XSOAR - How to pull file from context in playbook

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

XSOAR - How to pull file from context in playbook

L1 Bithead

Hello,

 

I am trying to pull a file from the context. I tried pulling the 'EntryId' for the file, but the playbook returned an error saying there was not a file at that file path. Is it possible to pull a file from the context, and if so, how can it be done?

3 REPLIES 3

L2 Linker

Hi!

Just checking where you tried to pull the EntryID from?  Did you use ${File.EntryID} as the input to your task?  Here's an example:

DougCouch_0-1630528737356.png

For more granularity and to not fetch all of the files in the incident you can add a filter into the entry like this: 

DougCouch_1-1630528891245.png

That fetches the EntryID for a File with txt in the Name.

I hope this helps!

Doug Couch  |  XSOAR Customer Success Engineer - Manager
Palo Alto Networks  |  3000 Tannery Way  |  Santa Clara, CA 95054  

Hi Doug!

 

I solved it with a Python script. I found the command demisto.getFilePath(entryID), which returns a dictionary containing the file name and path. The path to the file is incident#_EntryID. So if the incident number is 12345 and the entry id is 14@23456 then the path is 12345_14@23456.

L0 Member

Hi Thanks, 

 

Nice. and I am trying add this "ID" of the context data  in to playbook task . but i m not able to find this. will you able to help here to identifying the same ?

 

Abu_Satorp_0-1646111259873.png

  • 7478 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!