Customized integration to upload files from my computer to the siemplify server

you can write a python script that writes a file to the server. I’ve written text files directly to /tmp.
If it’s a larger file, you could put the file on a hosted webserver (or google drive) and then write a python script to download the file from the download link

View files in slack

I'm assuming you can do something similar. I'm not sure if one of the other File Utilities can be used to replace my step 1, but if not it wouldn't be too difficult to write a custom action to do so.

@nat marinheiro , if you mean 'manually' upload something to the be used by the playbook (or for any other reason) and to be associated with an alert (or case) you can upload 'evidence' to the case wall and then use a powerup action to retrieve it from the case wall

Hi @Yair Stern what powerup action would that be? I tried "Get Case Data" which reports the uploaded evidence as one of the items on the case wall, but wasn't able to find the "path" which e.g. needs to be put into a "Fireeye AX" action.

@Marek Kreul , slightly different usecase than what I had in mind, but I might be wrong.

To answer your question, I thought of using the "Get Attachment", which would return a base64 string of the file from the case wall.
I thought the problem was interacting 'manually' with the server and thats why I've suggested the add evidence (api).
If you want to use it to upload IOCs and send them to sandbox (or any other action that today uses a file path) then unfortunately you need an intermediate action to write it down to disk.

Alternatively, if we go by the customization route, you can customize the action that uploads files to the sandbox to either get them from the casewall (with the same API endpoint that the "Get Attachment" uses) or accept a base64 string and send it that way

Since I know we are working to address the issue of dealing with files in general I think the easiest way (looking to the future) would be not to change the actions that upload files to the sandbox, but rather use an intermediate action to deal with it right now, and in the future you should be able to remove that action (though it depends on the solution we will implement to deal with files).
So, the flow I suggest would be:
Hopefully, step 2 could be removed in the future and you should be able to transfer the base64 from step 1 directly to step 3 (or any other solution). Regardless, if possible I suggest you put this logic into a block, so it is easier and faster to change that in the future

understood - kind of.
What do you think when this future improvements to file handling will be available - is it 3 months, 1 year, ...?

Let me ask around and let you know what I found out

Hi all, we're investigating some possible directions and will update by the end of the week.

Hi all, I'm interested in the upcoming changes when it comes to working with files as well