To get the binary file associated with particular alerts from the Incident related list, run this SOAR action.

  • This action can be run from an alert.
  • The downloaded binary file is stored as an attachment in the Secured Attachment table record, which you can access from the Secured Attachment field of the Observable record.
  • File details are available in the Observables related list of alert records on which the action is performed.