Gmail
Gmail API and user management (This integration replaces the Gmail functionality in the GoogleApps API and G Suite integration).
Email · Gmail
Details
| ID | Gmail |
|---|---|
| Provider | |
| Category | |
| From Version | 5.0.0 |
| Docker Image | demisto/google-api-py3:1.0.0.10182333 |
| Supported Modules | Agentix Cloud Runtime Security Cloud Posture Security XSIAM EDR Cortex Cloud |
README
Use the Gmail integration to search and process emails in your organization’s Gmail mailboxes.
This integration replaces the Gmail functionality in the GoogleApps API and G Suite integration.
Prerequisites
You need to do the following in Google before configuring your integration instance in Cortex XSOAR.
- Get a New Private Key
- Enable APIs
- Delegate Domain-wide Authority to Your Service Account
- Get an Immutable Google Apps ID
Get a New Private Key
- Access your Google Service Account.
- In the IAM & admin section select Service accounts.
- If you need to create a new project, click CREATE PROJECT and do the following:
- In the New Project window, type a project name, select an organization from the drop-down list, and then select a location.
- Click CREATE.
-
In the Service accounts section, click + CREATE SERVICE ACCOUNT.
-
In the Create service account dialog, type a name for the service account, add a description, and then click CREATE AND CONTINUE.
- In the Grant this service account access to project section,click Continue.
- In the Grant users access to this service account section, click DONE.
-
In the Actions column for the newly created service account, click the verticle elipses, then click Manage keys.
- Click the ADD KEY dropdown, and select Create new key.
- Select Key type JSON and click CREATE.
This will generate a json Private key file that will be downloaded and saved locally. - Click CLOSE to close the dialog.
- Navigate to DETAILS -> Advanced Settings. Copy the Client ID.
Enable APIs
Both the Gmail API and the Admin SDK API are required to use this integration.
- From the main Navigation Menu hamburger icon, navigate to APIs & Services -> Library.
- In Search for APIs & Services, search for gmail.
- Click Gmail API, then click ENABLE.
- Repeat steps 2 & 3 for Admin SDK API.
Delegate Domain-wide Authority to Your Service Account
- In the Google Administrator Console, navigate to Security -> Access and data control -> API Controls.
- Click MANAGE DOMAIN WIDE DELEGATION.
- Click Add new to open the Add a new client ID dialog.
- Complete the dialog using the Client ID copied in Step 12 above, and the OAuth scopes noted below, then click AUTHORIZE to close the dialog.
https://www.googleapis.com/auth/gmail.settings.basic,https://www.googleapis.com/auth/admin.directory.user,https://www.googleapis.com/auth/admin.directory.device.mobile.action,https://www.googleapis.com/auth/admin.directory.device.mobile.readonly,https://www.googleapis.com/auth/gmail.modify,https://www.googleapis.com/auth/gmail.settings.sharing,https://www.googleapis.com/auth/gmail.send,https://www.googleapis.com/auth/gmail.modify,https://www.googleapis.com/auth/admin.directory.device.chromeos,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.user.security,https://www.googleapis.com/auth/admin.directory.rolemanagement,https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly,https://www.googleapis.com/auth/gmail.readonly,https://mail.google.com,https://www.googleapis.com/auth/gmail.compose
Get an Immutable Google Apps ID
To revoke or fetch a user role, you need an Immutable Google Apps ID.
- Continue within the Google Administrator Console from the previous step.
- Navigate to Security -> Authentication -> SSO with SAML applications.
- Copy the idpid value from the SSO URL, this is the Immutable Google Apps ID.
Required Scopes
Configure Gmail in Cortex XSOAR
- Navigate to Settings > Integrations > Instances.
- Search for Gmail.
-
Click Add instance to create and configure a new integration instance.
Parameter Description Required adminEmail The email of the user with admin privileges (the Password refers to the content of the Service Account file). True gappsID The immutable Google Apps ID. False query The events search query (for example, “from:example@demisto.com”) Used for searching emails in the inbox. The query language follows the Gmail query specification example: “from:someuser@example.com rfc822msgid:somemsgid@example.com is:unread”. For more information, read the Gmail Query Language documentation. False queryUserKey Events user key (for example, example@demisto.com) Use this to specify the email account to search for messages. By default, the integration uses the email address specified in the admin instance. False isFetch Whether to fetch incidents. False insecure Whether to trust any certificate. (not secure) False proxy Whether to use system proxy settings. False incidentType The incident type to map incoming events to. False fetch_time The first fetch timestamp, in days. False - Click Test to validate the URLs, token, and connection.
Use Cases
- Monitors a mailbox by using the integration fetch incident capability to monitor a mailbox and create incidents for new filtered emails.
- Searches a mailbox for emails with PDF attachments by using the following command.
gmail-search user-id=admin@demisto.com filename=”pdf” after=”2018/05/10”. - Deletes emails by using the following command.
!gmail-delete-mail user-id=admin@demisto.com message-id=164d2110e0152660
Fetched Incidents Data
- Incident Name
- Occurred
- Owner
- Type
- Severity
- Email From
- Email Message ID
- Email Subject
- Email To
- Attachment Extension
- Attachment Name
- Email Body
- Email Body Format
Commands
You can execute these commands from the Cortex XSOAR CLI as part of an automation or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
- gmail-delete-user: Deletes a Gmail user.
- gmail-get-tokens-for-user: Gets tokens for a user.
- gmail-get-user: Gets information for a Google user.
- gmail-get-user-roles: Gets all available Google roles.
- gmail-get-attachments: Gets Gmail message attachments.
- gmail-get-mail: Gets a Gmail message.
- gmail-search: Searches a user’s Gmail records.
- gmail-search-all-mailboxes: Searches in all Gmail mailboxes.
- gmail-list-users: Lists all Google users.
- gmail-list-labels: Lists all labels for a given user.
- gmail-revoke-user-role: Revokes a Google user’s role.
- gmail-create-user: Creates a new user.
- gmail-delete-mail: Deletes mail from a mailbox.
- gmail-get-thread: Gets the message in an email thread.
- gmail-move-mail: Moves an email to a different folder.
- gmail-move-mail-to-mailbox: Moves an email to a different mailbox.
- gmail-add-delete-filter: Adds a rule to delete an email.
- gmail-add-filter: Adds a new filter.
- gmail-list-filter: Gets a list of filters in a mailbox.
- gmail-remove-filter: Removes a filter from an email.
- gmail-hide-user-in-directory: Hides a user’s information.
- gmail-set-password: Sets a password.
- gmail-get-autoreply: Gets an auto reply message for the user.
- gmail-set-autoreply: Sets an auto-reply for the user.
- gmail-delegate-user-mailbox: Adds a delegate user to a mailbox.
- send-mail: Sends an email using Gmail.
- reply-mail: Replies to an email using Gmail.
- gmail-remove-delegated-mailbox: Removes a delegate user from a mailbox.
- gmail-get-role: Gets details of a specific role.
- gmail-forwarding-address-add: Creates a forwarding address.
- gmail-forwarding-address-update: Updates the disposition in a forwarding address.
- gmail-forwarding-address-list: Gets a list of forwarding addresses.
- gmail-forwarding-address-get: Gets a forwarding address.
- gmail-forwarding-address-remove: Removes a forwarding address.
- gmail-send-as-add: Creates a custom “from” send-as alias.
gmail-delete-user
Deletes a Gmail user.
Base Command
gmail-delete-user
Input
| Argument Name | Description | Required |
|---|---|---|
| user-id | The user’s email address. The “me” special value can be used to indicate the authenticated user. | Required |
Context Output
There is no context output for this command.
Command Example
!gmail-delete-user user-id=user1@domain.io
Human Readable Output
User user1@domain.io have been deleted.
gmail-get-tokens-for-user
Lists all tokens associated with a specified user.
Base Command
gmail-get-tokens-for-user
Input
| Argument Name | Description | Required |
|---|---|---|
| user-id | The user’s email address. The “me” special value can be used to indicate the authenticated user. | Required |
Command Example
!gmail-get-tokens-for-user user-id=user@domain.io
Context Example
{
"Tokens": {
"ClientId": "292824132082.apps.googleusercontent.com",
"DisplayText": "Google APIs Explorer",
"Kind": "admin#directory#token",
"Scopes": [
"openid",
"https://www.googleapis.com/auth/calendar"
],
"UserKey": "123456789"
}
}
Human Readable Output
Tokens
DisplayText ClientId Kind Scopes UserKey Google APIs Explorer 292824132082.apps.googleusercontent.com admin#directory#token openid, https://www.googleapis.com/auth/calendar123456789 Go Phish! 422358954086-4fvv287aojmge1qaqe9m5mmgmbuhg1hj.apps.googleusercontent.com admin#directory#token https://www.googleapis.com/auth/gmail.addons.current.message.readonly,
https://www.googleapis.com/auth/script.send_mail,
https://www.googleapis.com/auth/userinfo.email,
openid,
https://www.googleapis.com/auth/script.storage,
https://www.googleapis.com/auth/gmail.addons.execute,
https://www.googleapis.com/auth/admin.directory.user.readonly123456789 Demisto KMS DEV 950822307886-oiv25bpm32dtp21eabn2k5lf1ba7koum.apps.googleusercontent.com admin#directory#token https://www.googleapis.com/auth/cloud-platform123456789 Google Data Studio 371237729773-oj8m98u7esgqep8snt9aold136opo3fi.apps.googleusercontent.com admin#directory#token https://www.googleapis.com/auth/bigquery.readonly123456789 Postman 805864674475-3abs2rivkn7kreou30b8ru8esnti4oih.apps.googleusercontent.com admin#directory#token https://www.googleapis.com/auth/userinfo.profile,
https://www.googleapis.com/auth/userinfo.email123456789
gmail-get-user
Gets information for a specified user.
Base Command
gmail-get-user
Input
| Argument Name | Description | Required |
|---|---|---|
| user-id | The user’s email address. The “me” special value can be used to indicate the authenticated user. | Required |
| projection | The subset of fields to fetch for the user. Can be: “basic”: Do not include any custom fields for the user (default), “custom”: Includes custom fields from schemas requested in custom-field-mask, “full”: Includes all fields associated with the user. Possible values are: basic, custom, full. Default is basic. | Optional |
| view-type-public-domain | Whether to fetch the administrator or public view of the user. Can be admin_view (default), which includes both administrator and domain-public fields; or “domain_public”, which includes user fields that are publicly visible to other users in the domain. Possible values are: admin_view, domain_public. Default is admin_view. | Optional |
| custom-field-mask | A comma-separated list of schema names. All fields from these schemas are fetched. This should only be set when projection=custom. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Account.Type | String | The account type. For example, “AD”, “LocalOS”, “Google”, “AppleID”, and so on. |
| Account.ID | String | The unique ID for the account (integration specific). For AD accounts this is the Distinguished Name (DN). |
| Account.DisplayName | string | The display name. |
| Account.Gmail.Address | string | The email assigned with the current account. |
| Account.Email.Address | String | The email address of the account. |
| Account.Domain | String | The domain of the account. |
| Account.Username | String | The account username in the relevant system. |
| Account.OrganizationUnit | String | The Organization Unit (OU) of the account. |
| Account.Group | String | Groups to which the account belongs (integration specific). For example, for AD, these are the groups in which the account is a member. |
| Account.VisibleInDirectory | Boolean | Whether the account is visible in the directory. |
| Account.CustomerId | String | The customer unique ID. |
Command Example
!gmail-get-user user-id=user@domain.io
Context Example
{
"Account": {
"CustomerId": "C03puekhd",
"DisplayName": "user user",
"Domain": "domain.io",
"Email": {
"Address": "user@domain.io"
},
"Gmail": {
"Address": "user@domain.io"
},
"Group": "admin#directory#user",
"Groups": "admin#directory#user",
"ID": "115824619743385532879",
"Type": "Google",
"UserName": "user",
"Username": "user",
"VisibleInDirectory": true
}
}
Human Readable Output
User user@domain.io
Type ID Username DisplayName Groups CustomerId Domain VisibleInDirectory 115824619743385532879 user user user admin#directory#user C03puekhd domain.io Address: user@domain.io true
gmail-get-user-roles
Retrieves a list of all Google roles for a specified user.
Base Command
gmail-get-user-roles
Input
| Argument Name | Description | Required |
|---|---|---|
| user-id | The user’s email address. The “me” special value can be used to indicate the authenticated user. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Gmail.Role.RoleAssignmentId | String | The unique ID of the role assignment. |
| Gmail.Role.ScopeType | String | The scope type of the role. |
| Gmail.Role.Kind | String | The kind of the Role. |
| Gmail.Role.OrgUnitId | String | The organization the user was assigned to. |
| Gmail.Role.ID | String | The inner role ID. |
| Gmail.Role.AssignedTo | String | The user ID who was assigned to the role. |
Command Example
!gmail-get-user-roles user-id=user@domain.io
Context Example
{
"Gmail": {
"Role": [
{
"AssignedTo": "118105533760233960163",
"ID": "13801188331880449",
"Kind": "admin#directory#roleAssignment",
"OrgUnitId": "",
"RoleAssignmentId": "13801188331880456",
"ScopeType": "CUSTOMER"
},
{
"AssignedTo": "118105533760233960163",
"ID": "13801188331880463",
"Kind": "admin#directory#roleAssignment",
"OrgUnitId": "",
"RoleAssignmentId": "13801188331880489",
"ScopeType": "CUSTOMER"
},
{
"AssignedTo": "118105533760233960163",
"ID": "13801188331880469",
"Kind": "admin#directory#roleAssignment",
"OrgUnitId": "03ph8a2z3tho209",
"RoleAssignmentId": "13801188331880492",
"ScopeType": "ORG_UNIT"
}
]
}
}
Human Readable Output
User Roles of user@domain.io
ID RoleAssignmentId ScopeType Kind OrgUnitId 13801188331880449 13801188331880456 CUSTOMER admin#directory#roleAssignment 13801188331880463 13801188331880489 CUSTOMER admin#directory#roleAssignment 13801188331880469 13801188331880492 ORG_UNIT admin#directory#roleAssignment 03ph8a2z3tho209
gmail-get-attachments
Retrieves attachments from a sent Gmail message.
Base Command
gmail-get-attachments
Input
| Argument Name | Description | Required |
|---|---|---|
| message-id | The ID of the email to retrieve. You can get the ID by running the gmail-search command, or by fetching mails and copy the incident.labels.Email/ID value from the fetched incident context. | Required |
| user-id | The user’s email address. The “me” special value can be used to indicate the authenticated user. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| File.Name | String | The file name. |
| File.MD5 | String | The MD5 hash of the file. |
| File.SHA1 | String | The SHA1 hash of the file. |
| File.SHA256 | String | The SHA256 hash of the file. |
| File.Type | String | The file type, as determined by libmagic (same as displayed in file entries). |
| File.Size | Number | The size of the file in bytes. |
| File.SSDeep | String | The SSDeep hash of the file (same as displayed in file entries). |
| File.EntryID | String | The EntryID of the file. |
| File.Extension | String | The file extension. For example: “xls”. |
Command Example
!gmail-get-attachments message-id=16d4316a25a332e4 user-id=admin@demistodev.com
gmail-get-mail
Retrieves the Gmail message sent to a specified user.
