EWS Extension Online Powershell v3

Use the EWS Extension Online Powershell v3 integration to get information about mailboxes and users in your organization.
This integration was integrated and tested with version v3 of EWS Extension Online Powershell v3

Note: This integration does not replace the O365 - EWS - Extension integration, but an additional EWS extension integration
which utilizes the EXO v3 module.

Configure EWS Extension Online Powershell v3 in Cortex

App authentication

To use this integration, you need to connect an application with a certificate.

1. Create the application:
   1. Access Azure AD portal.
   2. Navigate to Home > App registrations.
   3. Click New Registration, give the application a name (for example: EWS) and click Register.
   4. In the left menu of the newly created application, click API permissions.
   5. Click Add a permission.
   6. In the Request API permissions page, click APIs my organization uses.
   7. Search for Office 365 Exchange Online.
   8. Click Application permissions.
   9. Under Exchange, click the ExchangeManageAsApp checkbox.
   10. Click Add permissions.
   11. Click Grant admin consent.
2. Create the certificate in Cortex XSOAR/XSIAM.

   1. Run the CreateCertificate command in the Playground to acquire the certificate.

      !CreateCertificate days=<# of days> password=password

   Note: Remember your password since you will need it to create your integration instance.

   1. Download the certificateBase34.txt file.
   2. Open the downloaded txt file and copy the text.
   3. In the integration instance configuration, paste the text in the Certificate field.
3. Attach the .cer file to your Azure app.
   1. In the Cortex XSOAR/XSIAM Playground, download the publickey.cer file
   2. In the Azure application, in the left menu, click Certificates & secrets.
   3. In the Certificates tab, upload the publickey.cer file.
4. Assign Azure AD roles to the application.
   1. You have two options:
      • Assign Azure AD roles to the application.
      • Assign custom role groups to the application using service principals.
   2. In the Azure AD portal, search for Microsoft Entra roles and administrators in the Search box.
   3. On the Roles and administrators page that opens, find and select one of the supported roles by clicking on the
      name of the role (not the checkbox) in the results.
      • The role Security Administrator is eligible for this integration.
   4. On the Assignments page that opens, select Add assignments.
   5. In the Add assignments flyout that opens, find and select the app that you created in Step 1.

Note: The information in the Playground is sensitive information. You should delete the information by running the following command:

!DeleteContext all=yes

1. In Cortex XSOAR/XSIAM, in the integration instance configuration, enter your saved password in the Password field.
2. In Azure, go to Entra ID (Overview blade) and copy the Primary domain field.
3. In Cortex XSOAR/XSIAM, in the integration instance configuration, paste the Domain name in The organization used in app-only authentication field.
4. In the Azure app, navigate to Home > App registration > application name and copy the Application (client) ID.
5. In Cortex XSOAR/XSIAM, in the integration instance configuration, paste the application ID in The application ID from the Azure portal field.

Verify that the admin account has sufficient Exchange Online permissions

For the integration to work, the Azure AD application’s service principal must have the correct permissions assigned in the Exchange Online role groups.

1. Open the Microsoft Purview Portal: https://purview.microsoft.com/
2. Log in using an admin account that can manage role assignments for the Azure AD application (for example, a Global Administrator or Privileged Role Administrator).
3. In the top bar, select: Settings → Roles and scopes
4. In the left sidebar, select: Role Groups
5. Search for the following role groups:
   • Organization Management – the most privileged role and fully supported for this integration.
   • Security Administrator – a highly privileged security role that also provides full access.
6. Open the role and verify that the service principal of the Azure AD application used by the integration is listed.
7. If not listed, click Edit → Add Users and assign the required roles.

• Note - for more information go to the official Microsoft Documentation.

Troubleshooting and Testing

Common Issues and Solutions

The role assigned to application 'app-id' isn't supported in this scenario.

Scenario:
When running ‘Test’, you receive the error:
“The role assigned to application app-id isn’t supported in this scenario. Please check online documentation for assigning correct Directory Roles to Azure AD Application for EXO App-Only Authentication.”

Solution:
Verify that the application has the correct directory role assigned in the Entra ID portal.
See the “App authentication” section above for detailed guidance.

The term 'cmdlet' is not recognized as a name of a cmdlet…

Scenario:
When running a command, you receive an error similar to:
“The term cmdlet is not recognized as a name of a cmdlet, function, script file, or executable program…”

Solution:
Make sure the service principal of the Azure AD application used by the integration has sufficient Exchange Online permissions.
Refer to the “Exchange Online permissions” section above to confirm the correct roles are assigned and detailed guidance.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ews-mailbox-list

Displays mailbox objects and attributes, populate property pages, or supplies mailbox information to other tasks.

Base Command

ews-mailbox-list

Input

Context Output

Command Example

!ews-mailbox-list limit=1

Context Example

{
    "EWS": {
        "Mailbox": {
            "Alias": "user",
            "DisplayName": "User User",
            "DistinguishedName": "CN=user,OU=example.com,OU=Microsoft Exchange Hosted Organizations,DC=EURPR07A005,DC=PROD,DC=OUTLOOK,DC=COM",
            "EmailAddresses": [
                "SPO:SPO_SPO0@SPO_SPO1",
                "SIP:user@example.com",
                "SMTP:user@example.com"
            ],
            "ExchangeVersion": "0.20 (15.0.0)",
            "ExternalDirectoryObjectId": "<ExternalDirectoryObjectId>",
            "Guid": "<Guid>",
            "Id": "user",
            "Identity": "user",
            "Name": "user",
            "OrganizationId": "EURPR07A005.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/example.com - EURPR07A005.PROD.OUTLOOK.COM/ConfigurationUnits/example.com/Configuration",
            "PrimarySmtpAddress": "user@example.com",
            "RecipientType": "UserMailbox",
            "RecipientTypeDetails": "UserMailbox",
            "UserPrincipalName": "user@example.com"
        }
    }
}

