Overview

Automatically add attachments like screenshots, source code, and other relevant documents to cases. This ensures that all essential information and context are included, boosting the accuracy of investigations.

Learn how to use attachments manually in a case investigation.

Potentially malicious files should not be uploaded to the workspace as attachments, as other users may accidentally download and open them.

Automatically manage attachments: Essential steps

Efficiently manage case attachments using attachment steps:

Add attachment to case
Get attachment download link
List case attachments
Remove attachment from case

How to use

Adding an attachment

To automatically add an attachment to a case:

Name the attachment: Give the attachment a descriptive name.
Select the input type:
- Raw data: Input raw data directly from the workflow context to save as a file attachment.
  [OR]
- File: Provide file content either in base64 format or via a file URL to attach it to the specified case.

File links can be available through trigger events or steps configured to return the output as a file. By default, file links are non-shareable and have the format: tqfile://steps/XXXXXXX. These links require the file function to access the file content and add it as an attachment to a case:
{{ file $.<path_to_non_shareable_file_url> }}. Read more about working with files.

Accessing an attachment

To automatically access an attachment:

Add the download link step: Use the Get attachment download link step to generate a downloadable link for an attachment.
Add the HTTP request step: To get the file content into the workflow context, use the Send an HTTP Request step with the GET method and provide the download link as the URL input (read more).

Including images in case descriptions or notes

To embed an image:

Attach the image: Use the Add attachment to case step to upload the image.
Embed the image: Use the static_link output field from the Add attachment to case step to insert the image into the case description or notes. In the Change case description or Add a new note to case steps, apply the following HTML tag (adjusting the path based on the step name):
```
<img src="{{ $.add_attachment_to_case.attachment.static_link }}">
```

Use case: Adding a screenshot to a case note

Attach the screenshot: Add the Add attachment to case step to a workflow. Use the output from the Screenshot HTML and attach it to the case.
Add screenshot as a note: Add the Add note with image step to a workflow. Add the static_link to the content parameter to display the screenshot directly in a note.

Saving the screenshot as a file is optional. This process will also work if the screenshot is passed as a Base64 string directly to the Add attachment to case step.

Automating Attachments in Torq Cases: Add Context and Information