Base Command
gmail-get-mail
Input
| Argument Name | Description | Required |
|---|---|---|
| user-id | The user’s email address. The “me” special value can be used to indicate the authenticated user. | Required |
| message-id | The ID of the email to retrieve. You can get the ID by running the gmail-search command, or by fetching mails and copy the incident.labels.Email/ID value from the fetched incident context. | Required |
| format | The format to return the message. Can be: “full”: Returns the full email message data with body content parsed in the payload field; the raw field is not used. (default) / “metadata”: Returns only the email message ID, labels, and email headers / “minimal”: Returns only the email message ID and labels; does not return the email headers, body, or payload / “raw”: Returns the full email message data with body content in the raw field as a base64url encoded string; the payload field is not used. Possible values are: full, metadata, minimal, raw. Default is full. | Optional |
| include-attachments | Whether to include the attachment entries in the result or not. Possible values are: False, True. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Gmail.ID | String | The inner ID of the Gmail message. |
| Gmail.ThreadId | string | The thread ID. |
| Gmail.Format | string | The MIME type of email. |
| Gmail.Labels | string | The labels of the specific email. |
| Gmail.To | String | The email address of the receiver. |
| Gmail.From | String | The email address of the sender. |
| Gmail.Cc | string | Additional recipient email address (CC). |
| Gmail.Bcc | string | Additional recipient email address (BCC). |
| Gmail.Subject | string | The subject of the email. |
| Gmail.Body | string | The content of the email. |
| Gmail.Attachments.ID | String | The email attachment ID (as appear in gmail). |
| Gmail.Attachments.Name | String | The email attachment name. |
| Gmail.Headers | unknown | All headers of the specific email (list). |
| Gmail.Mailbox | string | The email mailbox. |
| Email.To | String | The recipient of the email. |
| Email.From | String | The sender of the email. |
| Email.CC | String | Additional recipient email address (CC). |
| Email.BCC | String | Additional recipient email address (BCC). |
| Email.Format | String | The format of the email. |
| Email.Body/HTML | String | The HTML version of the email. |
| Email.Body/Text | String | The plain-text version of the email. |
| Email.Subject | String | The subject of the email. |
| Email.Headers | String | The headers of the email. |
| Email.Attachments.ID | String | The email attachment ID (as appear in gmail). |
| Email.Attachments.Name | String | The email attachment name. |
| Email.Date | String | The date the email was received. |
| File.Name | String | Relevant only when include-attachments is set to True. The file name. |
| File.MD5 | String | Relevant only when include-attachments is set to True. The MD5 hash of the file. |
| File.SHA1 | String | Relevant only when include-attachments is set to True. The SHA1 hash of the file. |
| File.SHA256 | String | Relevant only when include-attachments is set to True. The SHA256 hash of the file. |
| File.Type | String | Relevant only when include-attachments is set to True. The file type, as determined by libmagic (same as displayed in file entries). |
| File.Size | Number | Relevant only when include-attachments is set to True. The size of the file in bytes. |
| File.SSDeep | String | Relevant only when include-attachments is set to True. The SSDeep hash of the file (same as displayed in file entries). |
| File.EntryID | string | The EntryID of the file. |
| File.Extension | String | The file extension. For example: “xls”. |
Command Example
!gmail-get-mail user-id=user@domain.io message-id=175276e027a9aab9
Context Example
{
"Email": {
"Attachment Names": "",
"Attachments": [],
"BCC": [],
"Body/HTML": "",
"Body/Text": "",
"CC": [],
"Date": "Wed, 14 Oct 2020 07:05:21 -0700",
"Format": "multipart/alternative",
"From": "The G Suite Team <gsuite-noreply@google.com>",
"Headers": [
{
"Name": "Delivered-To",
"Value": "user@domain.io"
},
{
"Name": "Received",
"Value": "by 2002:a1c:7fc5:0:0:0:0:0 with SMTP id a188csp491068wmd; Wed, 14 Oct 2020 07:05:22 -0700 (PDT)"
},
{
"Name": "X-Received",
"Value": "by 2002:ab0:658e:: with SMTP id v14mr2984443uam.97.1602684322816; Wed, 14 Oct 2020 07:05:22 -0700 (PDT)"
},
{
"Name": "ARC-Seal",
"Value": "i=1; a=rsa-sha256; t=1602684322; cv=none; d=google.com; s=arc-20160816; b=ZMhZ46t3LKOsm7Goq4PFtXh+6SAMBjRuuOEPkvAC4qv6M+0fZphp/MrZa1MLM7wi5Q b2m13JPapwtAdOezOCcHFxCttXuoG4jpfmMGfJGNm5ITaNtNdHxfpsAQ8s6sVHfuKBCT m3+YRYDVInjmapyihFrMZYIdjeWxKAEaFye8NiedNIpX91tFt+H2JR69TW1hjAqLOurk cx57CUUFn+vSRM06zFmfGalk1ZgTPpRuPCqLCAK2+aOH4Rki6l8XzVYcoPwkcFVKYg2j +yXE8NbIReMtqiOL63EomUGuaCeLDcSPgaHsv3o+BdXEcLvuKBzqPqY2gUvpMZNAcG9q UsXg=="
},
{
"Name": "ARC-Message-Signature",
"Value": "i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=to:from:subject:message-id:feedback-id:reply-to:date:mime-version :userim-signature; bh=1iRIOaJixsPLiHwsRGm0Bzd/a5qzzjoDix+zYsrquWQ=; b=ZniRwt/7awcNv0Mr7RoyiHu0PhsC97+IquSkKX/Er7j2Cm7JEYGhitxnzeg5wfUpBn SCa66lcZ4qtgi/2PwmeJnlxybIJzzEG0cnVPtQG7A9yw/AjCcFn4iXsPWp9WtUD1ziV1 qnoDefmxorYvo5l2YWwxN/KtGqVEu+Za6YziiW06blKLyTId6rk2GqtbL4ebaMmhv+wa 2hJ6gsxdZLr9BfZ74pK8wyeJCiWPB+ovRd/QE3yWNmGI+fwFKGtoHouedr0ZXQ7Q3AGt UgSCIB6fkIOl3DiiXBRGqDWakxZV9424/yxIUjAzI/P8rOV4jQX0fJyVqj4NFNjsblzp fWUQ=="
},
{
"Name": "ARC-Authentication-Results",
"Value": "i=1; mx.google.com; userim=pass header.i=@google.com header.s=20161025 header.b=\"B/ouKoWq\"; spf=pass (google.com: domain of 3oqwhxw4kbcow8ay9u-347u51ew44w1u.s42tubq13y2r1utq9q.y4@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) smtp.mailfrom=3oQWHXw4KBcow8Ay9u-347u51Ew44w1u.s42tuBq13y2r1utq9q.y4@scoutcamp.bounces.google.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com"
},
{
"Name": "Return-Path",
"Value": "<3oQWHXw4KBcow8Ay9u-347u51Ew44w1u.s42tuBq13y2r1utq9q.y4@scoutcamp.bounces.google.com>"
},
{
"Name": "Received",
"Value": "from mail-sor-f69.google.com (mail-sor-f69.google.com. [209.85.220.69]) by mx.google.com with SMTPS id g25sor733005vsf.19.2020.10.14.07.05.22 for <user@domain.io> (Google Transport Security); Wed, 14 Oct 2020 07:05:22 -0700 (PDT)"
},
{
"Name": "Received-SPF",
"Value": "pass (google.com: domain of 3oqwhxw4kbcow8ay9u-347u51ew44w1u.s42tubq13y2r1utq9q.y4@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) client-ip=209.85.220.69;"
},
{
"Name": "Authentication-Results",
"Value": "mx.google.com; userim=pass header.i=@google.com header.s=20161025 header.b=\"B/ouKoWq\"; spf=pass (google.com: domain of 3oqwhxw4kbcow8ay9u-347u51ew44w1u.s42tubq13y2r1utq9q.y4@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) smtp.mailfrom=3oQWHXw4KBcow8Ay9u-347u51Ew44w1u.s42tuBq13y2r1utq9q.y4@scoutcamp.bounces.google.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com"
},
{
"Name": "userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:date:reply-to:feedback-id:message-id:subject:from:to; bh=1iRIOaJixsPLiHwsRGm0Bzd/a5qzzjoDix+zYsrquWQ=; b=B/ouKoWqw/ZxXjGlTzq1he5tz7yyGdNKzsNK1qI0hD6Kna8M25A909y5QY0p930hP5 frtkcjeUqhx+3xWcifYMCiiserHQp1PzOHcOtKBHLLB81kIIFy2PoXt5QSKQeN1hgrtF nspEDYBA1+ttmHSfYIy6EwBcjE5vZV6BrVes66s63I1TVOGk3My3mkDxmnHLjsJMimAp +Hg8GOEBbNjcA8sKk+rkO/3mTc4MQTO7rucOTbR0XxPiQ4ZJE7nxXYZ1FtZIC5btcoJn Qa6DHZDCpiU6S0kmEZculy5s7Kerrf+WrGsSCtZi9cuyPZ/+V35Okd5h3oamdXR3rUej VfFg=="
},
{
"Name": "X-Google-userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:date:reply-to:feedback-id :message-id:subject:from:to; bh=1iRIOaJixsPLiHwsRGm0Bzd/a5qzzjoDix+zYsrquWQ=; b=TmbhOtA3+mJPilYZ0+2u5g2u3ZVMZC0twNvhjaV4e0lSNTlyMRy7jNXXxY0dVF9re0 ScVwdWtvbwSejo6QzaFDuO7U9v83epq7Y+TvYO0tlJGddc1VzbywDcqIQHvVEeZfk/ki lcFw8X5eoQmNyuzTcojJisQeMs3+A5mlL7BNtiFO/PStXojW455WjrXb958HAdVvyBga R2O0QvGu0zLu1OmfTamo8sMJczU4gvUyWOC3SuqgUZNlFQ9GRyR4XRikigKL/WWKgVg0 RcILn2ziDM7z47V3yQuaGJTXiuabbgpY2zBMjTYkrVepe5BaWl1Lu7N7NIBnkkyjYZ+8 jjIA=="
},
{
"Name": "X-Gm-Message-State",
"Value": "AOAM531vyv6NOK1w4HuwIuGXXe5J5gAoRHJLdSnfBFKQZZPaATiWi6HA PxiSKqxH7La9SE8="
},
{
"Name": "X-Google-Smtp-Source",
"Value": "ABdhPJykPnFU/+bOu1SyNprW/mF8MF98QscgxjFit7dAqEV8CkZD4ahPZSzi9MS+qEzIN8xZdVG2128="
},
{
"Name": "MIME-Version",
"Value": "1.0"
},
{
"Name": "X-Received",
"Value": "by 2002:a05:6102:205c:: with SMTP id q28mr3609398vsr.38.1602684321347; Wed, 14 Oct 2020 07:05:21 -0700 (PDT)"
},
{
"Name": "Date",
"Value": "Wed, 14 Oct 2020 07:05:21 -0700"
},
{
"Name": "Reply-To",
"Value": "The G Suite Team <gsuite-noreply@google.com>"
},
{
"Name": "X-Google-Id",
"Value": "253939"
},
{
"Name": "Feedback-ID",
"Value": "P-10-0:C20060867:M110136315-en:gamma"
},
{
"Name": "X-Notifications",
"Value": "GAMMA:<be35f268e4fd76dd252437e3bffc032bc68e7d9a-20060867-110354355@google.com>"
},
{
"Name": "Message-ID",
"Value": "<be35f268e4fd76dd252437e3bffc032bc68e7d9a-20060867-110354355@google.com>"
},
{
"Name": "Subject",
"Value": "Your G Suite data transfer was successful for test user to newaccount newdemo"
},
{
"Name": "From",
"Value": "The G Suite Team <gsuite-noreply@google.com>"
},
{
"Name": "To",
"Value": "user@domain.io"
},
{
"Name": "Content-Type",
"Value": "multipart/alternative; boundary=\"000000000000a9382a05b1a2058d\""
}
],
"ID": "175276e027a9aab9",
"RawData": null,
"Subject": "Your G Suite data transfer was successful for test user to newaccount newdemo",
"To": "user@domain.io"
},
"Gmail": {
"Attachment Names": "",
"Attachments": [],
"Bcc": [],
"Body": "From: \"The G Suite Team\" [gsuite-noreply@google.com]\r\nSubject: Your G Suite data transfer was successful for test user to \r\nnewaccount newdemo\r\n\r\nHello Admin,\r\n\r\nG\u00a0Suite recently processed a request from test user (user@domain.io) \r\nto transfer data for test user (user@domain.io) to newaccount \r\nnewdemo (demo@domain.io).\r\n\r\nThe data transfer was successful.\r\n\r\nSincerely,\r\n\r\nThe G\u00a0Suite Team\r\n\r\n\r\n[Google Cloud]\r\n\r\n(c) 2020 Google LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043 * \r\nGoogle Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland * Google \r\nAsia Pacific Pte. Ltd., 8 Marina View, #30-01, Asia Square 1, Singapore \r\n018960\r\n\r\nYou're receiving this mandatory email service announcement to update you \r\nabout important changes to your Google Cloud product or account.\r\n",
"Cc": [],
"Date": "Wed, 14 Oct 2020 07:05:21 -0700",
"Format": "multipart/alternative",
"From": "The G Suite Team <gsuite-noreply@google.com>",
"Headers": [
{
"Name": "Delivered-To",
"Value": "user@domain.io"
},
{
"Name": "Received",
"Value": "by 2002:a1c:7fc5:0:0:0:0:0 with SMTP id a188csp491068wmd; Wed, 14 Oct 2020 07:05:22 -0700 (PDT)"
},
{
"Name": "X-Received",
"Value": "by 2002:ab0:658e:: with SMTP id v14mr2984443uam.97.1602684322816; Wed, 14 Oct 2020 07:05:22 -0700 (PDT)"
},
{
"Name": "ARC-Seal",
"Value": "i=1; a=rsa-sha256; t=1602684322; cv=none; d=google.com; s=arc-20160816; b=ZMhZ46t3LKOsm7Goq4PFtXh+6SAMBjRuuOEPkvAC4qv6M+0fZphp/MrZa1MLM7wi5Q b2m13JPapwtAdOezOCcHFxCttXuoG4jpfmMGfJGNm5ITaNtNdHxfpsAQ8s6sVHfuKBCT m3+YRYDVInjmapyihFrMZYIdjeWxKAEaFye8NiedNIpX91tFt+H2JR69TW1hjAqLOurk cx57CUUFn+vSRM06zFmfGalk1ZgTPpRuPCqLCAK2+aOH4Rki6l8XzVYcoPwkcFVKYg2j +yXE8NbIReMtqiOL63EomUGuaCeLDcSPgaHsv3o+BdXEcLvuKBzqPqY2gUvpMZNAcG9q UsXg=="
},
{
"Name": "ARC-Message-Signature",
"Value": "i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=to:from:subject:message-id:feedback-id:reply-to:date:mime-version :userim-signature; bh=1iRIOaJixsPLiHwsRGm0Bzd/a5qzzjoDix+zYsrquWQ=; b=ZniRwt/7awcNv0Mr7RoyiHu0PhsC97+IquSkKX/Er7j2Cm7JEYGhitxnzeg5wfUpBn SCa66lcZ4qtgi/2PwmeJnlxybIJzzEG0cnVPtQG7A9yw/AjCcFn4iXsPWp9WtUD1ziV1 qnoDefmxorYvo5l2YWwxN/KtGqVEu+Za6YziiW06blKLyTId6rk2GqtbL4ebaMmhv+wa 2hJ6gsxdZLr9BfZ74pK8wyeJCiWPB+ovRd/QE3yWNmGI+fwFKGtoHouedr0ZXQ7Q3AGt UgSCIB6fkIOl3DiiXBRGqDWakxZV9424/yxIUjAzI/P8rOV4jQX0fJyVqj4NFNjsblzp fWUQ=="
},
{