Human Readable Output

Results of ews-mailbox-list

Alias	DisplayName	DistinguishedName	EmailAddresses	ExchangeVersion	ExternalDirectoryObjectId	Guid	Id	Identity	Name	OrganizationId	PrimarySmtpAddress	RecipientType	RecipientTypeDetails	UserPrincipalName
“user”	“User User”	“CN=user,OU=example.com,OU=Microsoft Exchange Hosted Organizations,DC=EURPR07A005,DC=PROD,DC=OUTLOOK,DC=COM”	[“SPO:SPO_cac4b654-5fcf-44f0-818e-479cf8ae42ac@SPO_SP01”,”SIP:user@example.com”,”SMTP:user@example.com”]	“0.20 (15.0.0)”	“3fa9f28b-eb0e-463a-ba7b-8089fe9991e2”	{“value”:”042e60ea-0683-41a2-a149-ca4b682dcdda”,”Guid”:”042e60ea-0683-41a2-a149-ca4b682dcdda”}	“user”	“user”	“user”	“EURPR07A005.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/example.com - EURPR07A005.PROD.OUTLOOK.COM/ConfigurationUnits/example.com/Configuration”	“user@example.com”	“UserMailbox”	“UserMailbox”	“user@example.com”

ews-cas-mailbox-list

Displays Client Access settings that are configured on mailboxes.

Base Command

ews-cas-mailbox-list

Input

Context Output

Command Example

!ews-cas-mailbox-list limit=1

Context Example

{
    "EWS": {
        "CASMailbox": {
            "ActiveSyncEnabled": true,
            "DisplayName": "User User",
            "ECPEnabled": true,
            "EmailAddresses": [
                "SPO:SPO_SPO0@SPO_SPO1",
                "SIP:user@example.com",
                "SMTP:user@example.com"
            ],
            "EwsEnabled": true,
            "ExchangeVersion": "0.20 (15.0.0)",
            "ExternalDirectoryObjectId": "<ExternalDirectoryObjectId>",
            "Guid": "<Guid>",
            "Identity": "user",
            "ImapEnabled": true,
            "MAPIEnabled": true,
            "Name": "user",
            "OWAEnabled": true,
            "OrganizationId": "EURPR07A005.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/example.com - EURPR07A005.PROD.OUTLOOK.COM/ConfigurationUnits/example.com/Configuration",
            "PopEnabled": true,
            "PrimarySmtpAddress": "user@example.com",
            "ServerLegacyDN": "/o=ExchangeLabs/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=DBXPR07MB383"
        }
    }
}

Human Readable Output

Results of ews-cas-mailbox-list

ActiveSyncEnabled	DisplayName	ECPEnabled	EmailAddresses	EwsEnabled	ExchangeVersion	ExternalDirectoryObjectId	Guid	Identity	ImapEnabled	MAPIEnabled	Name	OrganizationId	OWAEnabled	PopEnabled	PrimarySmtpAddress	ServerLegacyDN
true	“User User”	true	[“SPO:SPO_cac4b654-5fcf-44f0-818e-479cf8ae42ac@SPO_SP01”,”SIP:user@example.com”,”SMTP:user@example.com”]	true	“0.20 (15.0.0)”	“3fa9f28b-eb0e-463a-ba7b-8089fe9991e2”	{“value”:”042e60ea-0683-41a2-a149-ca4b682dcdda”,”Guid”:”042e60ea-0683-41a2-a149-ca4b682dcdda”}	“user”	true	true	“user”	“EURPR07A005.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/example.com - EURPR07A005.PROD.OUTLOOK.COM/ConfigurationUnits/example.com/Configuration”	true	true	“user@example.com”	“/o=ExchangeLabs/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=DBXPR07MB383

ews-mailbox-permission-list

Retrieves permissions on a mailbox.

Base Command

ews-mailbox-permission-list

Input

Context Output

Command Example

!ews-mailbox-permission-list identity=user

Context Example

{
    "EWS": {
        "MailboxPermission": {
            "Identity": "user",
            "Permission": {
                "AccessRights": [
                    "FullAccess",
                    "ReadPermission"
                ],
                "Deny": {
                    "IsPresent": false
                },
                "Identity": "user",
                "InheritanceType": "All",
                "IsInherited": false,
                "User": "NT AUTHORITY\\SELF"
            }
        }
    }
}

Human Readable Output

Results of ews-mailbox-permission-list

AccessRights	Deny	Identity	InheritanceType	IsInherited	User
[“FullAccess”,”ReadPermission”]	{“IsPresent”:false}	“user”	“All”	false	“NT AUTHORITY\SELF”

ews-recipient-permission-list

Displays information about SendAs permissions that are configured for users.

Base Command

ews-recipient-permission-list

Input

Context Output

Command Example

!ews-recipient-permission-list identity=<Guid>

Context Example

{
    "EWS": {
        "RecipientPermission": {
            "AccessControlType": "Allow",
            "AccessRights": [
                1
            ],
            "Identity": "user",
            "InheritanceType": "None",
            "IsInherited": false,
            "Trustee": "NT AUTHORITY\\SELF"
        }
    }
}

Human Readable Output

Results of ews-mailbox-permission-list

AccessRights	Deny	Identity	InheritanceType	IsInherited	User
[“FullAccess”,”ReadPermission”]	{“IsPresent”:false}	“user”	“All”	false	“NT AUTHORITY\SELF”

ews-recipient-list

Displays existing recipient objects in your organization. This command returns all mail-enabled objects (for example, mailboxes, mail users, mail contacts, and distribution groups).

