Splunk SOAR

How to add multiple files in the vault to an archive

N_K
Engager

Hey, 

So I have a playbook that fetches multiple files and adds them to the soar vault. I can then send each individual file to Jira by specifying the files vault_id in the update_ticket action on the Jira app.

Ideally I would like to send only one file over to Jira, an archive containing each of the other files. I can create a file and add it to the archive after seeing this post - https://community.splunk.com/t5/Splunk-SOAR/SOAR-Create-File-from-Artifacts/m-p/581662

However, I don't know how I could take each individual file from the vault and add it to this archive before I sent it over.

Any help would be appreciated!

Thanks

0 Karma
1 Solution

victor_menezes
Communicator

Hi @N_K ,

I would, in a nutshell, use SSH action to create a temp unique folder locally on SOAR, then use SSH action "put file" to read from the vault your files and write them to this folder one by one. When all files are put in the folder, run a SSH command to archive them and finally upload it to Jira directly or send it to the vault and then send to Jira.
Confirming that Jira action is completed, you can remove the temp unique folder and that will remove the local files to save space. You can also remove the files from the vault at this time.

Have you tried this logic?

 

View solution in original post

0 Karma

victor_menezes
Communicator

Hi @N_K ,

I would, in a nutshell, use SSH action to create a temp unique folder locally on SOAR, then use SSH action "put file" to read from the vault your files and write them to this folder one by one. When all files are put in the folder, run a SSH command to archive them and finally upload it to Jira directly or send it to the vault and then send to Jira.
Confirming that Jira action is completed, you can remove the temp unique folder and that will remove the local files to save space. You can also remove the files from the vault at this time.

Have you tried this logic?

 

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...