Retrieve screenshots from Notes section

[adocasar]

Hi!

We are trying to give more importance to XSOAR within our SOC processes. As part of the changes we are introducing, we want all alert documentation to be done from now on in the 'Notes' section of each XSOAR incident.

The issue we are facing is that when we include screenshots as part of the evidence in the Notes, those images do not appear to be saved within the Incident Context in XSOAR. From what we can see, they are stored in a path such as:
xsoar/markdown/image/260282_8333f277-6a1e-4182-8cb3-037c2c865950.png.

We don’t know how to retrieve these images to, for example, attach them to the Jira/Service Now ticket associated with the alert. Is there a way to set these images into the incident context?

Please, find attached the error we are getting when we try to retrieve images from the mentioned path.

Regards

[ricardo.j.mateus]

Hey Adocasar!

I have a few questions:

• In your script can you execute the ssh command with 'ls'? This can give an idea of where you are in the directory and you can work from that result to that path.
• Do you have permissions to access that folder and file? If you don't that might be the reason that message shows up.
• An alternative solution might be to use XSOAR api calls like https://api-yourfqdn/public_api/v1/incidents/get_incidents in order to check the notes and see if you can retrieve the screenshots from there.

Best regards.