Base Command

ews-recipient-list

Input

Context Output

Command Example

!ews-recipient-list identity=<ExternalDirectoryObjectId>

Context Example

{
    "EWS": {
        "Recipient": {
            "Alias": "user",
            "DisplayName": "User User",
            "DistinguishedName": "CN=user,OU=example.com,OU=Microsoft Exchange Hosted Organizations,DC=EURPR07A005,DC=PROD,DC=OUTLOOK,DC=COM",
            "EmailAddresses": [
                "SPO:SPO_SPO0@SPO_SPO1",
                "SIP:user@example.com",
                "SMTP:user@example.com"
            ],
            "ExchangeVersion": "0.20 (15.0.0)",
            "ExternalDirectoryObjectId": "<ExternalDirectoryObjectId>",
            "Identity": "user",
            "Name": "user",
            "OrganizationId": "EURPR07A005.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/example.com - EURPR07A005.PROD.OUTLOOK.COM/ConfigurationUnits/example.com/Configuration",
            "PrimarySmtpAddress": "user@example.com",
            "RecipientType": "UserMailbox",
            "RecipientTypeDetails": "UserMailbox"
        }
    }
}

Human Readable Output

Results of ews-recipient-list

Alias	DisplayName	DistinguishedName	EmailAddresses	ExchangeVersion	ExternalDirectoryObjectId	Identity	Name	OrganizationId	PrimarySmtpAddress	RecipientType	RecipientTypeDetails
“user”	“user”	“CN=user_Identity,OU=example.com,OU=Microsoft Exchange Hosted Organizations,DC=EURPR07A005,DC=PROD,DC=OUTLOOK,DC=COM”	[“SPO:SPO_SP00@SPO_SP01”,”SMTP:user@example.com”]	“0.10 (14.0.100)”	“Identity”	“user_Identity”	“user_Identity”	“EURPR07A005.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/example.com - EURPR07A005.PROD.OUTLOOK.COM/ConfigurationUnits/example.com/Configuration”	“user@example.com”	“MailUniversalDistributionGroup”	“GroupMailbox”

ews-new-tenant-allow-block-list-items

Add new items to the Tenant Allow/Block Lists. Uses PowerShell New-TenantAllowBlockListItems cmdlet.

Official PowerShell cmdlet documentation here

Base Command

ews-new-tenant-allow-block-list-items

Input

Context Output

Command Example

!ews-new-tenant-allow-block-list-items action=Block list_type=sender entries="attacker@phishingsite.com" notes="Email observed in a phishing campaign."

Context Example

{
    "Action": "Block",
    "EntryValueHash": "d568L6iokOxrYqB2L1CxcKy6S6A/tCDoQQJal33AFWo=",
    "Error": null,
    "ExpirationDate": "2022-06-15T19:30:52.6071551Z",
    "Identity": "RgAAAAAuoyIuRcZsTKgZbIQyJWZUBwA02rlnO0nOR5RO-QI-xRP9AAAAAAEVAAA02rlnO0nOR5RO-QI-xRP9AAADfzPhAAAA0",
    "LastModifiedDateTime": "2022-05-16T19:30:52.7320883Z",
    "ListSubType": "Tenant",
    "ModifiedBy": "",
    "Notes": "Email observed in a phishing campaign.",
    "ObjectState": "New",
    "PSComputerName": "outlook.office365.com",
    "PSShowComputerName": false,
    "RunspaceId": "fe0186a8-6ce6-487d-bd65-a9869f60ffcd",
    "SubmissionID": "",
    "SysManaged": false,
    "Value": "attacker@phishingsite.com"
}

Human Readable Output

Results of ews-new-tenant-allow-block-list-items

Action	EntryValueHash	Error	ExpirationDate	Identity	LastModifiedDateTime	ListSubType	ModifiedBy	Notes	ObjectState	PSComputerName	PSShowComputerName	RunspaceId	SubmissionID	SysManaged	Value
Block	d568L6iokOxrYqB2L1CxcKy6S6A/tCDoQQJal33AFWo=		{“value”:”2022-06-15T19:34:01.2028448Z”,”DateTime”:”Wednesday, June 15, 2022 7:34:01 PM”}	RgAAAAAuoyIuRcZsTKgZbIQyJWZUBwA02rlnO0nOR5RO-QI-xRP9AAAAAAEVAAA02rlnO0nOR5RO-QI-xRP9AAADfzPiAAAA0	{“value”:”2022-05-16T19:34:01.2652934Z”,”DateTime”:”Monday, May 16, 2022 7:34:01 PM”}	Tenant		Email observed in a phishing campaign.	New	outlook.office365.com	false	{“value”:”8f736b87-f951-4b6b-aa21-e358720c44e3”,”Guid”:”8f736b87-f951-4b6b-aa21-e358720c44e3”}		false	attacker@phishingsite.com

ews-get-tenant-allow-block-list-items

Retrieve current Tenant Allow/Block List items. Uses Get-TenantAllowBlockListItems cmdlet.

