Add a screenshot to indicator layout using rasterize url

[NickyR]

Currently using rasterize url to add screenshots to incidents, any way to do the same for indicators?

Thanks for any help

[asawyer · Accepted solution]

Hi @NickyR – There is no straightforward way to do this for indicators, because indicators do not have an investigation (with a War Room, ability to store files, etc.) like incidents do.

However, it is possible to work around this by combining an indicator general purpose dynamic section script in the indicator layout with `rasterize` screenshots pulled from incidents. The workflow would be:

1. Run rasterization of URLs in incidents
2. Tag rasterize results with tag "rasterize"
3. Create an indicator general purpose dynamic section script and add a section to run it in the URL indicator layout
4. The general purpose dynamic section script does the following:
   1. Get incident IDs associated with the indicator
   2. Iterate over those incident IDs to see if they have any entries tagged with "rasterize". (Be mindful of the risk of overloading the server if some indicators are associated with an excessive number of incidents. The attached sample code cuts off after 10 incidents max for this reason.)
   3. If yes, grab the rasterization screenshot from the incident and display it using markdown

Please see the attached sample code for the general purpose dynamic section script. Be sure to test on dev first and use at your own risk!

[NickyR]

@asawyer you're incredible. Already had tags going for this with little to no tweaks in that script it worked perfectly. I really appreciate your response and helping me out! Thank you

[NickyR]

@asawyer so this works cause I had the rasterization run in the playbook per incident so that file is stored can can be retrieved. But say I want to get a screenshot/rasterize in this script to display content every time that script is ran(after the incident is closed), not just from the incident but the present content of the site, you have a rough idea how to approach?

[NickyR]

Think I got it! Basically just created a single step playbook with rasterize URL. Within the automation script I would reopen the case and then setPlaybook to that new basic playbook and grab that tagged png entity.

[asawyer]

Nice! With the limitation of indicators not having an investigation like incidents do, I think that is the cleanest possible approach.