Goal: Include a CSV file in a Teams message to process the contents and take an action, such as block a hash in Defender, or include a CSV file of IoCs to hunt with.
What works: I am able to get the URL to the CSV using
{{[“trigger-teams”].[message].[attachments].[0].[contentUrl]}}
Issue:
I am trying to use the getURL action and then decode the base64 byte data that is returned. However, looking at the returned data, the content is an HTML file and not the text file as there are tags in the decoded file. I can see part of the CSV so this leads me to believe that it is grabbing the page that displays a preview of the data.
I have searched on Discuss but only found a post of someone asking the same thing from a year ago. At this point, even ideas of what to try would be helpful.
Thanks in advance.