Official PowerShell cmdlet documentation here

Base Command

ews-get-tenant-allow-block-list-items

Input

Context Output

Command Example

!ews-get-tenant-allow-block-list-items action=Block list_type=sender

Context Example

[
    {
        "Action": "Block",
        "EntryValueHash": "d568L6iokOxrYqB2L1CxcKy6S6A/tCDoQQJal33AFWo=",
        "Error": null,
        "ExpirationDate": "2022-06-15T19:34:01.2028448Z",
        "Identity": "RgAAAAAuoyIuRcZsTKgZbIQyJWZUBwA02rlnO0nOR5RO-QI-xRP9AAAAAAEVAAA02rlnO0nOR5RO-QI-xRP9AAADfzPiAAAA0",
        "LastModifiedDateTime": "2022-05-16T19:34:01.2652934Z",
        "ListSubType": "Tenant",
        "ModifiedBy": "",
        "Notes": "Email observed in a phishing campaign.",
        "ObjectState": "Unchanged",
        "PSComputerName": "outlook.office365.com",
        "PSShowComputerName": false,
        "RunspaceId": "010da4cf-2d47-4b8a-a882-4bd6885faff1",
        "SubmissionID": "",
        "SysManaged": false,
        "Value": "attacker@phishingsite.com"
    }
]

Human Readable Output

Results of ews-get-tenant-allow-block-list-items

Action	EntryValueHash	Error	ExpirationDate	Identity	LastModifiedDateTime	ListSubType	ModifiedBy	Notes	ObjectState	PSComputerName	PSShowComputerName	RunspaceId	SubmissionID	SysManaged	Value
Block	d568L6iokOxrYqB2L1CxcKy6S6A/tCDoQQJal33AFWo=		{“value”:”2022-06-15T19:34:01.2028448Z”,”DateTime”:”Wednesday, June 15, 2022 7:34:01 PM”}	RgAAAAAuoyIuRcZsTKgZbIQyJWZUBwA02rlnO0nOR5RO-QI-xRP9AAAAAAEVAAA02rlnO0nOR5RO-QI-xRP9AAADfzPiAAAA0	{“value”:”2022-05-16T19:34:01.2652934Z”,”DateTime”:”Monday, May 16, 2022 7:34:01 PM”}	Tenant		Email observed in a phishing campaign.	Unchanged	outlook.office365.com	false	{“value”:”feada07c-99b7-48e9-a562-a755073522ff”,”Guid”:”feada07c-99b7-48e9-a562-a755073522ff”}		false	attacker@phishingsite.com

ews-get-tenant-allow-block-list-count

Retrieve current count of defined Tenant Allow/Block List items. Uses Get-TenantAllowBlockListItems cmdlet.

Official PowerShell cmdlet documentation here

Base Command

ews-get-tenant-allow-block-list-count

Input

Context Output

Command Example

!ews-get-tenant-allow-block-list-count list_type=sender

Context Example

{
    "Count": 2,
    "ListSubType": "Tenant",
    "ListType": "sender"
}

Human Readable Output

Results of ews-get-tenant-allow-block-list-count

Count	ListSubType	ListType
2	Tenant	sender

ews-remove-tenant-allow-block-list-items

Remove items from the Tenant Allow/Block Lists. You can delete items by their value or by unique ID. Uses PowerShell cmdlet Remove-TenantAllowBlockListItems cmdlet.

Official PowerShell cmdlet documentation here

Base Command

ews-remove-tenant-allow-block-list-items

Input

Context Output

Command Example

!ews-remove-tenant-allow-block-list-items list_type=sender entries="attacker2@phishingsite.com"

Context Example

{
    "Action": "0",
    "EntryValueHash": null,
    "Error": null,
    "ExpirationDate": null,
    "Identity": "",
    "LastModifiedDateTime": null,
    "ListSubType": null,
    "ModifiedBy": null,
    "Notes": null,
    "ObjectState": "Deleted",
    "PSComputerName": "outlook.office365.com",
    "PSShowComputerName": false,
    "RunspaceId": "efa88be5-7342-4b77-af2f-99dd2d914300",
    "SubmissionID": null,
    "SysManaged": null,
    "Value": "attacker2@phishingsite.com"
}

Human Readable Output

Results of ews-remove-tenant-allow-block-list-items

Action	EntryValueHash	Error	ExpirationDate	Identity	LastModifiedDateTime	ListSubType	ModifiedBy	Notes	ObjectState	PSComputerName	PSShowComputerName	RunspaceId	SubmissionID	SysManaged	Value
0									Deleted	outlook.office365.com	false	{“value”:”cd58060e-d033-4cdb-814e-9f9748fdf78c”,”Guid”:”cd58060e-d033-4cdb-814e-9f9748fdf78c”}			attacker@phishingsite.com

ews-export-quarantinemessage

Export quarantine messages.

Base Command

ews-export-quarantinemessage

Input

Context Output

Command Example

!ews-export-quarantinemessage identity="12345678-beef-dead-beef-0123456789ab\\c0ffee13-beef-dead-beef-0123456789ab"

Context Example

{
    "BodyEncoding": "Base64",
    "Eml": "TmV2ZXIgZ29ubmEgZ2l2ZSB5b3UgdXAsIG5ldmVyIGdvbm5hIGxldCB5b3UgZG93biwgbmV2ZXIgZ29ubmEgcnVuIGFyb3VuZCBhbmQgZGVzZXJ0IHlvdQo=",
    "Identity": "12345678-beef-dead-beef-0123456789ab\\c0ffee13-beef-dead-beef-0123456789ab",
    "Organization": "c0ffee13-beef-dead-beef-0123456789ab"
}

Human Readable Output

Results of ews-export-quarantinemessage

BodyEncoding	Eml	Identity	Organization
Base64	TmV2ZXIgZ29ubmEgZ2l2ZSB5b3UgdXAsIG5ldmVyIGdvbm5hIGxldCB5b3UgZG93biwgbmV2ZXIgZ29ubmEgcnVuIGFyb3VuZCBhbmQgZGVzZXJ0IHlvdQo=	12345678-beef-dead-beef-0123456789ab\c0ffee13-beef-dead-beef-0123456789ab	c0ffee13-beef-dead-beef-0123456789ab

ews-get-quarantinemessage

Retrieve quarantine messages.

