Retrieve Alert Attachments - Rapid7 ThreatCommand

This playbook is used by default for the Rapid7 ThreatCommand alerts being ingested as XSOAR incidents. This playbook retrieves attachments (CSV file and images) using the Alert ID incident field.

Pack

IntSight

Tasks

8

Inputs

• alert_id — Alert ID of the Rapid7 Threat Command incident.
• fetch_attachments — Boolean value indicating to include image files of alerts. If set to "true", then it fetches image files; otherwise, it does not.
• fetch_csv — Boolean value indicating to include CSV file of alerts. If set to "true", then it fetches CSV file; otherwise, it does not.

Commands used

• threat-command-alert-csv-get
• threat-command-alert-image-list