Splunk SOAR

How to upload/attach a file (vault) to a container via rest api?

rudnima7
New Member

I am looking for a rest endpoint to be able to attach the source file to the event. You can do this through the browser, and through the rest api I found an endpoint that only allows you to download the metadata of a given file. Is it possible to upload a source file via rest api?

https://docs.splunk.com/Documentation/SOAR/current/PlatformAPI/RESTVault - only GET methods for metadata, like hash, filename etc.

 

Labels (1)
0 Karma

kblaine
Explorer

I am not sure about using the rest endpoint to do it but there is a direct phantom api that allow you to add to the event called phantom.vault_add

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...