Base Command

ews-get-quarantinemessage

Input

Context Output

Command Example

#### Context Example

```json
{
[
    {
        "ApprovalId": "",
        "ApprovalUPN": "",
        "CustomData": null,
        "DeletedForRecipients": [],
        "Direction": "Outbound",
        "EntityType": "Email",
        "Expires": "2024-07-18T13:20:02.7166413+00:00",
        "Identity": "12345678-beef-dead-beef-0123456789ab\\c0ffee13-beef-dead-beef-0123456789ab",
        "MessageId": "\u003c12345678-beef-dead-beef-0123456789ab@123456.789a.bcde.example.com\u003e",
        "MoveToQuarantineAdminActionTakenBy": "",
        "MoveToQuarantineApprovalId": "",
        "Organization": "c0ffee13-beef-dead-beef-0123456789ab",
        "OverrideReason": "None",
        "OverrideReasonIntValue": 0,
        "PermissionToAllowSender": true,
        "PermissionToBlockSender": false,
        "PermissionToDelete": true,
        "PermissionToDownload": true,
        "PermissionToPreview": true,
        "PermissionToRelease": true,
        "PermissionToRequestRelease": false,
        "PermissionToViewHeader": false,
        "PolicyName": "Default",
        "PolicyType": "HostedContentFilterPolicy",
        "QuarantineTypes": "HighConfPhish",
        "QuarantinedUser": [],
        "ReceivedTime": "2024-07-02T13:20:02.7166413+00:00",
        "RecipientAddress": [
            "admin@example.com"
        ],
        "RecipientCount": 1,
        "RecipientTag": [
            ""
        ],
        "ReleaseStatus": "NOTRELEASED",
        "Released": false,
        "ReleasedBy": [],
        "ReleasedCount": 0,
        "ReleasedUser": [],
        "Reported": false,
        "SenderAddress": "alerts@example.com",
        "Size": 31218,
        "SourceId": "",
        "Subject": "Informational-severity alert: Tenant Allow/Block List entry is about to expire",
        "SystemReleased": false,
        "TagName": "AdminOnlyAccessPolicy",
        "TeamsConversationType": "",
        "Type": "High Confidence Phish"
    },
    {
        "ApprovalId": "",
        "ApprovalUPN": "",
        "CustomData": null,
        "DeletedForRecipients": [],
        "Direction": "Inbound",
        "EntityType": "Email",
        "Expires": "2024-07-13T10:59:12.7581841+00:00",
        "Identity": "12345678-beef-dead-beef-0123456789ac\\c0ffee13-beef-dead-beef-0123456789ac",
        "MessageId": "\u003c12345678-beef-dead-beef-0123456789ac@123456.789a.bcde.example.com\u003e",
        "MoveToQuarantineAdminActionTakenBy": "",
        "MoveToQuarantineApprovalId": "",
        "Organization": "c0ffee13-beef-dead-beef-0123456789ac",
        "OverrideReason": "None",
        "OverrideReasonIntValue": 0,
        "PermissionToAllowSender": true,
        "PermissionToBlockSender": false,
        "PermissionToDelete": true,
        "PermissionToDownload": true,
        "PermissionToPreview": true,
        "PermissionToRelease": true,
        "PermissionToRequestRelease": false,
        "PermissionToViewHeader": false,
        "PolicyName": "testing_quarantine_release",
        "PolicyType": "HostedContentFilterPolicy",
        "QuarantineTypes": "HighConfPhish",
        "QuarantinedUser": [],
        "ReceivedTime": "2024-06-28T10:59:12.7581841+00:00",
        "RecipientAddress": [
            "user@example.com"
        ],
        "RecipientCount": 1,
        "RecipientTag": [
            ""
        ],
        "ReleaseStatus": "RELEASED",
        "Released": true,
        "ReleasedBy": [
            "SystemMailbox{deadbeef-dead-beef-dead-beefdeadbeef}@example.com"
        ],
        "ReleasedCount": 1,
        "ReleasedUser": [],
        "Reported": false,
        "SenderAddress": "sender@example.com",
        "Size": 14781,
        "SourceId": "",
        "Subject": "Check the inbox",
        "SystemReleased": false,
        "TagName": "testing_release",
        "TeamsConversationType": "",
        "Type": "High Confidence Phish"
    }
]
}

Human Readable Output

Results of ews-get-quarantinemessage

ApprovalId	ApprovalUPN	CustomData	DeletedForRecipients	Direction	EntityType	Expires	Identity	MessageId	MoveToQuarantineAdminActionTakenBy	MoveToQuarantineApprovalId	Organization	OverrideReason	OverrideReasonIntValue	PermissionToAllowSender	PermissionToBlockSender	PermissionToDelete	PermissionToDownload	PermissionToPreview	PermissionToRelease	PermissionToRequestRelease	PermissionToViewHeader	PolicyName	PolicyType	QuarantineTypes	QuarantinedUser	ReceivedTime	RecipientAddress	RecipientCount	RecipientTag	ReleaseStatus	Released	ReleasedBy	ReleasedCount	ReleasedUser	Reported	SenderAddress	Size	SourceId	Subject	SystemReleased	TagName	TeamsConversationType	Type
				Outbound	Email	2024-07-18T13:20:02.7166413+00:00	12345678-beef-dead-beef-0123456789ab\c0ffee13-beef-dead-beef-0123456789ab	\u003c12345678-beef-dead-beef-0123456789ab@123456.789a.bcde.example.com\u003e			c0ffee13-beef-dead-beef-0123456789ab	None	0	true	false	true	true	true	true	false	false	Default	HostedContentFilterPolicy	HighConfPhish	[]	2024-07-02T13:20:02.7166413+00:00	[“admin@example.com”]	1	[””]	NOTRELEASED	false	[]	0	[]	false	alerts@example.com	31218		Informational-severity alert: Tenant Allow/Block List entry is about to expire	false	AdminOnlyAccessPolicy		High Confidence Phish
				Inbound	Email	2024-07-13T10:59:12.7581841+00:00	12345678-beef-dead-beef-0123456789ac\c0ffee13-beef-dead-beef-0123456789ac	\u003c12345678-beef-dead-beef-0123456789ac@123456.789a.bcde.example.com\u003e			c0ffee13-beef-dead-beef-0123456789ac	None	0	true	false	true	true	true	true	false	false	testing_quarantine_release	HostedContentFilterPolicy	HighConfPhish	[]	2024-06-28T10:59:12.7581841+00:00	[“user@example.com”]	1	[””]	RELEASED	true	[“SystemMailbox{deadbeef-dead-beef-dead-beefdeadbeef}@example.com”]	1	[]	false	sender@example.com	14781		Check the inbox	false	testing_release		High Confidence Phish

ews-release-quarantinemessage

Releases the quarantined messages. Uses the PowerShell Release-QuarantineMessage cmdlet.

Base Command

#### Input

| **Argument Name**      | **Description**                                            | **Required** |
|------------------------|------------------------------------------------------------|--------------|
| user                   | The email address of the user you want to release the quarantined message to.           | Optional |
| identities             | A comma-separated list of identities of the messages to release. | Optional |
| identity               | The identity of a single message to release.               | Optional |
| release_to_all         | Specify whether to release the message to all recipients.  | Optional |
| allow_sender           | Specify whether to allow the sender.                       | Optional |
| entity_type            | The entity workload type being released.                         | Optional |
| force                  | Specify whether to force the release.                      | Optional |
| report_false_positive  | Specify whether to report the message as a false positive. | Optional |
| action_type            | The action to perform on the quarantined message.     | Optional |

#### Context Output

There are no context outputs for this command.

#### Human Readable Output
>
>The message with identity 12345678-beef-dead-beef-0123456789ab\\c0ffee13-beef-dead-beef-0123456789ab has been sent for release from quarantine.

### ews-junk-rules-get

***
Gets junk rules for the specified mailbox.

#### Base Command

`ews-junk-rules-get`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| mailbox | ID of the mailbox for which to get junk rules. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| EWS.Rule.Junk.BlockedSendersAndDomains | String | Blocked senders and domains list. |
| EWS.Rule.Junk.ContactsTrusted | Boolean | If true, contacts are trusted by default. |
| EWS.Rule.Junk.Email | String | Junk rule mailbox. |
| EWS.Rule.Junk.Enabled | Boolean | If true, junk rule is enabled. |
| EWS.Rule.Junk.Identity | String | Junk rule identity. |
| EWS.Rule.Junk.MailboxOwnerId | String | Mail box owner ID. |
| EWS.Rule.Junk.TrustedListsOnly | Boolean | If true, only a list defined in the trusted lists are trusted. |
| EWS.Rule.Junk.TrustedRecipientsAndDomains | String | List of trusted recipients and domains. |
| EWS.Rule.Junk.TrustedSendersAndDomains | String | List of trusted senders and domains. |

#### Command Example

