How to Copy Incident Files from Linked Incidents

[michaelsysec242]

Hello Live Community,

I am working on a use-case that requires me to copy incident files of any kind from within linked incidents and copy them to the main incident to be saved as evidence. I have tried the getentries command but an entryID does not suffice as the physical file is not copied t my incident. Does anyone have an idea on how to do this? 

Many thanks,

MR

#XSOAR

[sua · Accepted solution]

Hi,

You can upload using Core Rest API integration, command "core-api-upload" which has arguments entryid, incidentid.