"Name": "ARC-Authentication-Results",
"Value": "i=1; mx.google.com; userim=pass header.i=@google.com header.s=20161025 header.b=\"B/ouKoWq\"; spf=pass (google.com: domain of 3oqwhxw4kbcow8ay9u-347u51ew44w1u.s42tubq13y2r1utq9q.y4@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) smtp.mailfrom=3oQWHXw4KBcow8Ay9u-347u51Ew44w1u.s42tuBq13y2r1utq9q.y4@scoutcamp.bounces.google.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com"
},
{
"Name": "Return-Path",
"Value": "<3oQWHXw4KBcow8Ay9u-347u51Ew44w1u.s42tuBq13y2r1utq9q.y4@scoutcamp.bounces.google.com>"
},
{
"Name": "Received",
"Value": "from mail-sor-f69.google.com (mail-sor-f69.google.com. [209.85.220.69]) by mx.google.com with SMTPS id g25sor733005vsf.19.2020.10.14.07.05.22 for <user@domain.io> (Google Transport Security); Wed, 14 Oct 2020 07:05:22 -0700 (PDT)"
},
{
"Name": "Received-SPF",
"Value": "pass (google.com: domain of 3oqwhxw4kbcow8ay9u-347u51ew44w1u.s42tubq13y2r1utq9q.y4@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) client-ip=209.85.220.69;"
},
{
"Name": "Authentication-Results",
"Value": "mx.google.com; userim=pass header.i=@google.com header.s=20161025 header.b=\"B/ouKoWq\"; spf=pass (google.com: domain of 3oqwhxw4kbcow8ay9u-347u51ew44w1u.s42tubq13y2r1utq9q.y4@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) smtp.mailfrom=3oQWHXw4KBcow8Ay9u-347u51Ew44w1u.s42tuBq13y2r1utq9q.y4@scoutcamp.bounces.google.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com"
},
{
"Name": "userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:date:reply-to:feedback-id:message-id:subject:from:to; bh=1iRIOaJixsPLiHwsRGm0Bzd/a5qzzjoDix+zYsrquWQ=; b=B/ouKoWqw/ZxXjGlTzq1he5tz7yyGdNKzsNK1qI0hD6Kna8M25A909y5QY0p930hP5 frtkcjeUqhx+3xWcifYMCiiserHQp1PzOHcOtKBHLLB81kIIFy2PoXt5QSKQeN1hgrtF nspEDYBA1+ttmHSfYIy6EwBcjE5vZV6BrVes66s63I1TVOGk3My3mkDxmnHLjsJMimAp +Hg8GOEBbNjcA8sKk+rkO/3mTc4MQTO7rucOTbR0XxPiQ4ZJE7nxXYZ1FtZIC5btcoJn Qa6DHZDCpiU6S0kmEZculy5s7Kerrf+WrGsSCtZi9cuyPZ/+V35Okd5h3oamdXR3rUej VfFg=="
},
{
"Name": "X-Google-userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:date:reply-to:feedback-id :message-id:subject:from:to; bh=1iRIOaJixsPLiHwsRGm0Bzd/a5qzzjoDix+zYsrquWQ=; b=TmbhOtA3+mJPilYZ0+2u5g2u3ZVMZC0twNvhjaV4e0lSNTlyMRy7jNXXxY0dVF9re0 ScVwdWtvbwSejo6QzaFDuO7U9v83epq7Y+TvYO0tlJGddc1VzbywDcqIQHvVEeZfk/ki lcFw8X5eoQmNyuzTcojJisQeMs3+A5mlL7BNtiFO/PStXojW455WjrXb958HAdVvyBga R2O0QvGu0zLu1OmfTamo8sMJczU4gvUyWOC3SuqgUZNlFQ9GRyR4XRikigKL/WWKgVg0 RcILn2ziDM7z47V3yQuaGJTXiuabbgpY2zBMjTYkrVepe5BaWl1Lu7N7NIBnkkyjYZ+8 jjIA=="
},
{
"Name": "X-Gm-Message-State",
"Value": "AOAM531vyv6NOK1w4HuwIuGXXe5J5gAoRHJLdSnfBFKQZZPaATiWi6HA PxiSKqxH7La9SE8="
},
{
"Name": "X-Google-Smtp-Source",
"Value": "ABdhPJykPnFU/+bOu1SyNprW/mF8MF98QscgxjFit7dAqEV8CkZD4ahPZSzi9MS+qEzIN8xZdVG2128="
},
{
"Name": "MIME-Version",
"Value": "1.0"
},
{
"Name": "X-Received",
"Value": "by 2002:a05:6102:205c:: with SMTP id q28mr3609398vsr.38.1602684321347; Wed, 14 Oct 2020 07:05:21 -0700 (PDT)"
},
{
"Name": "Date",
"Value": "Wed, 14 Oct 2020 07:05:21 -0700"
},
{
"Name": "Reply-To",
"Value": "The G Suite Team <gsuite-noreply@google.com>"
},
{
"Name": "X-Google-Id",
"Value": "253939"
},
{
"Name": "Feedback-ID",
"Value": "P-10-0:C20060867:M110136315-en:gamma"
},
{
"Name": "X-Notifications",
"Value": "GAMMA:<be35f268e4fd76dd252437e3bffc032bc68e7d9a-20060867-110354355@google.com>"
},
{
"Name": "Message-ID",
"Value": "<be35f268e4fd76dd252437e3bffc032bc68e7d9a-20060867-110354355@google.com>"
},
{
"Name": "Subject",
"Value": "Your G Suite data transfer was successful for test user to newaccount newdemo"
},
{
"Name": "From",
"Value": "The G Suite Team <gsuite-noreply@google.com>"
},
{
"Name": "To",
"Value": "user@domain.io"
},
{
"Name": "Content-Type",
"Value": "multipart/alternative; boundary=\"000000000000a9382a05b1a2058d\""
}
],
"Html": "html",
"ID": "175276e027a9aab9",
"Labels": "UNREAD, CATEGORY_UPDATES, INBOX",
"Mailbox": "user@domain.io",
"RawData": null,
"Subject": "Your G Suite data transfer was successful for test user to newaccount newdemo",
"ThreadId": "1752721e660048f9",
"To": "user@domain.io",
"Type": "Gmail"
}
}
Human Readable Output
Mailbox ID Subject From To Labels Format Body user@domain.io 175276e027a9aab9 Your G Suite data transfer was successful for test user to newaccount newdemo The G Suite Team gsuite-noreply@google.com user@domain.io UNREAD, CATEGORY_UPDATES, INBOX multipart/alternative From: “The G Suite Team” [gsuite-noreply@google.com]
Subject: Your G Suite data transfer was successful for test user to
newaccount newdemo
Hello Admin,
GÂ Suite recently processed a request from test user (user@domain.io)
to transfer data for test user (user@domain.io) to newaccount
newdemo (demo@domain.io).
The data transfer was successful.
Sincerely,
The GÂ Suite Team
[Google Cloud]
(c) 2020 Google LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043
Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland Google
Asia Pacific Pte. Ltd., 8 Marina View, #30-01, Asia Square 1, Singapore
018960
You’re receiving this mandatory email service announcement to update you
about important changes to your Google Cloud product or account.
gmail-search
Searches for Gmail records for a specific Google user.
Base Command
gmail-search
Input
| Argument Name | Description | Required |
|---|---|---|
| user-id | The user’s email address. The “me” special value can be used to indicate the authenticated user. | Required |
| query | Returns messages matching the specified query. Supports the same query format as the Gmail search box. For example, “from:someuser@example.com rfc822msgid: is:unread”. For more syntax information see “https://support.google.com/mail/answer/7190?hl=en”. | Optional |
| max-results | The maximum number of results to return. Default is 100. Maximum is 500. Can be 1 to 500, inclusive. Default is 100. | Optional |
| fields | Enables partial responses to be retrieved, separated by commas. Valid fields are only from the following list: Type, Mailbox, ThreadId, Labels, Headers, Attachments, RawData, Format, Subject, From, To, Body, Cc, Bcc, Date, Html, Attachment Names. | Optional |
| labels-ids | Returns messages with labels that match all of the specified label IDs in a comma-separated list. | Optional |
| page-token | Page token to retrieve a specific page of results in the list. | Optional |
| include-spam-trash | Include messages from SPAM and TRASH in the results. (Default: false). Possible values are: False, True. Default is False. | Optional |
| from | Specifies the sender. For example, “john”. | Optional |
| to | Specifies the receiver. For example, “john”. | Optional |
| subject | Words in the subject line. For example, “alert”. | Optional |
| filename | Attachments with a certain name or file type. For example, “pdf” or “report.pdf”. | Optional |
| in | Messages in any folder, including Spam and Trash. For example: shopping. | Optional |
| after | Search for messages sent after a specific date. For example: 2018/05/06. | Optional |
| before | Search for messages sent before a specific date. for example: 2018/05/09. | Optional |
| has-attachments | Whether to search for messages sent with attachments. Possible values are: True, False. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Gmail.ID | string | The inner ID of the Gmail message. |
| Gmail.ThreadId | string | The thread ID. |
| Gmail.Format | string | The MIME type of email. |
| Gmail.Labels | string | The labels of the specific email. |
| Gmail.To | string | The email address of the receiver. |
| Gmail.From | string | The email address of the sender. |
| Gmail.Cc | string | The additional recipient email address (CC). |
| Gmail.Bcc | string | The additional recipient email address (BCC). |
| Gmail.Subject | string | The subject of the specific email. |
| Gmail.Body | string | The content of the email. |
| Gmail.Attachments | unknown | Attachment details. Attachments IDs are separated by commas. |
| Gmail.Attachments.ID | String | The email attachment ID (as appear in gmail). |
| Gmail.Attachments.Name | String | The email attachment name. |
| Gmail.Headers | unknown | All headers of a specific email (list). |
| Gmail.Mailbox | string | The email mailbox. |
| GmailEmails.NextPageToken | string | Token used to get the next page of results. |
| Email.To | String | The recipient of the email. |
| Email.From | String | The sender of the email. |
| Email.CC | String | The additional recipient email address (CC). |
| Email.BCC | String | The additional recipient email address (BCC). |
| Email.Format | String | The format of the email. |
| Email.Body/HTML | String | The HTML version of the email. |
| Email.Body/Text | String | The plain-text version of the email. |
| Email.Subject | String | The subject of the email. |
| Email.Headers | String | The headers of the email. |
| Email.Attachments.entryID | Unknown | Comma-separated email attachment IDs. |
| Email.Date | String | The date the email was received. |
Command Example
!gmail-search user-id=user@domain.io after=2020/03/20 before=2021/04/01 query=access max-results=2
Context Example
{
"Email": [
{
"Attachment Names": "",
"Attachments": [],
"BCC": [],
"Body/HTML": "html",
"Body/Text": "html",
"CC": [],
"Date": "Wed, 07 Oct 2020 09:14:18 -0600",
"Format": "multipart/alternative",
"From": "Grammarly <info@send.grammarly.com>",
"Headers": [
{
"Name": "Delivered-To",
"Value": "user@domain.io"
},
{
"Name": "Received",
"Value": "by 2002:a1c:7fc5:0:0:0:0:0 with SMTP id a188csp615180wmd; Wed, 7 Oct 2020 08:14:23 -0700 (PDT)"
},
{
"Name": "X-Google-Smtp-Source",
"Value": "ABdhPJysZgukxXMVT3hNQSZ7vY1eZ1GXyXITNHrq5pHrea8WlO0evMqX7Y7S0HKmIQBGh41MSvQu"
},
{
"Name": "X-Received",
"Value": "by 2002:a1f:a94c:: with SMTP id s73mr1992787vke.19.1602083663011; Wed, 07 Oct 2020 08:14:23 -0700 (PDT)"
},
{
"Name": "ARC-Seal",
"Value": "i=1; a=rsa-sha256; t=1602083663; cv=none; d=google.com; s=arc-20160816; b=XADz+Kbl147CfVKP0LeksHQo/VotxjPhZdhMTHCh2odXJjQdOYQht55Mzsx2qDpbAm JuoffdsyLwuM4boUxIHTDU1jRlcpA11eVyukxICWcDUaJ8cDMORgBSxcY6PiJd5xXzyZ hmjxnn8Nz2vJD8TsiEVAEP1DoXIGl8DMz1HaPLZ2SAxPtPAloUAdcbw5jd88ZeLxRC91 Ztuqz4eGUmDZi/VgvyO+ekWRlmxVGtbD1LiFwCLy4z3WNFrkjIslcF5cZMV0iRKx6FyN G7EshV80gsvok5Dx4VdaprRWX6YjfTSoUE+jDuserJWouser2FboHCL1Hz7HkHfZV4QDjbV9 O6ow=="
},
{
"Name": "ARC-Message-Signature",
"Value": "i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=message-id:list-id:reply-to:mime-version:list-unsubscribe:date :subject:to:from:userim-signature; bh=pdsL/LK5XBos7TlVNY0trfJeccJTknVSjDucFlbPwO0=; b=FMfJczy2kdmT/P+CDmFaQGk1AqzOSV1wyICF8jNkjF79AEpP1OsA+YBLvqoICRgdyB sMZtdQjUQ1DYOYLe8LMtPOMwAOrP3pQw1iyg6YaPgbaq4DJr1b0CPlOvpacgVSIrcO+n DtFlmJ4OwYayJilD1PniD7nl3YLQzodxn1rNSO76kbWtKEis/xR2+lulBL9So8+y/r/y fTdaKQri9EjPYuserOSTcdF0jPAfg/IbH1NOrfLvj51+RIgrHRTC2Xqazo1Qf8WMVMATH6 NnlJZ7/qyR0Dur7gYVVxudJs7EW7+P7hk/p/fMrOgcRNPLgOEBT/K1392n8XrY+xDlMK uNxg=="
},
{
"Name": "ARC-Authentication-Results",
"Value": "i=1; mx.google.com; userim=pass header.i=@send.grammarly.com header.s=200608 header.b=mfR0Nrti; spf=pass (google.com: domain of bounce-45825_html-557366919-2940833-6424583-17450@bounce.send.grammarly.com designates 13.111.27.229 as permitted sender) smtp.mailfrom=bounce-45825_HTML-557366919-2940833-6424583-17450@bounce.send.grammarly.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=send.grammarly.com"
},
{
"Name": "Return-Path",
"Value": "<bounce-45825_HTML-557366919-2940833-6424583-17450@bounce.send.grammarly.com>"
},
{
"Name": "Received",
"Value": "from mta6.send.grammarly.com (mta6.send.grammarly.com. [13.111.27.229]) by mx.google.com with ESMTPS id u16si118009vsg.46.2020.10.07.08.14.20 for <user@domain.io> (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Oct 2020 08:14:23 -0700 (PDT)"
},
{
"Name": "Received-SPF",
"Value": "pass (google.com: domain of bounce-45825_html-557366919-2940833-6424583-17450@bounce.send.grammarly.com designates 13.111.27.229 as permitted sender) client-ip=13.111.27.229;"