```!ews-junk-rules-get mailbox="xsoar@dev.onmicrosoft.com"```

#### Context Example

```json
{
    "EWS": {
        "Rule": {
            "Junk": {
                "BlockedSendersAndDomains": [
                    "user1@gmail.com",
                    "user2@gmail.com"
                ],
                "ContactsTrusted": false,
                "Enabled": false,
                "Identity": "xsoar",
                "MailboxOwnerId": "xsoar",
                "TrustedListsOnly": false,
                "TrustedRecipientsAndDomains": [
                  "user1@gmail.com",
                  "user2@gmail.com"
                ],
                "TrustedSendersAndDomains": [
                  "user1@gmail.com",
                  "user2@gmail.com"
                ]
            }
        }
    }
}

Human Readable Output

EWS extension - ‘xsoar@dev.onmicrosoft.com’ Junk rules

BlockedSendersAndDomains	ContactsTrusted	Enabled	TrustedListsOnly	TrustedSendersAndDomains
[“user1@gmail.com”,”user2@gmail.com”]	False	False	False	[“user1@gmail.com”,”user2@gmail.com”]

ews-junk-rules-set

Sets junk rules for the specified mailbox.

Base Command

ews-junk-rules-set

Input

Context Output

There is no context output for this command.

Command Example

!ews-junk-rules-set mailbox="xsoar@dev.onmicrosoft.com" add_blocked_senders_and_domains="test@gmail.com" add_trusted_senders_and_domains="dev.onmicrosoft.com"

Human Readable Output

EWS extension - ‘xsoar@dev.onmicrosoft.com’ Junk rules modified!

ews-global-junk-rules-set

Sets junk rules in all managed accounts.

Base Command

ews-global-junk-rules-set

Input

Context Output

There is no context output for this command.

Command Example

!ews-global-junk-rules-set add_blocked_senders_and_domains="test@demisto.com" add_trusted_senders_and_domains="demisto.com"

Human Readable Output

EWS extension - Junk rules globally modified!

ews-message-trace-get

Searches message data for the last 10 days. If you run this command without any arguments, only data from the last 48 hours is returned.
If you enter a start date that is older than 10 days, you will receive an error and the command will return no results.
This command returns a maximum of 1,000,000 results, and will timeout on very large queries. If your query returns too many results, consider splitting it up using shorter start_date and end_date intervals.

Base Command

ews-message-trace-get

Input

Context Output

Command Example

#### Context Example

