import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401

try:
    incident = demisto.incident()
    ticket_id = incident.get("CustomFields", {}).get("cyphoticketid")

    if not ticket_id:
        raise ValueError("Ticket ID (cyphoticketid) is missing from incident.")

    args = {"ticket_id": ticket_id}

    download_response = demisto.executeCommand("cypho-download-attachment", args)

    if is_error(download_response[0]):
        raise DemistoException(f"Attachment download failed: {download_response[0].get('Contents')}")

    return_results(download_response)

except Exception as e:
    demisto.error(f"[CyphoDownloadAttachment] Error: {str(e)}")
    return_results(CommandResults(readable_output="Failed to download attachment from the ticket."))

Cypho Download Attachments

This automation enables analysts to download all attachments associated with a Cypho issue directly from Cortex XSOAR.

The script retrieves attachment metadata from Cypho, securely downloads each available file, and attaches them to the XSOAR incident. This eliminates the need for analysts to manually access Cypho to retrieve evidence, artifacts, or supporting documentation.

The automation is designed to streamline investigations by ensuring that all relevant files are readily available within the incident context in XSOAR, improving analysis speed and operational efficiency.

Script Data

---

Name	Description
Script Type	python3
Tags	incident-action, attachment

Inputs

---

There are no manual inputs for this script.
The automation automatically uses:

• The Cypho ticket ID associated with the incident
• Attachment metadata retrieved from Cypho
• The active incident context in Cortex XSOAR

Outputs

---

Downloaded attachments are added to the incident as files.
Each successfully retrieved attachment is stored in XSOAR and made available for analyst review.

✔ Notes

• This script is intended to be executed via an incident action button.
• If no attachments exist for the issue, the script exits gracefully without errors.
• Supports downloading multiple attachments in a single execution.
• Enhances investigation workflows by centralizing all evidence within XSOAR.
• Fully compatible with Cypho and Cortex XSOAR incident management processes.