},
{
"Name": "Authentication-Results",
"Value": "mx.google.com; userim=pass header.i=@send.grammarly.com header.s=200608 header.b=mfR0Nrti; spf=pass (google.com: domain of bounce-45825_html-557366919-2940833-6424583-17450@bounce.send.grammarly.com designates 13.111.27.229 as permitted sender) smtp.mailfrom=bounce-45825_HTML-557366919-2940833-6424583-17450@bounce.send.grammarly.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=send.grammarly.com"
},
{
"Name": "userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; s=200608; d=send.grammarly.com; h=From:To:Subject:Date:List-Unsubscribe:MIME-Version:Reply-To:List-ID: X-CSA-Complaints:Message-ID:Content-Type; i=info@send.grammarly.com; bh=pdsL/LK5XBos7TlVNY0trfJeccJTknVSjDucFlbPwO0=; b=mfR0NrtiSo8ju6kEDrZ8LSOE+VNqD+Gdw+mHUGTsLDpvvQ7yK2gLkv2WV6gwEgPY+N3e9u2Nqfi5 EA0V1wKWBwP5RUbQCu2Ir16VE34+gb+xUCxRpc3kx35tN40N1S9LXL2MUti9FLAvB90bvCaVIYAi DBvKmJ7ITnn0/sRAuVc="
},
{
"Name": "Received",
"Value": "by mta6.send.grammarly.com id hfnuser22fmd40 for <user@domain.io>; Wed, 7 Oct 2020 15:14:05 +0000 (envelope-from <bounce-45825_HTML-557366919-2940833-6424583-17450@bounce.send.grammarly.com>)"
},
{
"Name": "From",
"Value": "Grammarly <info@send.grammarly.com>"
},
{
"Name": "To",
"Value": "<user@domain.io>"
},
{
"Name": "Subject",
"Value": "A new editing experience from Grammarly"
},
{
"Name": "Date",
"Value": "Wed, 07 Oct 2020 09:14:18 -0600"
},
{
"Name": "List-Unsubscribe",
"Value": "<mailto:leave-fce310757d6601122d502d29-fe1c11757267027b7c1579-fe92167971640c7e76-fe8f12747760017576-fefe1577716104@leave.send.grammarly.com>"
},
{
"Name": "MIME-Version",
"Value": "1.0"
},
{
"Name": "Reply-To",
"Value": "No Reply <reply-fe92167971640c7e76-45825_HTML-557366919-6424583-17450@send.grammarly.com>"
},
{
"Name": "List-ID",
"Value": "<6424583.xt.local>"
},
{
"Name": "X-CSA-Complaints",
"Value": "whitelist-complaints@eco.de"
},
{
"Name": "X-SFMC-Stack",
"Value": "6"
},
{
"Name": "x-job",
"Value": "6424583_2940833"
},
{
"Name": "Message-ID",
"Value": "<73b01d0a-077f-428d-9495-16bfcd0c6839@ind1s06mta1344.xt.local>"
},
{
"Name": "Content-Type",
"Value": "multipart/alternative; boundary=\"p2tabpHjZRJC=_?:\""
}
],
"ID": "17503a0adab4557e",
"RawData": null,
"Subject": "A new editing experience from Grammarly",
"To": "<user@domain.io>"
},
{
"Attachment Names": "",
"Attachments": [],
"BCC": [],
"CC": [],
"Date": "Wed, 30 Sep 2020 10:36:01 -0600",
"Format": "multipart/alternative",
"From": "Grammarly <info@send.grammarly.com>",
"Headers": [
{
"Name": "Delivered-To",
"Value": "user@domain.io"
},
{
"Name": "Received",
"Value": "by 2002:a1c:7fc5:0:0:0:0:0 with SMTP id a188csp4842038wmd; Wed, 30 Sep 2020 09:36:02 -0700 (PDT)"
},
{
"Name": "X-Google-Smtp-Source",
"Value": "ABdhPJwojgAt1ZQUAuZgooyBtFUXhP13Te3ZswIrvoLlwDBbdnGOwpwKXuP0WdIhvsqgayud3lIg"
},
{
"Name": "X-Received",
"Value": "by 2002:a67:e3aa:: with SMTP id j10mr2201774vsm.51.1601483761873; Wed, 30 Sep 2020 09:36:01 -0700 (PDT)"
},
{
"Name": "ARC-Seal",
"Value": "i=1; a=rsa-sha256; t=1601483761; cv=none; d=google.com; s=arc-20160816; b=AuJYXtVI9hjosJlJYJ8kq07D4Eui933s9oDoPLnDb3VfBfc5TDlQ5NL9l94xSEXrFz Rutk8X1gzr2+34HSEQHC2Nn3QWJLI5sF/st2+ilhDXIIeWmxnG2AnRW8w4ZI3hq3tFdg iajCRHIlh85UifLyMuXKphABcPvxc6DE8OhEa7w53m1XpgwIO7+lOp7hU0ezj6WNirAv /F3TteoDPp8/QP1RoMjKk4OU+f+l+hcVewLktDXp7WlU+dqze62S224J/+AVtkrie0sm 7HLvgRCtgmCEy7csI0ym3iXCf+AgdlyJWfSpbFKYO+ZabU8c5KtgQU+PYDBwm0y1zNsG GLLg=="
},
{
"Name": "ARC-Message-Signature",
"Value": "i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=message-id:list-id:reply-to:mime-version:list-unsubscribe:date :subject:to:from:userim-signature; bh=3tGgTbVsOqIdcWpZmcxV3mpemPm9FK/OHgw1G3FwZFo=; b=EWoUJBwsNXvAzEHpj2v7lUMc0Wn9HVRkA7tLj5qPOHjt7gJNO4tQn3g9FDCzRGoq0W Lj54zgjIVU0RZf67LJV+lA18v46oYVQfFxo85hPqNHfUs+GLHcAQTlFTUmpuser+You2df qT22+L333SLywLWwVmSqK2IZbjVcK14wzDwAdQwMY6GizNToH8ybh0HMn+aZg99U3Ncs 98gdR5z9VY9BCskAguWsNjIcaGqGD8ZqrjJB8KdhSHNVZY7oi5yI1YSCm+7WciAf1P8F IhZnqjlVdMHikxUsPTy4qu2CWvStNspBr27jvW9OCVUZ5Z+xuAshyXa4BCoRkV2sXNOR 2eWg=="
},
{
"Name": "ARC-Authentication-Results",
"Value": "i=1; mx.google.com; userim=pass header.i=@send.grammarly.com header.s=200608 header.b=AHhCKJjI; spf=pass (google.com: domain of bounce-45825_html-557366919-2687540-6424583-52952@bounce.send.grammarly.com designates 13.111.122.9 as permitted sender) smtp.mailfrom=bounce-45825_HTML-557366919-2687540-6424583-52952@bounce.send.grammarly.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=send.grammarly.com"
},
{
"Name": "Return-Path",
"Value": "<bounce-45825_HTML-557366919-2687540-6424583-52952@bounce.send.grammarly.com>"
},
{
"Name": "Received",
"Value": "from mta4.send.grammarly.com (mta4.send.grammarly.com. [13.111.122.9]) by mx.google.com with ESMTPS id x14si334892uap.207.2020.09.30.09.36.01 for <user@domain.io> (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 30 Sep 2020 09:36:01 -0700 (PDT)"
},
{
"Name": "Received-SPF",
"Value": "pass (google.com: domain of bounce-45825_html-557366919-2687540-6424583-52952@bounce.send.grammarly.com designates 13.111.122.9 as permitted sender) client-ip=13.111.122.9;"
},
{
"Name": "Authentication-Results",
"Value": "mx.google.com; userim=pass header.i=@send.grammarly.com header.s=200608 header.b=AHhCKJjI; spf=pass (google.com: domain of bounce-45825_html-557366919-2687540-6424583-52952@bounce.send.grammarly.com designates 13.111.122.9 as permitted sender) smtp.mailfrom=bounce-45825_HTML-557366919-2687540-6424583-52952@bounce.send.grammarly.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=send.grammarly.com"
},
{
"Name": "userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; s=200608; d=send.grammarly.com; h=From:To:Subject:Date:List-Unsubscribe:MIME-Version:Reply-To:List-ID: X-CSA-Complaints:Message-ID:Content-Type; i=info@send.grammarly.com; bh=3tGgTbVsOqIdcWpZmcxV3mpemPm9FK/OHgw1G3FwZFo=; b=AHhCKJjI5fnuOJWoiRaMTpTBhDo5BI0tmL/9/4N/pXLEnVjbLkOjJwXpctGiXcDxzwurgjtYkxba Kllcg/KJpkudn524LHjFBRgEOlQu9764SJEXcwBXkZwQ7HTMZZIVyItoZsSU5wiVM6PoAc7qNCy0 H+je4EzCMdz23sPx4QU="
},
{
"Name": "Received",
"Value": "by mta4.send.grammarly.com id heipv42fmd4t for <user@domain.io>; Wed, 30 Sep 2020 16:36:01 +0000 (envelope-from <bounce-45825_HTML-557366919-2687540-6424583-52952@bounce.send.grammarly.com>)"
},
{
"Name": "From",
"Value": "Grammarly <info@send.grammarly.com>"
},
{
"Name": "To",
"Value": "<user@domain.io>"
},
{
"Name": "Subject",
"Value": "Write like a pro. Here's 20% off Grammarly Premium!"
},
{
"Name": "Date",
"Value": "Wed, 30 Sep 2020 10:36:01 -0600"
},
{
"Name": "List-Unsubscribe",
"Value": "<mailto:leave-fce310757d6601122d502d29-fe1c11757267027b7c1579-fe8f16767d63017975-fe8f12747760017576-fef811727c6106@leave.send.grammarly.com>"
},
{
"Name": "MIME-Version",
"Value": "1.0"
},
{
"Name": "Reply-To",
"Value": "No Reply <reply-fe8f16767d63017975-45825_HTML-557366919-6424583-52952@send.grammarly.com>"
},
{
"Name": "List-ID",
"Value": "<6424583.xt.local>"
},
{
"Name": "X-CSA-Complaints",
"Value": "whitelist-complaints@eco.de"
},
{
"Name": "X-SFMC-Stack",
"Value": "6"
},
{
"Name": "x-job",
"Value": "6424583_2687540"
},
{
"Name": "Message-ID",
"Value": "<5fce86ef-4d77-4f07-9f53-1cddafcf71d8@ind1s06mta1348.xt.local>"
},
{
"Name": "Content-Type",
"Value": "multipart/alternative; boundary=\"OBJySHqLwkIq=_?:\""
}
],
"ID": "174dfdee81fa8346",
"RawData": null,
"Subject": "Write like a pro. Here's 20% off Grammarly Premium!",
"To": "<user@domain.io>"
}
],
"Gmail": [
{
"Attachment Names": "",
"Attachments": [],
"Bcc": [],
"Body": "Grammarly\r\n \r\nhttps://click.send.grammarly.com/?qs=63b8bce6088947298e58f6b209acbedec627da2c5a9e6db63c25d7a91cc5d033f20b5e98474ae6c26955d5953c80e198718e7c642c683f08 \r\n\r\n\r\nhttps://click.send.grammarly.com/?qs=63b8bce608894729a31f23d448c10aacac177bc32d35281412289bdeaee77e6d71237bba943365135f276dd3a216a98afc38539bcc342bd0 \r\n\r\n\r\nYour Guide to Great Writing\r\nWhen you’re polishing an important message, there’s a lot to consider. To better guide you through the editing process, we’ve given Grammarly's browser extension a sleek new look. With suggestions organized by importance and theme, plus easy access to Grammarly’s tone detector, it’s never been easier to quickly and thoroughly improve your writing before sending it out into the world.\r\nWant to check it out for yourself?\r\n\r\n Next time you’re writing online, open Grammarly by clicking the green G in the lower right corner of your text field.\r\n\r\n\r\n\r\nhttps://click.send.grammarly.com/?qs=63b8bce608894729a31f23d448c10aacac177bc32d35281412289bdeaee77e6d71237bba943365135f276dd3a216a98afc38539bcc342bd0 \r\nLearn More \r\n\r\n\r\nhttps://click.send.grammarly.com/?qs=63b8bce608894729a31f23d448c10aacac177bc32d35281412289bdeaee77e6d71237bba943365135f276dd3a216a98afc38539bcc342bd0 \r\n\r\n\r\nFloating sidebar\r\n\r\nNow you can see all of Grammarly\u2019s feedback\u2014including suggestions about wordiness\u2014in a compact sidebar that you can position anywhere on your screen.\r\n\r\nhttps://click.send.grammarly.com/?qs=63b8bce608894729a31f23d448c10aacac177bc32d35281412289bdeaee77e6d71237bba943365135f276dd3a216a98afc38539bcc342bd0 \r\n\r\nOrganized feedback\r\nInstead of one long list of fixes, Grammarly now groups suggestions by theme, so you can tackle issues in an order that makes sense to you.\r\n\r\n\r\n\r\nhttps://click.send.grammarly.com/?qs=63b8bce60889472968c8fbdddda67d5ffe4e3e9510c3d039f51c5e6384a0dbf7f50df926ac0c45cffcc37d987e90c2db8d5a605ae2bf3c4a \r\n\r\n\r\nWhat's new in Premium?\r\nIf you\u2019re considering an upgrade to Grammarly Premium, now\u2019s a fantastic time. You\u2019ll get full access to Grammarly\u2019s tone suggestions and some all-new suggestions, including full-sentence clarity rewrites. For multilingual speakers, we\u2019ve added tailored suggestions to help you write more fluently with natural phrasing and word choice.\r\n\r\nhttps://click.send.grammarly.com/?qs=63b8bce60889472968c8fbdddda67d5ffe4e3e9510c3d039f51c5e6384a0dbf7f50df926ac0c45cffcc37d987e90c2db8d5a605ae2bf3c4a \r\nUpgrade to Premium \r\n\r\n \r\n \r\n\r\nhttps://click.send.grammarly.com/?qs=63b8bce6088947298205de4bc6f5baa6942035a27347bed70f376eb641988ce13553a98df548d5334c710496da40d701ea7f0747436cb35e \r\n\r\n \r\nhttps://click.send.grammarly.com/?qs=63b8bce60889472909674b9e1b80086f2f8a55a758ec0ff5422c7e418731df78a536f03419e5467ea3cdc46cfe13a7219c9c76aa43c18353 \r\n\r\n \r\nhttps://click.send.grammarly.com/?qs=63b8bce60889472978abf8c16e483cf9963720144e7eedea2b7fae9baca38d9f366a74bfaa6a9c55bb716d0eb437e2b13b0e0b9aa03f956a \r\n\r\n \r\nhttps://click.send.grammarly.com/?qs=63b8bce608894729cd424fff00db5cfde8a9258b354120767b238dc40dc183b9789fa2f900ff0e57c8d9a6bc77ad2ef68d26c422e5e3e9c0 \r\n\r\n\r\n \r\n\r\n \r\n\r\n \r\n\r\nhttps://view.send.grammarly.com/?qs=09877178720a4d39668e7a44fdd78d68f8393fb23acee0b64eff0a606379ca046d45856dfefd80f8302eadc8f7dec1dae314e6f038bafd98a388c93dc5a7bdddd160a54982f69a8f21b74bd31a5adbcf567ca0583163d53d \r\nView Web Version . \r\nhttps://click.send.grammarly.com/?qs=63b8bce608894729304de51e86d38d53940d8ee74804fd68ba82bccecdc473489f3ae530efe098cb4fad4d7796657104acd6cd72a37bcb4319ef4ac52472d689 \r\nEmail Preferences .\r\nhttps://click.send.grammarly.com/?qs=63b8bce608894729304de51e86d38d53940d8ee74804fd68ba82bccecdc473489f3ae530efe098cb4fad4d7796657104acd6cd72a37bcb4319ef4ac52472d689 \r\nUnsubscribe \r\n\r\n\r\nYou received this email because you are signed up to receive product update emails. If you would no longer like to receive these, please update your email preferences by visiting the link above.\r\n\r\n\r\n(c) 2020 Grammarly, Inc. 548 Market St. #35410, San Francisco, CA 94104\r\n\r\n\r\n \r\n\r\n\r\n \r\n\r\n\r\n",
"Cc": [],
"Date": "Wed, 07 Oct 2020 09:14:18 -0600",
"Format": "multipart/alternative",
"From": "Grammarly <info@send.grammarly.com>",
"Headers": [
{
"Name": "Delivered-To",
"Value": "user@domain.io"
