EWS Mail Sender Deprecated
Exchange Web Services mail sender. Note: this integration supports Office 365 basic authentication only. If you are using Office 365, we recommend using the EWS O365 Integration instead, which supports modern authentication (oauth2). Deprecated. Use EWS v2 instead
Email · Microsoft Exchange On-Premise
Details
| ID | EWS Mail Sender |
|---|---|
| Provider | Microsoft |
| Category | |
| From Version | 5.0.0 |
| Docker Image | demisto/py3ews:1.0.0.47270 |
| Supported Modules | Agentix Cloud Runtime Security Cloud Posture Security XSIAM EDR Cortex Cloud |
README
Exchange Web Services and Office 365 Email sender.
Configure EWS Mail Sender in Cortex
| Parameter | Description | Required |
|---|---|---|
| ewsServer | Exchange URL or Server IP address | True |
| credentials | Authentication: Email address (for Office 365) or DOMAIN\USERNAME (e.g. XSOAR.INT\admin) | True |
| defaultServerVersion | Server Version (2007, 2010, 2010_SP2, 2013, or 2016) | True |
| authType | Authentication Type (NTLM, Basic, or Digest). For Office 365 use Basic. | True |
| insecure | Trust any certificate (not secure) | False |
| proxy | Use system proxy settings | False |
| impersonation | Has impersonation rights | False |
| mailbox | Sender Mailbox | False |
| Single engine | If relevant, select the engine that acts as a proxy to the server. Engines are used when you need to access a remote network segments and there are network devices such as proxies, firewalls, etc. that prevent the Cortex XSOAR server from accessing the remote networks. For more information on Cortex XSOAR engines see: Cortex XSOAR 6.13 - Engines Cortex XSOAR 8 Cloud- Engines Cortex XSOAR 8.7 On-prem - Engines |
False |
Top Use-cases
- Send notifications to external users.
- Send an email asking for a response to be returned as part of a playbook. See Receiving an email reply
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
send-mail
Sends an email using EWS.
Base Command
send-mail
Input
| Argument Name | Description | Required |
|---|---|---|
| to | A CSV list of email addresses for the ‘to’ field. | Required |
| cc | A CSV list of email addresses for the ‘cc’ field. | Optional |
| bcc | A CSV list of email addresses for the ‘bcc’ field. | Optional |
| subject | Subject for the email to be sent. | Required |
| replyTo | The email address specified in the ‘reply to’ field. | Optional |
| body | The contents (body) of the email to send. | Optional |
| htmlBody | HTML formatted content (body) of the email to be sent. This argument overrides the “body” argument. | Optional |
| attachIDs | A CSV list of War Room entry IDs that contain files, and are used to attach files to the outgoing email. For example: attachIDs=15@8,19@8. | Optional |
| attachNames | A CSV list of names of attachments to send. Should be the same number of elements as attachIDs. | Optional |
| attachCIDs | A CSV list of CIDs to embed attachments within the email itself. | Optional |
| from_address | The email address from which to reply. | Optional |
Context Output
There is no context output for this command.
Command Example
!send-mail body="hello this is a test" subject=Hi to=avishai@demistodev.onmicrosoft.com
Human Readable Output
Sent email
attachments from subject to avishai@demistodev.onmicrosoft.com Hi avishai@demistodev.onmicrosoft.com
reply-mail
Replies to an email using EWS.
Base Command
reply-mail
Input
| Argument Name | Description | Required |
|---|---|---|
| inReplyTo | ID of the item to reply to. | Required |
| to | A CSV list of email addresses for the ‘to’ field. | Required |
| cc | A CSV list of email addresses for the ‘cc’ field. | Optional |
| bcc | A CSV list of email addresses for the ‘bcc’ field. | Optional |
| subject | Subject for the email to be sent. | Optional |
| body | The contents (body) of the email to send. | Optional |
| htmlBody | HTML formatted content (body) of the email to be sent. This argument overrides the “body” argument. | Optional |
| attachIDs | A CSV list of War Room entry IDs that contain files, and are used to attach files to the outgoing email. For example: attachIDs=15@8,19@8. | Optional |
| attachNames | A CSV list of names of attachments to send. Should be the same number of elements as attachIDs. | Optional |
| attachCIDs | A CSV list of CIDs to embed attachments within the email itself. | Optional |
Context Output
There is no context output for this command.
