TISC RSS Custom Feed – Attachment Not Created in Integration Process

[sarah_bioni]

While using Threat Intelligence Security Center (TISC) to configure a custom RSS feed, the integration appeared to run successfully, but no attachment was created in the Integration Process record.

Scenario:

• A public RSS endpoint was configured
• The integration was enabled
• Fetch Data was added
• Execute Now was triggered successfully

However, when checking the Integration Process table (sn_sec_cmn_integration_process), no attachment was present, even though the RSS response was being connected correctly.

At first glance, there were no clear errors in the execution, which made troubleshooting more challenging.

---

Root Cause

After multiple tests, the issue was traced back to a system property that restricts which file extensions are allowed as attachments in the instance.

In this case:

• The RSS integration saves the response body as an attachment
• The attachment was being created without any file extension
• Attachments without extensions were blocked by the instance
• As a result, the attachment was silently rejected and never saved

---

Solution

The fix was to explicitly add a file extension when saving the response body as an attachment.

This required a small change in the Script Include responsible for persisting the integration response.

Original code

msg.saveResponseBodyAsAttachment(this.integrationProcessGr.getTableName(), this.integrationProcessGr.getUniqueValue(), fname);

Updated code

msg.saveResponseBodyAsAttachment(this.integrationProcessGr.getTableName(), this.integrationProcessGr.getUniqueValue(), fname + ".xml");

By appending a valid extension (in this case, .xml), the attachment was successfully created and stored in the Integration Process record.

In my scenario the script include was: RSSFeedDatasourceIntegration