},
{
"Name": "Received",
"Value": "by 2002:a1c:7fc5:0:0:0:0:0 with SMTP id a188csp615180wmd; Wed, 7 Oct 2020 08:14:23 -0700 (PDT)"
},
{
"Name": "X-Google-Smtp-Source",
"Value": "ABdhPJysZgukxXMVT3hNQSZ7vY1eZ1GXyXITNHrq5pHrea8WlO0evMqX7Y7S0HKmIQBGh41MSvQu"
},
{
"Name": "X-Received",
"Value": "by 2002:a1f:a94c:: with SMTP id s73mr1992787vke.19.1602083663011; Wed, 07 Oct 2020 08:14:23 -0700 (PDT)"
},
{
"Name": "ARC-Seal",
"Value": "i=1; a=rsa-sha256; t=1602083663; cv=none; d=google.com; s=arc-20160816; b=XADz+Kbl147CfVKP0LeksHQo/VotxjPhZdhMTHCh2odXJjQdOYQht55Mzsx2qDpbAm JuoffdsyLwuM4boUxIHTDU1jRlcpA11eVyukxICWcDUaJ8cDMORgBSxcY6PiJd5xXzyZ hmjxnn8Nz2vJD8TsiEVAEP1DoXIGl8DMz1HaPLZ2SAxPtPAloUAdcbw5jd88ZeLxRC91 Ztuqz4eGUmDZi/VgvyO+ekWRlmxVGtbD1LiFwCLy4z3WNFrkjIslcF5cZMV0iRKx6FyN G7EshV80gsvok5Dx4VdaprRWX6YjfTSoUE+jDuserJWouser2FboHCL1Hz7HkHfZV4QDjbV9 O6ow=="
},
{
"Name": "ARC-Message-Signature",
"Value": "i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=message-id:list-id:reply-to:mime-version:list-unsubscribe:date :subject:to:from:userim-signature; bh=pdsL/LK5XBos7TlVNY0trfJeccJTknVSjDucFlbPwO0=; b=FMfJczy2kdmT/P+CDmFaQGk1AqzOSV1wyICF8jNkjF79AEpP1OsA+YBLvqoICRgdyB sMZtdQjUQ1DYOYLe8LMtPOMwAOrP3pQw1iyg6YaPgbaq4DJr1b0CPlOvpacgVSIrcO+n DtFlmJ4OwYayJilD1PniD7nl3YLQzodxn1rNSO76kbWtKEis/xR2+lulBL9So8+y/r/y fTdaKQri9EjPYuserOSTcdF0jPAfg/IbH1NOrfLvj51+RIgrHRTC2Xqazo1Qf8WMVMATH6 NnlJZ7/qyR0Dur7gYVVxudJs7EW7+P7hk/p/fMrOgcRNPLgOEBT/K1392n8XrY+xDlMK uNxg=="
},
{
"Name": "ARC-Authentication-Results",
"Value": "i=1; mx.google.com; userim=pass header.i=@send.grammarly.com header.s=200608 header.b=mfR0Nrti; spf=pass (google.com: domain of bounce-45825_html-557366919-2940833-6424583-17450@bounce.send.grammarly.com designates 13.111.27.229 as permitted sender) smtp.mailfrom=bounce-45825_HTML-557366919-2940833-6424583-17450@bounce.send.grammarly.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=send.grammarly.com"
},
{
"Name": "Return-Path",
"Value": "<bounce-45825_HTML-557366919-2940833-6424583-17450@bounce.send.grammarly.com>"
},
{
"Name": "Received",
"Value": "from mta6.send.grammarly.com (mta6.send.grammarly.com. [13.111.27.229]) by mx.google.com with ESMTPS id u16si118009vsg.46.2020.10.07.08.14.20 for <user@domain.io> (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Oct 2020 08:14:23 -0700 (PDT)"
},
{
"Name": "Received-SPF",
"Value": "pass (google.com: domain of bounce-45825_html-557366919-2940833-6424583-17450@bounce.send.grammarly.com designates 13.111.27.229 as permitted sender) client-ip=13.111.27.229;"
},
{
"Name": "Authentication-Results",
"Value": "mx.google.com; userim=pass header.i=@send.grammarly.com header.s=200608 header.b=mfR0Nrti; spf=pass (google.com: domain of bounce-45825_html-557366919-2940833-6424583-17450@bounce.send.grammarly.com designates 13.111.27.229 as permitted sender) smtp.mailfrom=bounce-45825_HTML-557366919-2940833-6424583-17450@bounce.send.grammarly.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=send.grammarly.com"
},
{
"Name": "userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; s=200608; d=send.grammarly.com; h=From:To:Subject:Date:List-Unsubscribe:MIME-Version:Reply-To:List-ID: X-CSA-Complaints:Message-ID:Content-Type; i=info@send.grammarly.com; bh=pdsL/LK5XBos7TlVNY0trfJeccJTknVSjDucFlbPwO0=; b=mfR0NrtiSo8ju6kEDrZ8LSOE+VNqD+Gdw+mHUGTsLDpvvQ7yK2gLkv2WV6gwEgPY+N3e9u2Nqfi5 EA0V1wKWBwP5RUbQCu2Ir16VE34+gb+xUCxRpc3kx35tN40N1S9LXL2MUti9FLAvB90bvCaVIYAi DBvKmJ7ITnn0/sRAuVc="
},
{
"Name": "Received",
"Value": "by mta6.send.grammarly.com id hfnuser22fmd40 for <user@domain.io>; Wed, 7 Oct 2020 15:14:05 +0000 (envelope-from <bounce-45825_HTML-557366919-2940833-6424583-17450@bounce.send.grammarly.com>)"
},
{
"Name": "From",
"Value": "Grammarly <info@send.grammarly.com>"
},
{
"Name": "To",
"Value": "<user@domain.io>"
},
{
"Name": "Subject",
"Value": "A new editing experience from Grammarly"
},
{
"Name": "Date",
"Value": "Wed, 07 Oct 2020 09:14:18 -0600"
},
{
"Name": "List-Unsubscribe",
"Value": "<mailto:leave-fce310757d6601122d502d29-fe1c11757267027b7c1579-fe92167971640c7e76-fe8f12747760017576-fefe1577716104@leave.send.grammarly.com>"
},
{
"Name": "MIME-Version",
"Value": "1.0"
},
{
"Name": "Reply-To",
"Value": "No Reply <reply-fe92167971640c7e76-45825_HTML-557366919-6424583-17450@send.grammarly.com>"
},
{
"Name": "List-ID",
"Value": "<6424583.xt.local>"
},
{
"Name": "X-CSA-Complaints",
"Value": "whitelist-complaints@eco.de"
},
{
"Name": "X-SFMC-Stack",
"Value": "6"
},
{
"Name": "x-job",
"Value": "6424583_2940833"
},
{
"Name": "Message-ID",
"Value": "<73b01d0a-077f-428d-9495-16bfcd0c6839@ind1s06mta1344.xt.local>"
},
{
"Name": "Content-Type",
"Value": "multipart/alternative; boundary=\"p2tabpHjZRJC=_?:\""
}
],
"Html": "html",
"ID": "17503a0adab4557e",
"Labels": "CATEGORY_PROMOTIONS, UNREAD, INBOX",
"Mailbox": "user@domain.io",
"RawData": null,
"Subject": "A new editing experience from Grammarly",
"ThreadId": "17503a0adab4557e",
"To": "<user@domain.io>",
"Type": "Gmail"
},
{
"Attachment Names": "",
"Attachments": [],
"Bcc": [],
"Body": "Grammarly Premium August 2019 Promo \r\n\r\nhttps://click.send.grammarly.com/?qs=7d3ab28cc69aa23344f507f25b9d65dc197b1db732e9723c9d03738396344f15d971c8232f3f859821a9ed07612787ae8952a52df6c3e3e7f288747e04e4537f \r\nGet 20% off Premium → \r\n \r\n\r\nhttps://click.send.grammarly.com/?qs=7d3ab28cc69aa23344f507f25b9d65dc197b1db732e9723c9d03738396344f15d971c8232f3f859821a9ed07612787ae8952a52df6c3e3e7f288747e04e4537f \r\n\r\n \r\nAre you ready to level up? Grammarly Premium empowers you to put your best foot forward through exclusive access to features like vocabulary enhancement and suggestions for improving style and tone.\r\n\r\nUpgrade in the next 48 hours to receive 20% OFF and start writing compelling, effective content with greater confidence.\r\n \r\n\r\nhttps://click.send.grammarly.com/?qs=7d3ab28cc69aa23344f507f25b9d65dc197b1db732e9723c9d03738396344f15d971c8232f3f859821a9ed07612787ae8952a52df6c3e3e7f288747e04e4537f \r\nGet 20% Off Premium \r\n\r\n \r\n\r\n \r\n \r\n\r\nhttps://click.send.grammarly.com/?qs=7d3ab28cc69aa23344f507f25b9d65dc197b1db732e9723c9d03738396344f15d971c8232f3f859821a9ed07612787ae8952a52df6c3e3e7f288747e04e4537f \r\n\r\n \r\n \r\n \r\n\r\nhttps://click.send.grammarly.com/?qs=2a35c60cf790245dace2796a031670f49219f3c4a00cae25d2dab59f72e6be49671fdecec1ca6d0285eac535168d7d98d0174ae389750a82 \r\n\r\nhttps://click.send.grammarly.com/?qs=a5f2bccb158ea90a0f6327f16256b045f7045b3ad3b9888cb4403400459f0be6bd90d7662bd64b837e1407368baedc62b0a80ca05f11d285 \r\n\r\nhttps://click.send.grammarly.com/?qs=a8de5e2a924b74c72a9cab9ac340987e51210dfea60c966334c7fe8354d11d0ee4824a49abaf38276f8a4f57fe26b84881b2f518ca4e5c44 \r\n\r\nhttps://click.send.grammarly.com/?qs=31d75588096fc8f0ecf301e89b11f8e90f5ea6e5283bd15266a2bbc89e4bec07c0a70213de591dfb18a0d88647f8a091eb0b527f013b4087 \r\n\r\n \r\n \r\n\r\nhttps://view.send.grammarly.com/?qs=04bdbe912f831db4355d68715de8fcc8bc879738444c98c65c7026b05760cc2e72cb475a3fcefe9843d4d8a929dbb99cca13e0eff2ed2b7693c950a77831230ebcc2421322e1194ee01f317d8b9ddb58e33dde99eb0db358 \r\nView Web Version \u00b7 \r\nhttps://click.send.grammarly.com/?qs=19dd9fb895689c3f0dd49d01ba845db6ad830f8fea7e18f4f49ced631c9a973533f91f93115ca5afaf96b7e3a9d092eaa29d1a417ad1c7975ab94c6b36607509 \r\nEmail Preferences \u00b7 \r\nhttps://click.send.grammarly.com/?qs=19dd9fb895689c3f0dd49d01ba845db6ad830f8fea7e18f4f49ced631c9a973533f91f93115ca5afaf96b7e3a9d092eaa29d1a417ad1c7975ab94c6b36607509 \r\nUnsubscribe \r\n \r\nYou received this offer for Grammarly Premium because you are currently opted in to receive them via your preference settings. You may adjust your preferences at any time by clicking the link above.\r\n \r\n\u00a9 2020 Grammarly, Inc., 548 Market St. #35410, San Francisco, CA 94104\r\n \r\n\r\n\r\n",
"Cc": [],
"Date": "Wed, 30 Sep 2020 10:36:01 -0600",
"Format": "multipart/alternative",
"From": "Grammarly <info@send.grammarly.com>",
"Headers": [
{
"Name": "Delivered-To",
"Value": "user@domain.io"
},
{
"Name": "Received",
"Value": "by 2002:a1c:7fc5:0:0:0:0:0 with SMTP id a188csp4842038wmd; Wed, 30 Sep 2020 09:36:02 -0700 (PDT)"
},
{
"Name": "X-Google-Smtp-Source",
"Value": "ABdhPJwojgAt1ZQUAuZgooyBtFUXhP13Te3ZswIrvoLlwDBbdnGOwpwKXuP0WdIhvsqgayud3lIg"
},
{
"Name": "X-Received",
"Value": "by 2002:a67:e3aa:: with SMTP id j10mr2201774vsm.51.1601483761873; Wed, 30 Sep 2020 09:36:01 -0700 (PDT)"
},
{
"Name": "ARC-Seal",
"Value": "i=1; a=rsa-sha256; t=1601483761; cv=none; d=google.com; s=arc-20160816; b=AuJYXtVI9hjosJlJYJ8kq07D4Eui933s9oDoPLnDb3VfBfc5TDlQ5NL9l94xSEXrFz Rutk8X1gzr2+34HSEQHC2Nn3QWJLI5sF/st2+ilhDXIIeWmxnG2AnRW8w4ZI3hq3tFdg iajCRHIlh85UifLyMuXKphABcPvxc6DE8OhEa7w53m1XpgwIO7+lOp7hU0ezj6WNirAv /F3TteoDPp8/QP1RoMjKk4OU+f+l+hcVewLktDXp7WlU+dqze62S224J/+AVtkrie0sm 7HLvgRCtgmCEy7csI0ym3iXCf+AgdlyJWfSpbFKYO+ZabU8c5KtgQU+PYDBwm0y1zNsG GLLg=="
},
{
"Name": "ARC-Message-Signature",
"Value": "i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=message-id:list-id:reply-to:mime-version:list-unsubscribe:date :subject:to:from:userim-signature; bh=3tGgTbVsOqIdcWpZmcxV3mpemPm9FK/OHgw1G3FwZFo=; b=EWoUJBwsNXvAzEHpj2v7lUMc0Wn9HVRkA7tLj5qPOHjt7gJNO4tQn3g9FDCzRGoq0W Lj54zgjIVU0RZf67LJV+lA18v46oYVQfFxo85hPqNHfUs+GLHcAQTlFTUmpuser+You2df qT22+L333SLywLWwVmSqK2IZbjVcK14wzDwAdQwMY6GizNToH8ybh0HMn+aZg99U3Ncs 98gdR5z9VY9BCskAguWsNjIcaGqGD8ZqrjJB8KdhSHNVZY7oi5yI1YSCm+7WciAf1P8F IhZnqjlVdMHikxUsPTy4qu2CWvStNspBr27jvW9OCVUZ5Z+xuAshyXa4BCoRkV2sXNOR 2eWg=="
},
{
"Name": "ARC-Authentication-Results",
"Value": "i=1; mx.google.com; userim=pass header.i=@send.grammarly.com header.s=200608 header.b=AHhCKJjI; spf=pass (google.com: domain of bounce-45825_html-557366919-2687540-6424583-52952@bounce.send.grammarly.com designates 13.111.122.9 as permitted sender) smtp.mailfrom=bounce-45825_HTML-557366919-2687540-6424583-52952@bounce.send.grammarly.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=send.grammarly.com"
},
{
"Name": "Return-Path",
"Value": "<bounce-45825_HTML-557366919-2687540-6424583-52952@bounce.send.grammarly.com>"
},
{
"Name": "Received",
"Value": "from mta4.send.grammarly.com (mta4.send.grammarly.com. [13.111.122.9]) by mx.google.com with ESMTPS id x14si334892uap.207.2020.09.30.09.36.01 for <user@domain.io> (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 30 Sep 2020 09:36:01 -0700 (PDT)"
},
{
"Name": "Received-SPF",
"Value": "pass (google.com: domain of bounce-45825_html-557366919-2687540-6424583-52952@bounce.send.grammarly.com designates 13.111.122.9 as permitted sender) client-ip=13.111.122.9;"
},
{
"Name": "Authentication-Results",
"Value": "mx.google.com; userim=pass header.i=@send.grammarly.com header.s=200608 header.b=AHhCKJjI; spf=pass (google.com: domain of bounce-45825_html-557366919-2687540-6424583-52952@bounce.send.grammarly.com designates 13.111.122.9 as permitted sender) smtp.mailfrom=bounce-45825_HTML-557366919-2687540-6424583-52952@bounce.send.grammarly.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=send.grammarly.com"
},
{
"Name": "userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; s=200608; d=send.grammarly.com; h=From:To:Subject:Date:List-Unsubscribe:MIME-Version:Reply-To:List-ID: X-CSA-Complaints:Message-ID:Content-Type; i=info@send.grammarly.com; bh=3tGgTbVsOqIdcWpZmcxV3mpemPm9FK/OHgw1G3FwZFo=; b=AHhCKJjI5fnuOJWoiRaMTpTBhDo5BI0tmL/9/4N/pXLEnVjbLkOjJwXpctGiXcDxzwurgjtYkxba Kllcg/KJpkudn524LHjFBRgEOlQu9764SJEXcwBXkZwQ7HTMZZIVyItoZsSU5wiVM6PoAc7qNCy0 H+je4EzCMdz23sPx4QU="
},
{
"Name": "Received",
"Value": "by mta4.send.grammarly.com id heipv42fmd4t for <user@domain.io>; Wed, 30 Sep 2020 16:36:01 +0000 (envelope-from <bounce-45825_HTML-557366919-2687540-6424583-52952@bounce.send.grammarly.com>)"
},
{
"Name": "From",
"Value": "Grammarly <info@send.grammarly.com>"
},
{
"Name": "To",
"Value": "<user@domain.io>"
},
{
"Name": "Subject",
"Value": "Write like a pro. Here's 20% off Grammarly Premium!"
