Troubleshooting "Downloaded screenshot is empty or is not a PNG" Error in Splunk Attack Analyzer Connector

Applicability

Description

The get_file_job_screenshots action within the Splunk Attack Analyzer connector may fail with the error message: Downloaded screenshot is empty or is not a PNG.

This error is triggered by the _has_expected_download_signature method, located in splunkattackanalyzer_connector.py (line 52).

The method validates that the downloaded data is a non-empty byte or bytearray and that it begins with the standard PNG signature (\x89PNG\r\n\x1a\n). If these conditions are not met, the action returns a failure, even if other screenshots in the same job were successfully saved to the vault.

Investigation

1. Verify the error logs to confirm the failure is associated with the get_file_job_screenshots action.
2. The failure occurs when _has_expected_download_signature returns False. This indicates that the data received from the external API failed one of the following validation checks:
   • The data is not a byte or bytearray type.
   • The data is empty (b'').
   • The data does not start with the required PNG signature (\x89PNG\r\n\x1a\n).
3. Evaluate the timing of the analysis job. It is observed that even when a majority of screenshots are successfully saved, a single invalid return can cause the entire action to fail. This suggests a potential race condition or data inconsistency from the external API source.

Resolution

To ensure playbook resilience, implement a decision block that allows the automation to proceed even if a specific screenshot retrieval fails.

1. Open the affected playbook in the SOAR Playbook Editor.
2. Add a decision block immediately following the get_file_job_screenshots action.
3. Configure the decision logic to evaluate the success of the action:
   • Success Path: Proceed with standard playbook operations.
   • Failure Path: If the action fails, use the container.add_note action to log a warning message in the container and allow the playbook to continue to subsequent steps.
4. Save and test the playbook to confirm that the workflow continues execution despite individual screenshot retrieval errors.