

uri	Request URI
filename	File name of download
description	Description of file entry

demisto.executeCommand("demisto-api-download", {"uri":""})

I would imagine I need to input my API key, but am not sure how to enter it using this command

Any assistance with how to use this to download a file from an incident?

Thanks

Re: how to use demisto-api-download in a Automation

chrking — Tue, 14 Jun 2022 00:53:35 GMT

I'm a little concerned that demisto-api-download isn't what you're expecting. The demisto-api-download will download a response from the API endpoint and save it as an artifact in the war room of the current incident. It won't download the response to your browser automatically, although you can download the saved artifact manually.

The only thing you have to provide for this command is the URL path. The API key is configured within the "Demisto REST API" integration instance.

Here's an example of what that looks like. In this example we send a post request to generate a CSV export of incident data, then download the results.

post_result = demisto.executeCommand("demisto-api-post", {"uri":"/incident/batch/exportToCsv", "body":"{\"all\":true,\"columns\":[\"name\"],\"filter\":{}}"}) filename = post_result[0]['Contents']['response'] res = demisto.executeCommand("demisto-api-download", {"uri":"/incident/csv/{}".format(filename)})

The end result is an entry like this:

I hope that helps.

Re: how to use demisto-api-download in a Automation

jfernandes1 — Tue, 14 Jun 2022 01:47:15 GMT

Hi @kbratt, I think you might need to explain your use case again and in more detail.

1. Do you want to download a file that is stored somewhere (Linux filesystem) on the "Palo Alto" hosted XSOAR instance? to an incident? - This is not possible for a PA hosted instance. We do not give SSH access and do not allow the SSH integration.

2. Do you want to download a file that is inside an incident to your system? - This is not possible since we do not have access your filesystem from the XSOAR UI.

3. Do you want to download a file from an external URL and save it inside the incident? - This is possible with some simple python code like below. The automation will accept the "URL" as an input.

import urllib2 response = urllib2.urlopen(URL) data = response.read() demisto.results(fileResult(FILENAME, data))

Also, scenario 1 is possible if you're not using a PA Hosted XSOAR platform. Thanks.

Re: how to use demisto-api-download in a Automation

kbratt — Tue, 14 Jun 2022 16:19:37 GMT

@jfernandes1 , I can gladly explain our use case a little better. Hope this makes sense.

We are trying to do #2 in your response above for the most part. We have an on-prem XSOAR environment that we are moving away from, to a hosted instance.

Currently on-prem, we are able to copy a file from an incident, to a non XSOAR Server in our environment using the Shared Agent in a playbook.. Moving to the Hosted solution, the shared agents / d2 agents are depreciated, so we are looking for other ways to continue to have this functionality in the hosted solution and are exploring our options.

The powershell remoting integration looks promising, but it apparently has a file size limitation on what it is able to upload from xsoar to another Server. I can upload incident files under 275k using the command !ps-remote-upload-file, but anything larger fails. This would be the ideal solution, but I am not sure there is a way around the size limitation.

We found the XSOAR API integration and this also looks somewhat promising. It's a little ugly, but I was thinking about using a combination of 2 integrations to get around the limitations. Possibly use the powershell remoting integration to get around the filesystem permissions issue you highlighted to then call the XSOAR API integration GET /entry/download/entryid in a script to download the file.

Re: how to use demisto-api-download in a Automation

chrking — Wed, 15 Jun 2022 00:45:16 GMT

It sounds like you're looking for a file upload command/integration, like:

SMB: https://xsoar.pan.dev/docs/reference/integrations/server-message-block-smb-v2#smb-upload or

SCP: https://xsoar.pan.dev/docs/reference/integrations/remote-access-v2#copy-to

Uploading to a cloud file store and then syncing to your local server is also a potential option depending on what you're looking for. For that an integration like Azure File store https://xsoar.pan.dev/docs/reference/integrations/azure-storage-file-share#azure-storage-fileshare-file-create or Google Drive https://xsoar.pan.dev/docs/reference/integrations/google-drive#google-drive-file-upload would do what you need.

Re: how to use demisto-api-download in a Automation

kbratt — Wed, 15 Jun 2022 16:24:06 GMT

Thanks for the responses @chrking , much apprecaited.

I think the SMB upload integration is exactly what I am looking for. I was able to just upload a file from our hosted XSOAR instance to a server on our network. Will test building this into some automation now and testing, but looks promising for sure.