Snapshot URL¶

Table of Contents¶

Release Notes
Overview
- Key Features
Requirements
Installation
- Install
- App Configuration
Function - SnapShot URL
Playbooks
Troubleshooting & Support

Release Notes¶

Version	Date	Notes
1.0.0	01/2024	Initial Release

Overview¶

Save snapshots of web pages as incident attachments

screenshot: main

Save snapshots of web pages as incident attachments

Key Features¶

URL Snapshot as PNG image attachment

Requirements¶

This app supports the IBM Security QRadar SOAR Platform and the IBM Security QRadar SOAR for IBM Cloud Pak for Security.

This implementation uses a FireFox or Chrome browser to perform the url lookup and image rendering. The configuration of a Firefox or Chrome browser may place additional constraints on an Integration Server. Therefore, the use of the App Host for container deployment is the easiest way to configure this app. App Host deployments use the FireFox browser.

SOAR platform¶

The SOAR platform supports two app deployment mechanisms, App Host and integration server.

If deploying to a SOAR platform with an App Host, the requirements are:

SOAR platform >= 48.0.0.
The app is in a container-based format (available from the AppExchange as a zip file).

If deploying to a SOAR platform with an integration server, the requirements are:

SOAR platform >= 48.0.0.
The app is in the older integration format (available from the AppExchange as a zip file which contains a tar.gz file).
Integration server is running resilient-circuits>=48.0.0.
If using an API key account, make sure the account provides the following minimum permissions:

Name

Permissions

Org Data

Read

Function

Read

Incident

Edit

Name	Permissions
Org Data	Read
Function	Read
Incident	Edit

The following SOAR platform guides provide additional information:

App Host Deployment Guide: provides installation, configuration, and troubleshooting information, including proxy server settings.
Integration Server Guide: provides installation, configuration, and troubleshooting information, including proxy server settings.
System Administrator Guide: provides the procedure to install, configure and deploy apps.

The above guides are available on the IBM Documentation website at ibm.biz/soar-docs. On this web page, select your SOAR platform version. On the follow-on page, you can find the App Host Deployment Guide or Integration Server Guide by expanding Apps in the Table of Contents pane. The System Administrator Guide is available by expanding System Administrator.

Cloud Pak for Security¶

If you are deploying to IBM Cloud Pak for Security, the requirements are:

IBM Cloud Pak for Security >= 1.10.
Cloud Pak is configured with an App Host.
The app is in a container-based format (available from the AppExchange as a zip file).

The following Cloud Pak guides provide additional information:

App Host Deployment Guide: provides installation, configuration, and troubleshooting information, including proxy server settings. From the Table of Contents, select Case Management and Orchestration & Automation > Orchestration and Automation Apps.
System Administrator Guide: provides information to install, configure, and deploy apps. From the IBM Cloud Pak for Security IBM Documentation table of contents, select Case Management and Orchestration & Automation > System administrator.

These guides are available on the IBM Documentation website at ibm.biz/cp4s-docs. From this web page, select your IBM Cloud Pak for Security version. From the version-specific IBM Documentation page, select Case Management and Orchestration & Automation.

Proxy Server¶

The app does support a proxy server.

Python Environment¶

Python 3.9 is supported. This is due to dependencies on selenium. Additional package dependencies may exist for each of these packages:

resilient-circuits>=48.0.0
selenium

Installation¶

Install¶

To install or uninstall an App or Integration on the SOAR platform, see the documentation at ibm.biz/soar-docs.
To install or uninstall an App on IBM Cloud Pak for Security, see the documentation at ibm.biz/cp4s-docs and follow the instructions above to navigate to Orchestration and Automation.

App Configuration¶

Setting	Required	Example	Description
browser	No	`firefox\|chrome`	Browser to use for web site image rendering. Only used with integration servers. Default is `firefox`.
proxy_server	No	`11.22.33.44`	HTTP(S) proxy server

Integration Server Installation¶

Either a Firefox or Chrome browser needs to be installed prior to using this app. Tested versions of the browsers are:

Browser	Tested Version
Firefox	121.0
Chrome	120.0

Function - SnapShot URL¶

Snapshot URL as png image attachment.

screenshot: fn-snapshot-url

Inputs:

Name	Type	Required	Example	Tooltip
`snapshot_incident_id`	`number`	Yes	`-`	-
`snapshot_url`	`text`	Yes	`-`	-
`snapshot_timeout`	`number`	No	`30`	default is 30 seconds
`snapshot_fullpage`	bool	No	‘Yes’	full page image or just initial page height image

Outputs:

NOTE: This example might be in JSON format, but results is a Python Dictionary on the SOAR platform.

results = {
  "content": {
    "attachment_name": "https://cybersecuritynordic.messukeskus.com/program-3/.png"
  },
  "inputs": {
    "snapshot_incident_id": 2103,
    "snapshot_url": "https://cybersecuritynordic.messukeskus.com/program-3/"
  },
  "metrics": {
    "execution_time_ms": 49769,
    "host": "1fd9269d-5558-411b-ba33-e4767f763c59-8678ccd8c8-xs2vr",
    "package": "fn-snapshot-url",
    "package_version": "1.0.0",
    "timestamp": "2023-12-28 20:51:10",
    "version": "1.0"
  },
  "raw": null,
  "reason": null,
  "success": true,
  "version": 2
}

Example Pre-Process Script:

inputs.snapshot_incident_id = incident.id
inputs.snapshot_url = artifact.value
if getattr(playbook.inputs, "snapshot_url_load_timeout", None):
  inputs.snapshot_timeout = playbook.inputs.snapshot_url_load_timeout
inputs.snapshot_fullpage = playbook.inputs.snapshot_full_screen_capture

Example Post-Process Script:

results = playbook.functions.results.snapshot_results

if results.success:
  incident.addNote(f"Snapshot URL for {results.inputs.snapshot_url} succeeded with attachment: {results.content.attachment_name}")
else:
  incident.addNote(f"Snapshot URL {results.reason}")

Playbooks¶

Playbook Name	Description	Object	Status
Snapshot URL	Manual playbook to snapshot URL as png attachment.	artifact	`enabled`

Troubleshooting & Support¶

Full screen images are not viewable within SOAR.¶

When viewing PNG files within SOAR by clicking on the attachment, only the bottom portion of the page is visible. Download the PNG attachment to view the entire URL page.
For full page images, it’s possible that all the subsequent page images may not display. This a feature of some websites which load images on demand when the page comes into view.

For Support¶

This is a IBM Supported app. Refer issues to ibm.com/mysupport. Also search the Community ibm.biz/soarcommunity for assistance.