Playbook: How do I turn string into a CSV email attachment?

dulguun — Wed, 07 Aug 2024 05:04:30 GMT

I've got a string that contains CSV contents. How do I send an email that has an attachment which is made from my string variable?

Re: Playbook: How do I turn string into a CSV email attachment?

marnall — Wed, 07 Aug 2024 20:38:01 GMT

If I understand correctly, you would like your string to be converted into a .csv file, and attached to an email sent by SOAR?

This would likely be a multi-step procedure:

1. Use a custom function to write the CSV to a temporary file on disk.

2. Use a custom function to call phantom.vault_add() to convert the temporary file on disk into a CSV in the vault.

3. Pass the ID of the file in the vault to the email action block as the attachment input.

I personally have never gotten the SMTP app to successfully send file attachments, so I would recommend testing sending email with a file already in a vault before starting steps 1 and 2.

Re: Playbook: How do I turn string into a CSV email attachment?

dulguun — Mon, 12 Aug 2024 00:49:22 GMT

Thank you. It worked.

topic Playbook: How do I turn string into a CSV email attachment? in Splunk Dev

Playbook: How do I turn string into a CSV email attachment?

Re: Playbook: How do I turn string into a CSV email attachment?

Re: Playbook: How do I turn string into a CSV email attachment?