Splunk SOAR

How to add multiple files in the vault to an archive

N_K
Engager

Hey, 

So I have a playbook that fetches multiple files and adds them to the soar vault. I can then send each individual file to Jira by specifying the files vault_id in the update_ticket action on the Jira app.

Ideally I would like to send only one file over to Jira, an archive containing each of the other files. I can create a file and add it to the archive after seeing this post - https://community.splunk.com/t5/Splunk-SOAR/SOAR-Create-File-from-Artifacts/m-p/581662

However, I don't know how I could take each individual file from the vault and add it to this archive before I sent it over.

Any help would be appreciated!

Thanks

0 Karma
1 Solution

victor_menezes
Communicator

Hi @N_K ,

I would, in a nutshell, use SSH action to create a temp unique folder locally on SOAR, then use SSH action "put file" to read from the vault your files and write them to this folder one by one. When all files are put in the folder, run a SSH command to archive them and finally upload it to Jira directly or send it to the vault and then send to Jira.
Confirming that Jira action is completed, you can remove the temp unique folder and that will remove the local files to save space. You can also remove the files from the vault at this time.

Have you tried this logic?

 

View solution in original post

0 Karma

victor_menezes
Communicator

Hi @N_K ,

I would, in a nutshell, use SSH action to create a temp unique folder locally on SOAR, then use SSH action "put file" to read from the vault your files and write them to this folder one by one. When all files are put in the folder, run a SSH command to archive them and finally upload it to Jira directly or send it to the vault and then send to Jira.
Confirming that Jira action is completed, you can remove the temp unique folder and that will remove the local files to save space. You can also remove the files from the vault at this time.

Have you tried this logic?

 

0 Karma
Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...