```json
{
    "EWS": {
        "MessageTrace": [
            {
                "EndDate": "2021-01-03T06:14:14.9596257Z",
                "FromIP": "8.8.8.8",
                "Index": 1,
                "MessageId": "xxx",
                "MessageTraceId": "xxxx",
                "Organization": "dev.onmicrosoft.com",
                "Received": "2021-01-03T04:45:36.4662406",
                "RecipientAddress": "xsoar@dev.onmicrosoft.com",
                "SenderAddress": "xsoar@dev.onmicrosoft.com",
                "Size": 1882,
                "StartDate": "2021-01-01T06:14:14.9596257Z",
                "Status": "GettingStatus",
                "Subject": "Test mail",
                "ToIP": null
            },
            {
                "EndDate": "2021-01-03T06:15:14.9596257Z",
                "FromIP": "8.8.8.8",
                "Index": 2,
                "MessageId": "xxx",
                "MessageTraceId": "xxxx",
                "Organization": "dev.onmicrosoft.com",
                "Received": "2021-01-03T04:46:36.4662406",
                "RecipientAddress": "xsoar@dev.onmicrosoft.com",
                "SenderAddress": "xsoar@dev.onmicrosoft.com",
                "Size": 1882,
                "StartDate": "2021-01-01T06:15:14.9596257Z",
                "Status": "GettingStatus",
                "Subject": "Test mail",
                "ToIP": null
            }
        ]
    }
}

Human Readable Output

EWS extension - Messages trace

EndDate	FromIP	Index	MessageId	MessageTraceId	Organization	Received	RecipientAddress	SenderAddress	Size	StartDate	Status	Subject	ToIP
1/3/2021 6:14:14 AM	8.8.8.8	0	xxx	xxxx	microsoft.com	1/3/2021 4:45:36 AM	xsoar@dev.microsoft.com	xsoar@dev.onmicrosoft.com	6975	1/1/2021 6:14:14 AM	Delivered	Test mail
1/3/2021 6:15:14 AM	8.8.8.8	1	xxx	xxxx	microsoft.com	1/3/2021 4:46:36 AM	xsoar@dev.microsoft.com	xsoar@dev.onmicrosoft.com	6975	1/1/2021 6:15:14 AM	Delivered	Test mail

ews-message-trace-list

You can use this command to search message data for the last 90 days. If you run this command without any arguments, only data from the last 48 hours is returned.
You can only return 10 days worth of data per query.
This command returns a maximum of 5,000 results. If your data exceeds the result size, consider splitting it up using shorter start_date and end_date intervals.
For information on how to use pagination, see the Pagination section below.

Pagination Information:
Pagination isn’t supported in this command due to API limitations. To query subsequent data, use the starting_recipient_address and end_date parameters with the values from the Recipient address and Received Time properties respectively of the previous result in the next query.
For more information, Click for the Microsoft API Documentation

Best Practices:

• Use the limit argument to adjust the size of your results.
• Be as precise as possible. Narrow the gap between start_date and end_date and use additional arguments (for example, starting_recipient_address) where possible.
• Use message_id where possible (required for messages sent to more than 1000 recipients).

