How to add multiple files in the vault to an archive

[N_K]

Hey, 

So I have a playbook that fetches multiple files and adds them to the soar vault. I can then send each individual file to Jira by specifying the files vault_id in the update_ticket action on the Jira app.

Ideally I would like to send only one file over to Jira, an archive containing each of the other files. I can create a file and add it to the archive after seeing this post - https://community.splunk.com/t5/Splunk-SOAR/SOAR-Create-File-from-Artifacts/m-p/581662

However, I don't know how I could take each individual file from the vault and add it to this archive before I sent it over.

Any help would be appreciated!

Thanks

[victor_menezes · Accepted solution]

Hi @N_K ,

I would, in a nutshell, use SSH action to create a temp unique folder locally on SOAR, then use SSH action "put file" to read from the vault your files and write them to this folder one by one. When all files are put in the folder, run a SSH command to archive them and finally upload it to Jira directly or send it to the vault and then send to Jira.
Confirming that Jira action is completed, you can remove the temp unique folder and that will remove the local files to save space. You can also remove the files from the vault at this time.

Have you tried this logic?