Custom Web server on XSOAR

[Antanas]

Hi,

I'ld like to run a simple web server on demand, which would listen for POST requests and put the data posted in a file (or context).

So far I achieved similar by modifying community integration XSOAR-Web-Server, which use long lasting instance mode and creates web server using Python Bottle. Server is started by an integration in a simple oneliner:

run(host='0.0.0.0', port=listen_port, debug=True)

I then deal with  POST requests with:

@route('post-uri', method='POST') 

def post-uri():

     ...    # write to a file /tmp/data.txt locally

After web server received all the posts, I get the data form the XSOAR file system container ../diff/tmp/data.txt.

Is there a way to access the data from the container using the commands in that integration? Cause at the time the data is collected, there are no incidents associated with it. If i create a new command and try to access /tmp/data.txt - it seem to be executed in different container and does not have access to that file.

[MBeauchamp2]

I think you'd be better off using something like the Generic Webhook integration to receive the post request, and then have the created Incident write the data to a file.  

The POST would need to be JSON, but you could then map the data to a field, or drop it to labels.   Then have your automation create the file and return it to the war room using the fileResult method (check the script helper)

https://xsoar.pan.dev/docs/reference/integrations/generic-webhook

[Antanas]

Thanks @MBeauchamp2 for reply. The problem with your suggestion is that I will get 1 incident per 1 POST. But I'ld like to aggregate all the posts (e.g. 1000 of them) within the timeframe in 1 incident.

[MBeauchamp2]

Then I'd use a preprocessing script to handle that part.  And have it add an entry to the first Incident.