Command Example
!reply-mail item_id=AAMkAGY3OTQyMzMzLWYxNjktNDE0My05NmZhLWQ5MGY1YjIyNzBkNABGAAAAAACYCKjWAnXBTrnhgWJCcLX7BwDrxRwRjq/zTrN6vWSzK4OWAAAAAAEMAADrxRwRjq/zTrN6vWSzK4OWAAPYQGFeAAA= body=hello subject=hi to="avishai@demistodev.onmicrosoft.com"
Human Readable Output
Sent email
attachments from subject to avishai@demistodev.onmicrosoft.com hi avishai@demistodev.onmicrosoft.com
Configuration parameters
ewsServer— Exchange URL or Server IP address (required)credentials— Authentication: Email address (for Office 365) or DOMAIN\USERNAME (e.g. DEMISTO.INT\admin) (required)defaultServerVersion— Server Version (2007, 2010, 2010_SP2, 2013, or 2016) (required)authType— Authentication Type (NTLM, Basic, or Digest). For Office 365 use Basic. (required)insecure— Trust any certificate (not secure)proxy— Use system proxy settingsimpersonation— Has impersonation rightsmailbox— Sender Mailbox
Commands (2)
-
reply-mailReplies to an email using EWS.
-
send-mailSends an email using EWS.
import logging import demistomock as demisto import pytest import EWSMailSender from exchangelib.errors import UnauthorizedError class MockAccount: def __init__(self, primary_smtp_address="", error=401): self.primary_smtp_address = primary_smtp_address self.error = error @property def root(self): if self.error == 401: raise UnauthorizedError('Wrong username or password') if self.error == 404: raise Exception('Page not found') def test_prepare(): res = EWSMailSender.prepare() assert res.server == 'outlook.office365.com' def test_start_logging(): EWSMailSender.start_logging() logging.getLogger().debug("test this") assert "test this" in EWSMailSender.log_stream.getvalue() def test_get_account_unauthorized_error(mocker): """ Given: Incorrect credentials When: Creating an Account Then: Verify we've tried 3 times to create an account And we put it to the debug.log """ mocker.patch.object(EWSMailSender, 'Account', return_value=MockAccount(error=401)) demisto_debug = mocker.patch.object(demisto, 'debug') EWSMailSender.get_account('test@test.com') assert demisto_debug.call_args.args[0] == 'Got unauthorized error, This is attempt number 3' def test_get_account_not_found_error(mocker): """ Given: Incorrect endpoint When: Creating an Account Then: Verify we do not try 3 times to create an Account And the debug.log is empty """ mocker.patch.object(EWSMailSender, 'Account', return_value=MockAccount(error=404)) demisto_debug = mocker.patch.object(demisto, 'debug') with pytest.raises(Exception) as e: EWSMailSender.get_account('test@test.com') assert str(e.value) == 'Page not found' assert not demisto_debug.call_args def test_send_mail(mocker): """ Given - to, subject and replyTo arguments to send an email. When - trying to send an email Then - verify the context output is returned correctly and that the 'to' and 'replyTo' arguments were sent as a list of strings. """ from EWSMailSender import send_email mocker.patch.object(EWSMailSender, 'Account', return_value=MockAccount(primary_smtp_address="test@gmail.com")) send_email_mocker = mocker.patch.object(EWSMailSender, 'send_email_to_mailbox') result = send_email(to="test@gmail.com", subject="test", replyTo="test1@gmail.com,test2@gmail.com,test3@gmail.com") assert send_email_mocker.call_args.kwargs.get('to') == ['test@gmail.com'] assert send_email_mocker.call_args.kwargs.get('reply_to') == [ 'test1@gmail.com', 'test2@gmail.com', 'test3@gmail.com' ] assert result.get('Contents') == { 'from': 'test@gmail.com', 'to': ['test@gmail.com'], 'subject': 'test', 'attachments': [] } def test_send_mail_with_trailing_comma(mocker): """ Given - a 'subject' which is 'test' and 'to' which is 'test@gmail.com,' (ending with a comma), When - trying to send an email Then - verify that the 'to' field was extracted correctly and that the trailing comma was handled. """ from EWSMailSender import send_email mocker.patch.object(EWSMailSender, 'Account', return_value=MockAccount(primary_smtp_address="test@gmail.com")) send_email_mocker = mocker.patch.object(EWSMailSender, 'send_email_to_mailbox') result = send_email(to="test@gmail.com,", subject="test") assert send_email_mocker.call_args.kwargs.get('to') == ['test@gmail.com'] assert result.get('Contents') == { 'from': 'test@gmail.com', 'to': ['test@gmail.com'], 'subject': 'test', 'attachments': [] }