},
{
"Name": "Date",
"Value": "Wed, 30 Sep 2020 10:36:01 -0600"
},
{
"Name": "List-Unsubscribe",
"Value": "<mailto:leave-fce310757d6601122d502d29-fe1c11757267027b7c1579-fe8f16767d63017975-fe8f12747760017576-fef811727c6106@leave.send.grammarly.com>"
},
{
"Name": "MIME-Version",
"Value": "1.0"
},
{
"Name": "Reply-To",
"Value": "No Reply <reply-fe8f16767d63017975-45825_HTML-557366919-6424583-52952@send.grammarly.com>"
},
{
"Name": "List-ID",
"Value": "<6424583.xt.local>"
},
{
"Name": "X-CSA-Complaints",
"Value": "whitelist-complaints@eco.de"
},
{
"Name": "X-SFMC-Stack",
"Value": "6"
},
{
"Name": "x-job",
"Value": "6424583_2687540"
},
{
"Name": "Message-ID",
"Value": "<5fce86ef-4d77-4f07-9f53-1cddafcf71d8@ind1s06mta1348.xt.local>"
},
{
"Name": "Content-Type",
"Value": "multipart/alternative; boundary=\"OBJySHqLwkIq=_?:\""
}
],
"Html": "html",
"ID": "174dfdee81fa8346",
"Labels": "CATEGORY_PROMOTIONS, UNREAD, INBOX",
"Mailbox": "user@domain.io",
"RawData": null,
"Subject": "Write like a pro. Here's 20% off Grammarly Premium!",
"ThreadId": "174dfdee81fa8346",
"To": "<user@domain.io>",
"Type": "Gmail"
}
]
}
Human Readable Output
Search in user@domain.io
query: “after:2020/03/20 before:2021/04/01 access”
gmail-search-all-mailboxes
Searches the Gmail records for all Google users.
Troubleshooting
The command iterates over all available accounts, and downloads messages matching the query for each account. For organizations with many accounts, this can take longer than the default 5 minutes. To overcome this issue increase the execution-timeout from 300 to a higher value.
To determine what value should be used, take a look at the logs after a failed execution of the command. The command prints to the logs info messages detailing the status of the search for every 100 accounts it successfully searched.
2022-06-27 09:56:05.1588 info (Gmail_instance_Gmail_gmail-search-all-mailboxes) Still searching. Searched 40% of total accounts (400 / 1000), and found 30 results so far (source: /Users/darbel/dev/go/src/github.com/demisto/server/services/automation/dockercoderunner.go:955)
Inspecting these messages should allow you to determine what percent the search was able to finish before timing out. Take the given timeout and divide it with the last percent you see in the logs - the new timeout value should be greater than this. Fine tune the correct execution-timeout.
Base Command
gmail-search-all-mailboxes
Input
| Argument Name | Description | Required |
|---|---|---|
| query | Returns messages matching the specified query. Supports the same query format as the Gmail search box. For example, “from:someuser@example.com rfc822msgid: is:unread”. For more syntax information,see “https://support.google.com/mail/answer/7190?hl=en”. | Optional |
| max-results | The maximum number of results to return. Default is 100. Maximum is 500. Can be 1 to 500, inclusive. Default is 100. | Optional |
| fields | Enables partial responses to be retrieved, separated by commas. Valid fields are only from the following list: Type, Mailbox, ThreadId, Labels, Headers, Attachments, RawData, Format, Subject, From, To, Body, Cc, Bcc, Date, Html, Attachment Names. | Optional |
| labels-ids | Returns messages with labels that match all of the specified label IDs in a comma-separated list. | Optional |
| page-token | Page token to retrieve a specific page of results in the list. | Optional |
| include-spam-trash | Includes messages from SPAM and TRASH in the results. (Default: false). Possible values are: False, True. Default is False. | Optional |
| from | Specifies the sender. For example, “john”. | Optional |
| to | Specifies the receiver. For example, “john”. | Optional |
| subject | Words in the subject line. For example, “alert”. | Optional |
| filename | Attachments with a certain name or file type. For example, “pdf” or “report.pdf”. | Optional |
| in | Messages in any folder, including Spam and Trash. For example, shopping. | Optional |
| after | Search for messages sent after a specific date. For example, 2018/05/06. | Optional |
| before | Search for messages sent before a specific date. For example, 2018/05/09. | Optional |
| has-attachments | Whether to search for messages sent with attachments. Possible values are: False, True. | Optional |
| show-only-mailboxes | Whether to return only mailboxes which contain the email. Default is “True”. Possible values are: false, true. Default is True. | Optional |
| list_accounts | Accounts to search in. | Optional |
| search_from | Used to track search progress. | Optional |
| search_to | Used to track search progress. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Gmail.ID | string | The inner ID of the Gmail message. |
| Gmail.ThreadId | string | The thread ID. |
| Gmail.Format | string | The MIME type of the email. |
| Gmail.Labels | string | The labels of a specific email. |
| Gmail.To | string | The email address of the receiver. |
| Gmail.From | string | The email address of the sender. |
| Gmail.Cc | string | The additional recipient email address (CC). |
| Gmail.Bcc | string | The additional recipient email address (BCC). |
| Gmail.Subject | string | The subject of the specific email. |
| Gmail.Body | string | The content of the email. |
| Gmail.Attachments | unknown | The attachments of the email. IDs are separated by commas. |
| Gmail.Headers | unknown | All headers of a specific mail (list). |
| Gmail.Mailboxes | String | The Gmail mailboxes in which emails matching the query were found. |
| Gmail.UnsearchedAcounts | String | A list of accounts that were not searched due to an error accessing them. |
| PageToken.NextPageToken | String | Fetches the next list of accounts that will be searched. |
| SearchFromAccountIndex | String | A search is performed from an account index (Enables the search process to be followed). |
| SearchToAccountIndex | String | A search is performed to an account index (Enables the search process to be followed). |
| Email.To | String | The recipient of the email. |
| Email.From | String | The sender of the email. |
| Email.CC | String | The additional recipient email address (CC). |
| Email.BCC | String | The additional recipient email address (BCC). |
| Email.Format | String | The format of the email. |
| Email.Body/HTML | String | The HTML version of the email. |
| Email.Body/Text | String | The plain-text version of the email. |
| Email.Subject | String | The subject of the email. |
| Email.Headers | String | The headers of the email. |
| Email.Attachments.entryID | Unknown | Email Attachments. IDs are separated by commas. |
| Email.Date | String | The date the email was received. |
Command Example
!gmail-search-all-mailboxes after=2019/04/10 max-results=1 before=2021/04/15
Context Example
{
"Email": [
{
"Attachment Names": "",
"Attachments": [],
"BCC": [],
"Body/HTML": "<div>\r\n <meta http-equiv=Content-Type content=\"text/html; charset=utf-8\">\r\n <meta name=viewport content=width=device-width>\r\n <style>@media only screen{html{min-height:100%;background:#fafafa}}@media only screen and (max-width:640px){.small-float-center{margin:0 auto!important;float:none!important;text-align:center!important}}@media only screen and (max-width:640px){table.body img{width:auto;height:auto}table.body center{min-width:0!important}table.body .container{width:344px!important}table.body .columns{height:auto!important;-moz-box-sizing:border-box;-webkit-box-sizing:border-box;box-sizing:border-box;padding-left:40px!important;padding-right:40px!important}table.body .columns .columns{padding-left:0!important;padding-right:0!important}table.body .collapse .columns{padding-left:0!important;padding-right:0!important}th.small-1{display:inline-block!important;width:8.33333%!important}th.small-3{display:inline-block!important;width:25%!important}th.small-4{display:inline-block!important;width:33.33333%!important}th.small-6{display:inline-block!important;width:50%!important}th.small-8{display:inline-block!important;width:66.66667%!important}th.small-9{display:inline-block!important;width:75%!important}th.small-12{display:inline-block!important;width:100%!important}.columns th.small-12{display:block!important;width:100%!important}table.menu{width:100%!important}table.menu td,table.menu th{width:auto!important;display:inline-block!important}table.menu.vertical td,table.menu.vertical th{display:block!important}table.menu[align=center]{width:auto!important}}</style>\r\n <span class=preheader style=color:#fafafa;display:none!important;font-size:1px;line-height:1px;max-height:0;max-width:0;mso-hide:all!important;opacity:0;overflow:hidden;visibility:hidden></span>\r\n <table class=body style=Margin:0;background:#F8F9FA!important;border-collapse:collapse;border-spacing:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;height:100%;line-height:inherit;margin:0;padding:0;vertical-align:top;width:100%;text-align:left>\r\n <tr style=padding:0;vertical-align:top>\r\n <td class=center align=center valign=top style=-moz-hyphens:none;-webkit-hyphens:none;Margin:0;border-collapse:collapse!important;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;hyphens:none;line-height:inherit;margin:0;padding:0;vertical-align:top;word-wrap:keep-all>\r\n <center data-parsed=\"\" style=min-width:600px;width:100%>\r\n\r\n <table align=center class=\"container float-center\" style=\"Margin:0 auto;background:#fafafa;border-collapse:collapse;border-spacing:0;float:none;margin:0 auto;padding:0;text-align:left;vertical-align:top;width:600px\"><tbody><tr style=padding:0;vertical-align:top><td style=-moz-hyphens:none;-webkit-hyphens:none;Margin:0;border-collapse:collapse!important;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;hyphens:none;line-height:inherit;margin:0;padding:0;vertical-align:top;word-wrap:keep-all>\r\n <table class=\"row header\" style=background:#F8F9FA;border-collapse:collapse;border-spacing:0;display:table;font-size:12px;padding:0;position:relative;vertical-align:top;width:100%><tbody><tr style=padding:0;vertical-align:top>\r\n <th class=\"small-12 large-12 columns first last\" style=\"Margin:0 auto;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0 auto;padding:0;padding-bottom:24px;padding-left:40px;padding-right:40px;padding-top:12px;width:560px\"><table style=border-collapse:collapse;border-spacing:0;margin-bottom:0;padding:0;vertical-align:top;width:100%><tr style=padding:0;vertical-align:top><th style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0;text-align:left>\r\n\r\n <img src=https://storage.googleapis.com/support-kms-prod/BfxWlTCe6OCizPoUdUCwDz979TQRdnVdSMCG alt=\"G Suite\" height=30 style=-ms-interpolation-mode:bicubic;clear:both;display:block;margin-top:24px;max-height:30px;max-width:100%;outline:0;text-decoration:none;width:auto>\r\n\r\n </th>\r\n<th class=expander style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0!important;visibility:hidden;width:0></th></tr></table></th>\r\n </tr></tbody></table>\r\n\r\n <table class=\"row info\" style=align-items:center;background:#fff;border-collapse:collapse;border-color:#E8EAED;border-spacing:0;border-style:solid;border-width:1px;display:table;padding:0;position:relative;vertical-align:top;width:100%><tbody><tr style=padding:0;vertical-align:top>\r\n <th class=\"small-12 large-12 columns first last\" style=\"Margin:0 auto;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0 auto;padding:0;padding-bottom:0;padding-left:40px;padding-right:40px;width:560px\"><table style=border-collapse:collapse;border-spacing:0;padding:0;vertical-align:top;width:100%><tr style=padding:0;vertical-align:top><th style=\"Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0 0 24px;text-align:left\">\r\n <p style=Margin:0;Margin-bottom:16px;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:24px;margin:0;margin-bottom:16px;margin-top:24px;padding:0>Hello Admin,</p>\r\n\r\n<p style=Margin:0;Margin-bottom:16px;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:24px;margin:0;margin-bottom:16px;padding:0>G Suite recently processed a request from test user (user@domain.io) to transfer data for admin admin (admin@domain.io) to newaccount newdemo (demo@domain.io).