Hello,
In short, I have to transmute a file, and I leverage the /vault/tmp/ directory.
I'm able to do what I want, but I'm wondering if I have to 'clean up' this /vault/tmp/ directory.
ex - I have a file I want to XOR bit by bit. I read unxord.exe bit by bit, write to /vault/tmp/xord.exe, then I do a phantom.vault_add(file_location="/vault/tmp/xord.exe"). This works fine.
Do I have to do any removal of the "/vault/tmp/xord.exe"?
I've tried to do something like:
import os
os.remove("/vault/tmp/xord.exe")
However, I get a path not found error.
So, how often does Phantom SOAR clean up the /vault/tmp/ directory, and can/should I remove the temp file myself?
Thanks!
@splunk4days i believe that by using the phantom.vault_add() API the file is "moved" from the tmp dir into the relevant file location on the platform where the vault storage is, rather than copied.
I have not tested this but have also never had to clear the /tmp dir when using it for vault_add() API calls.