Base Command

ews-message-trace-list

Input

Context Output

Command Example

#### Context Example

```json
{
"EWS": {
 "MessageTrace": [
            {
                "EndDate": "2021-01-03T06:14:14.9596257Z",
                "FromIP": "8.8.8.8",
                "Index": 1,
                "MessageId": "xxx",
                "MessageTraceId": "xxxx",
                "Organization": "dev.onmicrosoft.com",
                "Received": "2021-01-03T04:45:36.4662406",
                "RecipientAddress": "xsoar@dev.onmicrosoft.com",
                "SenderAddress": "xsoar@dev.onmicrosoft.com",
                "Size": 1882,
                "StartDate": "2021-01-01T06:14:14.9596257Z",
                "Status": "GettingStatus",
                "Subject": "Test mail",
                "ToIP": null
            },
            {
                "EndDate": "2021-01-03T06:15:14.9596257Z",
                "FromIP": "8.8.8.8",
                "Index": 2,
                "MessageId": "xxx",
                "MessageTraceId": "xxxx",
                "Organization": "dev.onmicrosoft.com",
                "Received": "2021-01-03T04:46:36.4662406",
                "RecipientAddress": "xsoar@dev.onmicrosoft.com",
                "SenderAddress": "xsoar@dev.onmicrosoft.com",
                "Size": 1882,
                "StartDate": "2021-01-01T06:15:14.9596257Z",
                "Status": "GettingStatus",
                "Subject": "Test mail",
                "ToIP": null
            }
        ]
    }
}

Human Readable Output

EWS extension - Messages trace

EndDate	FromIP	Index	MessageId	MessageTraceId	Organization	Received	RecipientAddress	SenderAddress	Size	StartDate	Status	Subject	ToIP
1/3/2021 6:14:14 AM	8.8.8.8	0	xxx	xxxx	microsoft.com	1/3/2021 4:45:36 AM	xsoar@dev.microsoft.com	xsoar@dev.onmicrosoft.com	6975	1/1/2021 6:14:14 AM	Delivered	Test mail
1/3/2021 6:15:14 AM	8.8.8.8	1	xxx	xxxx	microsoft.com	1/3/2021 4:46:36 AM	xsoar@dev.microsoft.com	xsoar@dev.onmicrosoft.com	6975	1/1/2021 6:15:14 AM	Delivered	Test mail

ews-federation-trust-get

Displays the federation trust configured for the Exchange organization.

Base Command

ews-federation-trust-get

Input

Context Output

ews-federation-configuration-get

Retrieves the Exchange organization’s federated organization identifier and related details, such as federated domains, organization contact, and status.

Base Command

ews-federation-configuration-get

Input

Context Output

ews-remote-domain-get

Gets the configuration information for the remote domains configured in your organization. This command is available only in the Exchange Online PowerShell V3 module.

Base Command

ews-remote-domain-get

Input

Context Output

ews-user-list

Displays the existing user objects in your organization.

Base Command

ews-user-list

Input

Context Output

ews-mailbox-audit-bypass-association-list

Retrieves information about the AuditBypassEnabled property value for user accounts (on-premises Exchange and the cloud) and computer accounts (on-premises Exchange only).

Base Command

ews-mailbox-audit-bypass-association-list

Input

Context Output

ews-rule-list

Get a list of all mailbox rules.

Base Command

ews-rule-list

Input

Context Output

Human Readable Output

Results of ews-rule-list

Enabled	Name	Priority	RuleIdentity
true	CheckActionRequired	1	1268829516541722625
true	ews phishing test	8	1845290268845146113

ews-get-rule

Get a mailbox rule.

Base Command

ews-get-rule

Input

Context Output

Human Readable Output

Results of ews-rule-list

Enabled	Name	Priority	RuleIdentity	Description	IsValid	StopProcessingRules
true	CheckActionRequired	1	1268829516541722625	If the message: the sender requested any action and my name is in the To box	true	false

ews-remove-rule

Remove a mailbox rule.

Base Command

ews-remove-rule

Input

Context Output

There are no context outputs for this command.

Human Readable Output

Rule 1845290268845146113 has been deleted successfully

ews-rule-disable

Disable an existing inbox rule in a given mailbox.

Base Command

ews-rule-disable

Input

Context Output

There are no context outputs for this command.

Human Readable Output

Rule 1845290268845146113 has been disabled successfully

ews-rule-enable

Enable an existing inbox rule in a given mailbox.

Base Command

ews-rule-enable

Input

Context Output

There are no context outputs for this command.

Human Readable Output

Rule 1845290268845146113 has been enabled successfully

ews-mail-flow-rules-list

List all mail flow rules (transport rules) in the organization.

Base Command

ews-mail-flow-rules-list

Input

Context Output

Human Readable Output

Results of ews-rule-list

Name	State	Priority	Comment	WhenChanged	CreatedBy
demisto	Disabled	1	comment	2019-10-14T07:25:04+00:00	Ed Testmaner
demisto-2	Enabled	2	comment	2019-11-15T010:21:45+00:00	Kemp Kimmons
demisto-3	Enabled	3	comment	2019-11-16T016:26:46+00:00	Barbara Wagner

ews-mail-flow-rule-get

Get a mail flow rule (transport rules) in the organization.

Base Command

ews-mail-flow-rule-get

Input

Context Output

Human Readable Output

Results of ews-rule-list

Name	State	Priority	Comment	WhenChanged	CreatedBy
demisto	Disabled	1	comment	2019-10-14T07:25:04+00:00	Ed Testmaner

ews-mail-flow-rule-remove

Remove a mail flow rule (transport rule) from the organization.

Base Command

ews-mail-flow-rule-remove

Input

Context Output

There are no context outputs for this command.

Human Readable Output

Mail flow rule 1845290268845146113 has been removed successfully

ews-mail-flow-rule-disable

Disable a mail flow rule (transport rule) in the organization.

Base Command

ews-mail-flow-rule-disable

Input

Context Output

There are no context outputs for this command.

Human Readable Output

Mail flow rule 1845290268845146113 has been disabled successfully

ews-mail-flow-rule-enable

Enable a mail flow rule (transport rule) in the organization.

Base Command

ews-mail-flow-rule-enable

Input

Context Output

There are no context outputs for this command.

Human Readable Output

Mail flow rule 1845290268845146113 has been enabled successfully

ews-mail-flow-rule-create

Create a transport rule (mail flow rule) in the organization. A name must always be provided, either through the name argument or as a Name key inside the entry_id file. When no entry_id file is provided, both the name argument and at least one action (reject_message_reason_text, quarantine, or delete_message) are required.

Base Command

ews-mail-flow-rule-create

Input

Context Output

Command example

!ews-mail-flow-rule-create name="My Rule" mode=Enforce priority=0 subject_contains_words="confidential" quarantine=true comments="Created by playbook"

Human Readable Output

Mail flow rule ‘My Rule’ was created successfully

Name	State	Mode	Priority	IsRuleConfigurationSupported	Comments
My Rule	Enabled	Enforce	0	true	Created by playbook

ews-mail-flow-rule-update

Modify an existing transport rule (mail flow rule) in the organization. An identity must always be provided, either through the identity argument or as an Identity key inside the entry_id file. When no entry_id file is provided, the identity argument is required.

Base Command

ews-mail-flow-rule-update

Input

Context Output

There are no context outputs for this command.

Command example

!ews-mail-flow-rule-update identity="My Rule" priority=1 comments="Updated by playbook"

Human Readable Output

Mail flow rule 1845290268845146113 has been updated successfully

ews-mail-forwarding-disable

Disable mail forwarding for a given user.

Base Command

ews-mail-forwarding-disable

Input

Context Output

There are no context outputs for this command.

Human Readable Output

Mail forwarding for user 1845290268845146113 has been disabled successfully

```