</p>\r\n\r\n<p style=Margin:0;Margin-bottom:16px;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:24px;margin:0;margin-bottom:16px;padding:0>The data transfer was successful.</p>\r\n\r\n<p style=\"margin-top:8px;color:#3C4043;font-family:Google Sans,Helvetica,Arial,sans-serif;font-size:14px;font-weight:700;line-height:24px;margin:0;margin-bottom:0px;padding:0\">Sincerely,</p>\r\n\r\n<p style=\"Margin:0;color:#3C4043;font-family:Google Sans,Helvetica,Arial,sans-serif;font-size:14px;font-weight:700;line-height:24px;margin:0;margin-bottom:0;padding:0\">The G Suite Team</p>\r\n </th></tr></table></th>\r\n </tr></tbody></table>\r\n\r\n <table class=\"row footer\" style=background:#F8F9FA;border-collapse:collapse;border-spacing:0;display:table;margin-top:0;padding:0;position:relative;vertical-align:top;width:100%><tbody><tr style=padding:0;vertical-align:top>\r\n <th class=\"small-12 large-12 columns first last\" style=\"Margin:0 auto;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0 auto;padding:0;padding-bottom:0;padding-left:40px;padding-right:40px;width:560px\"><table style=border-collapse:collapse;border-spacing:0;padding:0;vertical-align:top;width:100%><tr style=padding:0;vertical-align:top><th style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:24px;text-align:left>\r\n\r\n <img src=https://storage.googleapis.com/support-kms-prod/Yd1rPlunjtOKzNDXcw3eFmVCjI828xhBZqQy alt=\"Google Cloud\" height=30 style=-ms-interpolation-mode:bicubic;clear:both;display:block;margin-bottom:14px;max-width:100%;max-height:30px;outline:0;text-decoration:none;width:auto>\r\n <p style=Margin:0;Margin-bottom:16px;color:#6C737F;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:12px;font-weight:400;line-height:16px;margin:0;margin-bottom:14px;padding:0>\r\n \u00a9 2020 Google LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043\r\n </p>\r\n <p style=Margin:0;Margin-bottom:16px;color:#6C737F;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:12px;font-weight:400;line-height:16px;margin:0;margin-bottom:14px;padding:0>\r\n <em>You\u2019re receiving this mandatory email service announcement to update you about important changes to your Google Cloud product or account.</em>\r\n </p>\r\n </th>\r\n<th class=expander style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0!important;visibility:hidden;width:0></th></tr></table></th>\r\n </tr></tbody></table>\r\n </td></tr></tbody></table>\r\n\r\n </center>\r\n </td>\r\n </tr>\r\n </table>\r\n <!-- prevent Gmail on iOS font size manipulation -->\r\n <div style=\"display:none;white-space:nowrap;font:15px courier;line-height:0\"> </div>\r\n \r\n</div>\r\n",
"Body/Text": "From: \"The G Suite Team\" [gsuite-noreply@google.com]\r\nSubject: Your G Suite data transfer was successful for admin admin to \r\nnewaccount newdemo\r\n\r\nHello Admin,\r\n\r\nG\u00a0Suite recently processed a request from test user (user@domain.io) \r\nto transfer data for admin admin (admin@domain.io) to newaccount \r\nnewdemo (demo@domain.io).\r\n\r\nThe data transfer was successful.\r\n\r\nSincerely,\r\n\r\nThe G\u00a0Suite Team\r\n\r\n\r\n[Google Cloud]\r\n\r\n(c) 2020 Google LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043 * \r\nGoogle Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland * Google \r\nAsia Pacific Pte. Ltd., 8 Marina View, #30-01, Asia Square 1, Singapore \r\n018960\r\n\r\nYou're receiving this mandatory email service announcement to update you \r\nabout important changes to your Google Cloud product or account.\r\n",
"CC": [],
"Date": "Wed, 14 Oct 2020 05:41:24 -0700",
"Format": "multipart/alternative",
"From": "The G Suite Team <gsuite-noreply@google.com>",
"Headers": [
{
"Name": "Delivered-To",
"Value": "admin@domain.io"
},
{
"Name": "Received",
"Value": "by 2002:a02:7354:0:0:0:0:0 with SMTP id a20csp545510jae; Wed, 14 Oct 2020 05:41:28 -0700 (PDT)"
},
{
"Name": "X-Received",
"Value": "by 2002:ac8:5792:: with SMTP id v18mr548458qta.314.1602679284583; Wed, 14 Oct 2020 05:41:24 -0700 (PDT)"
},
{
"Name": "ARC-Seal",
"Value": "i=1; a=rsa-sha256; t=1602679284; cv=none; d=google.com; s=arc-20160816; b=inCsQKzjd3amLNvs3Bp/NvKnfT1kZepYeCarDm20s9rNbAsSQMAG4hs82ay7PdRWyQ wpF3gkwRhIBYRS+g9vzw0tm9is9DyDCZ6fDb1MD6cypJIv9s1if0yrb89BLfv8dobLkb /bA/rLqMOjz+aogJtYyXuzmOOzgd5O9t6SndWcDHXU39RxfortydOaRXDMs7v8MjY0ug QtKrcZMLS01+amO5am5PWz0hxORNpJ3eVvWDt2BdeyBjTfqKpHTeaoz1U9iF1ykiA3LZ ce9ojCi6ZE+cqha5N38Ymrb5q/4IHJqoRmeED/x0f5qfknCs+HH8EwIJKocklB0Xyyri rTDQ=="
},
{
"Name": "ARC-Message-Signature",
"Value": "i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=to:from:subject:message-id:feedback-id:reply-to:date:mime-version :userim-signature; bh=uHezP21QvUyC54yXw9TZPN19UBE4CUwtwmFkjlyW8yc=; b=SfF5gf8iUPvEjLbUf34ss15ub8BIsEFd9mqb8bLctUMFBeHYhvoI10A0hcef7sBMrR dGsjnLXCTUVWFG8KCDUq/4LU5Oxt/oynlymOMYXg4S4sgfwnn55YquSa7WkxSd56mCzu U3u9AiUXYPo3nXHkE2OpE56ZxZMZXybP7wqN5mtMTm1lgVIB0O+m9ZoXAfAHRrN/BlWm NyV3xYfKy4lxOXg2891Gqjor0cyxmdLnFfAUV1UhKtA6B8vdV8EYll8IgaGyF/ZV2nnv OcHCJN6P7nCAQjzfuftAfAKok8oH+wfJrK3NYZekkY3GY7yz5ecEQUUdUw+zlV7JEUU+ atsA=="
},
{
"Name": "ARC-Authentication-Results",
"Value": "i=1; mx.google.com; userim=pass header.i=@google.com header.s=20161025 header.b=i0zVcnln; spf=pass (google.com: domain of 39pggxw4kbfudprfqb-klobmivdlldib.zljxajfkkfjyibaxqx.fl@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) smtp.mailfrom=39PGGXw4KBfUdprfqb-klobmivdlldib.ZljXajfkkfjYibaXqX.fl@scoutcamp.bounces.google.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com"
},
{
"Name": "Return-Path",
"Value": "<39PGGXw4KBfUdprfqb-klobmivdlldib.ZljXajfkkfjYibaXqX.fl@scoutcamp.bounces.google.com>"
},
{
"Name": "Received",
"Value": "from mail-sor-f69.google.com (mail-sor-f69.google.com. [209.85.220.69]) by mx.google.com with SMTPS id x77sor1124176qkb.139.2020.10.14.05.41.24 for <admin@domain.io> (Google Transport Security); Wed, 14 Oct 2020 05:41:24 -0700 (PDT)"
},
{
"Name": "Received-SPF",
"Value": "pass (google.com: domain of 39pggxw4kbfudprfqb-klobmivdlldib.zljxajfkkfjyibaxqx.fl@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) client-ip=209.85.220.69;"
},
{
"Name": "Authentication-Results",
"Value": "mx.google.com; userim=pass header.i=@google.com header.s=20161025 header.b=i0zVcnln; spf=pass (google.com: domain of 39pggxw4kbfudprfqb-klobmivdlldib.zljxajfkkfjyibaxqx.fl@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) smtp.mailfrom=39PGGXw4KBfUdprfqb-klobmivdlldib.ZljXajfkkfjYibaXqX.fl@scoutcamp.bounces.google.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com"
},
{
"Name": "userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:date:reply-to:feedback-id:message-id:subject:from:to; bh=uHezP21QvUyC54yXw9TZPN19UBE4CUwtwmFkjlyW8yc=; b=i0zVcnln+GKJw0aTEwMcfE9LbIQpDTWDMUsBzRGyiTdzomU7SQ4wdfje3GlB+dJEJ3 aZyzP/LBE5Dn0ce3fDXlf2kVgip609YIHMbmCLpitcod/Y40Y3BOs54ppXgnTB8uuiaj K0gbEyk0ytwypf2YlpwSIG+IlkPsR7vh+r/XHtQZFMsFi/+lRwcVdd77RiAB3LSUu1VL FidSGkmo1/IWQafndOuGRoGESwYDSyKj3KH77Z67G8wLJycCoLwVRsz+1ypVZeXWjepC /BVtteMhC/wvG9yvqYfDN6O9b0RES3G6VVL8Q8Rct8Z6W+jfA4+Vjj8/0uucFFuhJUp1 VYAg=="
},
{
"Name": "X-Google-userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:date:reply-to:feedback-id :message-id:subject:from:to; bh=uHezP21QvUyC54yXw9TZPN19UBE4CUwtwmFkjlyW8yc=; b=sr5kUqJ8b3DtVKa6txI60W6YnjC4ut7/IS9vgrTFXYejb1kAz3S2T9kmusercByKpUgV d1dxJgc4IXWjvzXTGeiPhkd14yVU4o9yGVPyqpHWqh01wRzvm4A1XDCNpueqKzu3CCwD W0Gi5WDuxhyoXTVfbA5khNj3FKIzbsjEq9AuPmot7AGIU/KLqNNxZXTgmaEWjQAIOSNa ZO1yonkoJJzkiK8Ice77T9Z4sF8gK117uT+XGUJsBIETDC1CoLT0DMG2gIqGoACx7DNS ZCVEG9qgMvHQZG0n4QTM+X6C/y2eBX5+bo1GUXTzRLq+zipFtQB4Ub0JkiS8n85DQ3UI Vbog=="
},
{
"Name": "X-Gm-Message-State",
"Value": "AOAM532AtfkPzRtzg/pDi2pgJupb4kWVaPeUCv/m1zWUETSIukg/v3gr HJO17WVR4Xupop0="
},
{
"Name": "X-Google-Smtp-Source",
"Value": "ABdhPJykymec9GUMAf4Zaz8lfI9Oz5NpB0m6BlC1NDD5LoiZdBzpYwtPAXotrZpg2c+2eCjjPcToDgk="
},
{
"Name": "MIME-Version",
"Value": "1.0"
},
{
"Name": "X-Received",
"Value": "by 2002:a05:620a:22d4:: with SMTP id o20mr4626484qki.151.1602679284199; Wed, 14 Oct 2020 05:41:24 -0700 (PDT)"
},
{
"Name": "Date",
"Value": "Wed, 14 Oct 2020 05:41:24 -0700"
},
{
"Name": "Reply-To",
"Value": "The G Suite Team <gsuite-noreply@google.com>"
},
{
"Name": "X-Google-Id",
"Value": "253939"
},
{
"Name": "Feedback-ID",
"Value": "P-10-0:C20060867:M110136315-en:gamma"
},
{
"Name": "X-Notifications",
"Value": "GAMMA:<35c14aeaf7734b2245ba4e59e605c4a43f99137a-20060867-110354355@google.com>"
},
{
"Name": "Message-ID",
"Value": "<35c14aeaf7734b2245ba4e59e605c4a43f99137a-20060867-110354355@google.com>"
},
{
"Name": "Subject",
"Value": "Your G Suite data transfer was successful for admin admin to newaccount newdemo"
},
{
"Name": "From",
"Value": "The G Suite Team <gsuite-noreply@google.com>"
},
{
"Name": "To",
"Value": "admin@domain.io"
},
{
"Name": "Content-Type",
"Value": "multipart/alternative; boundary=\"0000000000006c713905b1a0d95d\""
}
],
"ID": "175272123add67b3",
"RawData": null,
"Subject": "Your G Suite data transfer was successful for admin admin to newaccount newdemo",
"To": "admin@domain.io"
},
{
"Attachment Names": "",
"Attachments": [],
"BCC": [],
"Body/HTML": "html",
"Body/Text": "Tips for using your new inbox\r\n[image: Gmail]\r\n\r\nWelcome to your inbox\r\n[image: Search]\r\nFind emails fast\r\nWith the power of Google Search in your inbox, you can archive\r\n<https://support.google.com/mail/answer/6576?hl=en&utm_source=gmailwelcomeemail&utm_medium=email&utm_campaign=gmailwelcome>\r\nall your email and find it\r\n<https://support.google.com/mail/answer/6593?hl=en&utm_source=gmailwelcomeemail&utm_medium=email&utm_campaign=gmailwelcome>\r\nlater in a flash. Your inbox stays tidy, and you never need to worry about\r\nwhat to keep.\r\n[image: Personalize]\r\nPersonalize test Data Technologies Mail\r\nCustomize inbox backgrounds, email signatures, and other options in test\r\nData Technologies Mail settings\r\n<https://support.google.com/mail/answer/6562?hl=en&utm_source=gmailwelcomeemail&utm_medium=email&utm_campaign=gmailwelcome>.\r\nReview and adjust your privacy and security settings at My Account\r\n<https://myaccount.google.com/>.\r\n[image: Organize]\r\nOrganize your email\r\nYou can organize email with labels\r\n<https://support.google.com/mail/answer/118708?hl=en&utm_source=gmailwelcomeemail&utm_medium=email&utm_campaign=gmailwelcome>,\r\nwhich are like folders, but you can add more than one label to a message.\r\nYou can also use filters\r\n<https://support.google.com/mail/answer/6579?hl=en&utm_source=gmailwelcomeemail&utm_medium=email&utm_campaign=gmailwelcome>\r\nto automatically sort and categorize messages as they come in.\r\n[image: Social]\r\nChat and meet from your inbox\r\nChat with contacts and start video meetings with up to 25 people in Google\r\nHangouts\r\n<https://support.google.com/hangouts/answer/3115176?hl=en&utm_source=gmailwelcomeemail&utm_medium=email&utm_campaign=gmailwelcome>\r\n.\r\n\r\nGet training and tips\r\nFind Gmail guides, tips, cheat sheets, help switching from Microsoft\u00ae\r\nOutlook\u00ae, and more at the G Suite Learning Center\r\n<https://support.google.com/a/users/answer/9259748?hl=en&utm_source=gmailwelcomeemail&utm_medium=email&utm_campaign=gmailwelcome>\r\n.\r\nVisit the Learning Center\r\n<https://support.google.com/a/users/answer/9259748?hl=en&utm_source=gmailwelcomeemail&utm_medium=email&utm_campaign=gmailwelcome>\r\n\r\nHappy emailing,\r\nThe Gmail Team\r\n[image: Google Cloud]\r\n\r\n\u00a9 2020 Google LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043\r\n\r\n*You\u2019re receiving this mandatory email service announcement to update you\r\nabout important changes to your Google Cloud product or account.*\r\n",
"CC": [],
"Date": "Wed, 28 Oct 2020 09:13:51 -0700",
"Format": "multipart/alternative",
