Rasterize

Converts URLs, PDF files, and emails to an image file or PDF file.

Docker Security Recommendations

If you are using the integration to rasterize un-trusted URLs or HTML content, such as those obtained via external emails, we recommend following the instructions at the Network Hardening Guide (Cortex XSOAR 6.13) or Docker network hardening Guide (Cortex XSOAR 8 Cloud) or Docker network hardening Guide (Cortex XSOAR 8.7 On-prem) under the Block Internal Network Access section.

Configure Rasterize in Cortex

Configuration Notes:

• Return Errors: If this checkbox is not selected, a warning will be returned instead of an error.

• Chrome options: A comma-separated list of Chrome options to add or remove for rasterization. Use for advanced troubleshooting. If a value contains a comma (for example, when setting the user agent value), escape it with the backslash (\) character. To remove a default option that is used, put the option in square brackets. For example, to add the option –disable-auto-reload and remove the option –disable-dev-shm-usage, set the following value:

    --disable-auto-reload,[--disable-dev-shm-usage]
  

  To set a language for the browser, add the –accept-lang argument followed by the desired language code in IETF BCP 47 format. For example, --accept-lang=de-DE.
  If you want to set the language to en-US, use en-GB instead.

• Rasterize Mode: It is possible to rasterize either via Chrome WebDriver or Chrome Headless CLI. WebDriver supports more options than Headless CLI. Such as support for the offline option in the rasterize-emails command. There are some urls that do not rasterize well with WebDriver and may succeed with Headless CLI. Thus, it is recommended to use the WebDriver - Preferred mode, which will use WebDriver as a start and fallback to Headless CLI if it fails.
• Use system proxy settings: Select this checkbox to use the system’s proxy settings. Important: this integration does not support proxies which require authentication.

Limitations

• Rasterize does not support private network paths.

• The default timeout is 5 minutes (300 seconds). If the rasterize command processes a large number of URLs, or even a smaller number of URLs that take a long time to load, it can result in a timeout error. For example, 100 URLs each taking 5 seconds to open would total 500 seconds, exceeding the default timeout limit.
  In cases where you encounter timeout errors when processing many URLs, you can either:

  • Split the URLs into smaller batches to process.
  • Increase the timeout setting for the specific task in the playbook that runs the rasterize command. To increase the timeout for a playbook task, modify the task’s configuration by accessing the task settings, clicking the Advanced section, and adjusting the Execution timeout (seconds) field to a higher value appropriate for the workload.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

rasterize

Converts the contents of a URL to an image file or a PDF file.

Base Command

rasterize

Input

Context Output

Command Example

!rasterize url=http://google.com

Context Example

{
    "InfoFile": {
        "EntryID": "922@6e069bc4-2a1e-43ea-8ed3-ea558e377751",
        "Extension": "png",
        "Info": "image/png",
        "Name": "url.png",
        "Size": 29909,
        "Type": "PNG image data, 1024 x 800, 8-bit/color RGBA, non-interlaced"
    }
}

Passing Multiple URLs

To pass multiple URLs as an argument when one or more URL contains a comma, use a JSON list formatted as a string as follows:
"[\"https://www.a.com\", \"https://www.b.com\"]"

Alternatively, you can wrap the entire list in backticks () so it is interpreted as a single argument. If you do this, make sure to: -Only use double quotes (") to enclose each URL string. -Replace any double quotes in a URL with single quotes (') or%22, or pass the URL separately to ensure proper parsing and avoid conflicts caused by nested quotation marks. for example: `["https://www.a.com", "https://www.b.com/?q='test_arg'/search"]``

Human Readable Output

!image

rasterize-email

Converts the body of an email to an image file or a PDF file.

Base Command

rasterize-email

Input

Context Output

Command Example

!rasterize-email htmlBody="<html><head><meta http-equiv=\"Content-Type\" content=\"text/html;charset=utf-8\"></head><body><br>---------- TEST FILE ----------<br></body></html>"

Context Example

{
    "InfoFile": {
        "EntryID": "926@6e069bc4-2a1e-43ea-8ed3-ea558e377751",
        "Extension": "png",
        "Info": "image/png",
        "Name": "email.png",
        "Size": 5243,
        "Type": "PNG image data, 600 x 800, 8-bit/color RGBA, non-interlaced"
    }
}

Human Readable Output

!image

rasterize-image

Converts an image file to a PDF file.

Base Command

rasterize-image

Input

Context Output

Command Example

!rasterize-image EntryID=889@6e069bc4-2a1e-43ea-8ed3-ea558e377751

Context Example

{
    "InfoFile": {
        "EntryID": "930@6e069bc4-2a1e-43ea-8ed3-ea558e377751",
        "Extension": "pdf",
        "Info": "application/pdf",
        "Name": "889@6e069bc4-2a1e-43ea-8ed3-ea558e377751.pdf",
        "Size": 21856,
        "Type": "PDF document, version 1.4"
    }
}

Human Readable Output

rasterize-pdf

Converts a PDF file to an image file.

Base Command

rasterize-pdf

Input

Context Output

Command Example

!rasterize-pdf EntryID=897@6e069bc4-2a1e-43ea-8ed3-ea558e377751

Context Example

{
    "InfoFile": {
        "EntryID": "934@6e069bc4-2a1e-43ea-8ed3-ea558e377751",
        "Extension": "jpeg",
        "Info": "image/jpeg",
        "Name": "image.jpeg",
        "Size": 77514,
        "Type": "JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1700x2200, components 3"
    }
}

Human Readable Output

rasterize-html

Converts an html file to a PDF or PNG file.

Base Command

rasterize-html

Input

Context Output

Command Example

!rasterize-html EntryID=889@6e069bc4-2a1e-43ea-8ed3-ea558e4586751

Context Example

{
    "InfoFile": {
        "EntryID": "930@6e069bc4-2a1e-43ea-8ed3-ea558e458651",
        "Extension": "png",
        "Info": "application/png",
        "Name": "image.png",
        "Size": 21856,
        "Type": "png document, version 1.4"
    }
}

Human Readable Output