About abracamontesauz

Hi @abracamontesauz, From what I understand you're referring to the "Cortex XDR - IOC" integration. I think sync you're referring to is the "Fetch Indicators" function, This will pull IOCs from XDR => XSOAR - not the other way around.    If you want to manually push indicators (XSOAR => XDR) you can use the "!xdr-iocs-push indicator=<value>" command. This command can be called in a playbook by passing a single\list of IOC to XDR.    I have an example of below showing 2 methods to doing the same function. You do not require the "Playbook Triggered" step  for method 2.  ... View more

Hi Alejandro   Just found it out. If you email it with mail-sender-new: AttachedID is <id>@<ticketnumber> -> 31@1234 attachNames is the name of the attachment, you would like to see in the Mail Attachment -> "picture.png" attachCIDs is the name in the war room, in the "command"-Part of the entry 31 -> "picture" You need all three entries. You may put more than one attachment, just put a coma in between -> "31@1234,45@1234" etc   Finally I've got it working 🙂   greets roger ... View more

Now I understand. There isn't anything to be done about the filename in the incident.   I can only suggest perhaps doing something directly with the io library to manipulate the "name" in a file handle, howeverm I don't think this is possible.   One workaround would be to (excuse the pseudo code):       def get_handle(file_data):     return_handle = open(file_data['name'], "wb")     with open(file_data['path'], "rb") as fp:         return_handle.write(fp.read())         return_handle.seek(0,0)     return return_handle     def main():     args = demisto.args()     entryID = args['entryID']     file_data = demisto.getFilePath(entryID)     new_handle = get_handle(file_data)     This would temporarily write data to a file named aptly and return the handle you need. This file, though, would only exist throughout the execution of the intergation command. ... View more