Custom Web server on XSOAR

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Custom Web server on XSOAR

L2 Linker



I'ld like to run a simple web server on demand, which would listen for POST requests and put the data posted in a file (or context).

So far I achieved similar by modifying community integration XSOAR-Web-Server, which use long lasting instance mode and creates web server using Python Bottle. Server is started by an integration in a simple oneliner:

run(host='', port=listen_port, debug=True)


I then deal with  POST requests with:

@route('post-uri', method='POST') 

def post-uri():

     ...    # write to a file /tmp/data.txt locally


After web server received all the posts, I get the data form the XSOAR file system container ../diff/tmp/data.txt.


Is there a way to access the data from the container using the commands in that integration? Cause at the time the data is collected, there are no incidents associated with it. If i create a new command and try to access /tmp/data.txt - it seem to be executed in different container and does not have access to that file.


Curious Fellow

L4 Transporter

I think you'd be better off using something like the Generic Webhook integration to receive the post request, and then have the created Incident write the data to a file.  


The POST would need to be JSON, but you could then map the data to a field, or drop it to labels.   Then have your automation create the file and return it to the war room using the fileResult method (check the script helper)

Thanks @MBeauchamp2 for reply. The problem with your suggestion is that I will get 1 incident per 1 POST. But I'ld like to aggregate all the posts (e.g. 1000 of them) within the timeframe in 1 incident.

Curious Fellow

L4 Transporter

Then I'd use a preprocessing script to handle that part.  And have it add an entry to the first Incident. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!