Retrieve Alert Attachments - Rapid7 ThreatCommand

This playbook is used by default for the Rapid7 ThreatCommand alerts being ingested as XSOAR incidents. This playbook retrieves attachments (CSV file and images) using the Alert ID incident field.

Rapid7 - Threat Command (IntSights) · 8 tasks · 3 inputs · 0 outputs

Inputs

  • alert_id — Alert ID of the Rapid7 Threat Command incident.
  • fetch_attachments — Boolean value indicating to include image files of alerts. If set to "true", then it fetches image files; otherwise, it does not.
  • fetch_csv — Boolean value indicating to include CSV file of alerts. If set to "true", then it fetches CSV file; otherwise, it does not.

Commands used

threat-command-alert-csv-get threat-command-alert-image-list

Flowchart

yes yes yes yes Start Start Retrieve images of the alert. - threat-command-alert-image-list Retrieve images of the al... threat-command-alert-image-list Retrieve the CSV file of the alert. - threat-command-alert-csv-get Retrieve the CSV file of ... threat-command-alert-csv-get End End Is Rapid7 Threat Command integration enabled? - Exists Is Rapid7 Threat Command ... Exists Integration is not enabled. - Print Integration is not enabled. Print Is fetch attachment enabled? - AreValuesEqual Is fetch attachment enabled? AreValuesEqual Is fetch CSV enabled? - AreValuesEqual Is fetch CSV enabled? AreValuesEqual