Use the Get File from Asset SOAR action to get a file from the Device ID that is associated with selected alerts on the Alerts related list, or on the Configuration Items related list on Security Incidents.

  • This action can be run from an alert or a device.
  • The file is stored as an attachment in the Secured Attachment table record, which you can access from the Secured Attachment field of the Observable record.
  • File details are available in the Observables related list of alert records and in the Associated Observables related list for the incident on which the action is performed.