"From": "Gmail Team <mail-noreply@google.com>",
"Headers": [
{
"Name": "MIME-Version",
"Value": "1.0"
},
{
"Name": "x-no-auto-attachment",
"Value": "1"
},
{
"Name": "Received",
"Value": "by 2002:a9a:545:0:b029:96:b451:56b4; Wed, 28 Oct 2020 09:13:51 -0700 (PDT)"
},
{
"Name": "Date",
"Value": "Wed, 28 Oct 2020 09:13:51 -0700"
},
{
"Name": "Message-ID",
"Value": "<CAJ0=S95fT_hUQ5MMTB9GmQBaT7AqzGTyjwpdmLu5=REM5-F+_g@mail.gmail.com>"
},
{
"Name": "Subject",
"Value": "Tips for using your new inbox"
},
{
"Name": "From",
"Value": "Gmail Team <mail-noreply@google.com>"
},
{
"Name": "To",
"Value": "abcd12 a <azsa@domain.io>"
},
{
"Name": "Content-Type",
"Value": "multipart/alternative; boundary=\"0000000000000515ee05b2bd73a9\""
}
],
"ID": "1756ffcad693a98f",
"RawData": null,
"Subject": "Tips for using your new inbox",
"To": "abcd12 a <azsa@domain.io>"
},
{
"Attachment Names": "",
"Attachments": [],
"BCC": [],
"Body/HTML": "<div>\r\n <meta http-equiv=Content-Type content=\"text/html; charset=utf-8\">\r\n <meta name=viewport content=width=device-width>\r\n <style>@media only screen{html{min-height:100%;background:#fafafa}}@media only screen and (max-width:640px){.small-float-center{margin:0 auto!important;float:none!important;text-align:center!important}}@media only screen and (max-width:640px){table.body img{width:auto;height:auto}table.body center{min-width:0!important}table.body .container{width:344px!important}table.body .columns{height:auto!important;-moz-box-sizing:border-box;-webkit-box-sizing:border-box;box-sizing:border-box;padding-left:40px!important;padding-right:40px!important}table.body .columns .columns{padding-left:0!important;padding-right:0!important}table.body .collapse .columns{padding-left:0!important;padding-right:0!important}th.small-1{display:inline-block!important;width:8.33333%!important}th.small-3{display:inline-block!important;width:25%!important}th.small-4{display:inline-block!important;width:33.33333%!important}th.small-6{display:inline-block!important;width:50%!important}th.small-8{display:inline-block!important;width:66.66667%!important}th.small-9{display:inline-block!important;width:75%!important}th.small-12{display:inline-block!important;width:100%!important}.columns th.small-12{display:block!important;width:100%!important}table.menu{width:100%!important}table.menu td,table.menu th{width:auto!important;display:inline-block!important}table.menu.vertical td,table.menu.vertical th{display:block!important}table.menu[align=center]{width:auto!important}}</style>\r\n <span class=preheader style=color:#fafafa;display:none!important;font-size:1px;line-height:1px;max-height:0;max-width:0;mso-hide:all!important;opacity:0;overflow:hidden;visibility:hidden></span>\r\n <table class=body style=Margin:0;background:#F8F9FA!important;border-collapse:collapse;border-spacing:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;height:100%;line-height:inherit;margin:0;padding:0;vertical-align:top;width:100%;text-align:left>\r\n <tr style=padding:0;vertical-align:top>\r\n <td class=center align=center valign=top style=-moz-hyphens:none;-webkit-hyphens:none;Margin:0;border-collapse:collapse!important;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;hyphens:none;line-height:inherit;margin:0;padding:0;vertical-align:top;word-wrap:keep-all>\r\n <center data-parsed=\"\" style=min-width:600px;width:100%>\r\n\r\n <table align=center class=\"container float-center\" style=\"Margin:0 auto;background:#fafafa;border-collapse:collapse;border-spacing:0;float:none;margin:0 auto;padding:0;text-align:left;vertical-align:top;width:600px\"><tbody><tr style=padding:0;vertical-align:top><td style=-moz-hyphens:none;-webkit-hyphens:none;Margin:0;border-collapse:collapse!important;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;hyphens:none;line-height:inherit;margin:0;padding:0;vertical-align:top;word-wrap:keep-all>\r\n <table class=\"row header\" style=background:#F8F9FA;border-collapse:collapse;border-spacing:0;display:table;font-size:12px;padding:0;position:relative;vertical-align:top;width:100%><tbody><tr style=padding:0;vertical-align:top>\r\n <th class=\"small-12 large-12 columns first last\" style=\"Margin:0 auto;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0 auto;padding:0;padding-bottom:24px;padding-left:40px;padding-right:40px;padding-top:12px;width:560px\"><table style=border-collapse:collapse;border-spacing:0;margin-bottom:0;padding:0;vertical-align:top;width:100%><tr style=padding:0;vertical-align:top><th style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0;text-align:left>\r\n\r\n <img src=https://storage.googleapis.com/support-kms-prod/BfxWlTCe6OCizPoUdUCwDz979TQRdnVdSMCG alt=\"G Suite\" height=30 style=-ms-interpolation-mode:bicubic;clear:both;display:block;margin-top:24px;max-height:30px;max-width:100%;outline:0;text-decoration:none;width:auto>\r\n\r\n </th>\r\n<th class=expander style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0!important;visibility:hidden;width:0></th></tr></table></th>\r\n </tr></tbody></table>\r\n\r\n <table class=\"row info\" style=align-items:center;background:#fff;border-collapse:collapse;border-color:#E8EAED;border-spacing:0;border-style:solid;border-width:1px;display:table;padding:0;position:relative;vertical-align:top;width:100%><tbody><tr style=padding:0;vertical-align:top>\r\n <th class=\"small-12 large-12 columns first last\" style=\"Margin:0 auto;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0 auto;padding:0;padding-bottom:0;padding-left:40px;padding-right:40px;width:560px\"><table style=border-collapse:collapse;border-spacing:0;padding:0;vertical-align:top;width:100%><tr style=padding:0;vertical-align:top><th style=\"Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0 0 24px;text-align:left\">\r\n <p style=Margin:0;Margin-bottom:16px;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:24px;margin:0;margin-bottom:16px;margin-top:24px;padding:0>Hello Admin,</p>\r\n\r\n<p style=Margin:0;Margin-bottom:16px;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:24px;margin:0;margin-bottom:16px;padding:0>G Suite recently processed a request from user test (user@domain.io) to transfer data for newaccount newdemo (demo@domain.io) to drive activity (driveactivity@domain.io).</p>\r\n\r\n<p style=Margin:0;Margin-bottom:16px;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:24px;margin:0;margin-bottom:16px;padding:0>The data transfer was successful.</p>\r\n\r\n<p style=\"margin-top:8px;color:#3C4043;font-family:Google Sans,Helvetica,Arial,sans-serif;font-size:14px;font-weight:700;line-height:24px;margin:0;margin-bottom:0px;padding:0\">Sincerely,</p>\r\n\r\n<p style=\"Margin:0;color:#3C4043;font-family:Google Sans,Helvetica,Arial,sans-serif;font-size:14px;font-weight:700;line-height:24px;margin:0;margin-bottom:0;padding:0\">The G Suite Team</p>\r\n </th></tr></table></th>\r\n </tr></tbody></table>\r\n\r\n <table class=\"row footer\" style=background:#F8F9FA;border-collapse:collapse;border-spacing:0;display:table;margin-top:0;padding:0;position:relative;vertical-align:top;width:100%><tbody><tr style=padding:0;vertical-align:top>\r\n <th class=\"small-12 large-12 columns first last\" style=\"Margin:0 auto;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0 auto;padding:0;padding-bottom:0;padding-left:40px;padding-right:40px;width:560px\"><table style=border-collapse:collapse;border-spacing:0;padding:0;vertical-align:top;width:100%><tr style=padding:0;vertical-align:top><th style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:24px;text-align:left>\r\n\r\n <img src=https://storage.googleapis.com/support-kms-prod/Yd1rPlunjtOKzNDXcw3eFmVCjI828xhBZqQy alt=\"Google Cloud\" height=30 style=-ms-interpolation-mode:bicubic;clear:both;display:block;margin-bottom:14px;max-width:100%;max-height:30px;outline:0;text-decoration:none;width:auto>\r\n <p style=Margin:0;Margin-bottom:16px;color:#6C737F;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:12px;font-weight:400;line-height:16px;margin:0;margin-bottom:14px;padding:0>\r\n \u00a9 2020 Google LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043\r\n </p>\r\n <p style=Margin:0;Margin-bottom:16px;color:#6C737F;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:12px;font-weight:400;line-height:16px;margin:0;margin-bottom:14px;padding:0>\r\n <em>You\u2019re receiving this mandatory email service announcement to update you about important changes to your Google Cloud product or account.</em>\r\n </p>\r\n </th>\r\n<th class=expander style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0!important;visibility:hidden;width:0></th></tr></table></th>\r\n </tr></tbody></table>\r\n </td></tr></tbody></table>\r\n\r\n </center>\r\n </td>\r\n </tr>\r\n </table>\r\n <!-- prevent Gmail on iOS font size manipulation -->\r\n <div style=\"display:none;white-space:nowrap;font:15px courier;line-height:0\"> </div>\r\n \r\n</div>\r\n",
"Body/Text": "From: \"The G Suite Team\" [gsuite-noreply@google.com]\r\nSubject: Your G Suite data transfer was successful for newaccount newdemo \r\nto drive activity\r\n\r\nHello Admin,\r\n\r\nG\u00a0Suite recently processed a request from user test \r\n(user@domain.io) to transfer data for newaccount newdemo \r\n(demo@domain.io) to drive activity (driveactivity@domain.io).\r\n\r\nThe data transfer was successful.\r\n\r\nSincerely,\r\n\r\nThe G\u00a0Suite Team\r\n\r\n\r\n[Google Cloud]\r\n\r\n(c) 2020 Google LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043 * \r\nGoogle Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland * Google \r\nAsia Pacific Pte. Ltd., 8 Marina View, #30-01, Asia Square 1, Singapore \r\n018960\r\n\r\nYou're receiving this mandatory email service announcement to update you \r\nabout important changes to your Google Cloud product or account.\r\n",
"CC": [],
"Date": "Thu, 15 Oct 2020 01:38:22 -0700",
"Format": "multipart/alternative",
"From": "The G Suite Team <gsuite-noreply@google.com>",
"Headers": [
{
"Name": "Delivered-To",
"Value": "demo@domain.io"
},
{
"Name": "Received",
"Value": "by 2002:a50:af21:0:0:0:0:0 with SMTP id g30csp212233edd; Thu, 15 Oct 2020 01:38:23 -0700 (PDT)"
},
{
"Name": "X-Received",
"Value": "by 2002:a6b:8dca:: with SMTP id p193mr2390539iod.77.1602751103584; Thu, 15 Oct 2020 01:38:23 -0700 (PDT)"
},
{
"Name": "ARC-Seal",
"Value": "i=1; a=rsa-sha256; t=1602751103; cv=none; d=google.com; s=arc-20160816; b=aBcIUB9Cpn0j7zKAvs9iT9OreqI9h4NpnQtb0QOfYPUV2ELm/TzFaITNIpxrCuNmaL H1Azc1/FIH7jAw93MB0ppnzud+WAYpDHJ/1dfdgkXVxocKsicWD5s658TMqZKZNewkpG puR4GIt/xQULVvmMgjuRnbVPdXm4Xch8JTZJz7lnni5CRUyIqLXcvlF0uVtwwr4ajgAB FbjeIwlgsNttMyPyP90EVWG1dbbo4z4MRMjEJ42lve+YZ0cmtRaM7rkLaJ2Z2Mml6Ui3 8yapFa2VME7s9qdtO3lgfdw5/U/1Yw5X8cjdYmtQrRbHfu9MLsRDdM9ugb07gBcu0cVK /yRQ=="
},
{
"Name": "ARC-Message-Signature",
"Value": "i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=to:from:subject:message-id:feedback-id:reply-to:date:mime-version :userim-signature; bh=Y3ZqZNVJw6xMlulEe1vZahBH7+HTnDug5V6Hzf3Un8A=; b=y0QuwIKW9pmokqDGOLWQPsiyq57ek3ZRQlDIRT1/rIS3aBzRHov7LujIYD/PuGRhBL H3J3PUEAdm2zuBTSHYulAm1rxa06vJO+w/WLP1KmzlYvAU5s0WdhiVedBTbBhUyRTMAM 1C8c+Yqhs6quII/mtLB4u7iFyAatEAsM/4W6SCS7wteJvGN3kvNio/d1auser8RK4Kqd6r FlZQU6tFn79W7vm++tvLjy+owZWN6akpEUHBqPir17Rgciw7bKDZkfpjD7MgjhcP3t9X 0ISf7wPgvtE6BXkmdWuuCuHNmmrH7IoS7rrPSr0CylXcGp2IrLZbdZ78LVRpNRBarrRz FW5g=="
},
{
"Name": "ARC-Authentication-Results",
"Value": "i=1; mx.google.com; userim=pass header.i=@google.com header.s=20161025 header.b=bvX9MVYr; spf=pass (google.com: domain of 3fgqixw4kblubnpdoz-ijmzkgtbjjbgz.xjhyzhjidhwgzyvov.dj@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) smtp.mailfrom=3fgqIXw4KBLUbnpdoZ-ijmZkgtbjjbgZ.XjhYZhjidhWgZYVoV.dj@scoutcamp.bounces.google.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com"
},
{
"Name": "Return-Path",
"Value": "<3fgqIXw4KBLUbnpdoZ-ijmZkgtbjjbgZ.XjhYZhjidhWgZYVoV.dj@scoutcamp.bounces.google.com>"
},
{
"Name": "Received",
"Value": "from mail-sor-f69.google.com (mail-sor-f69.google.com. [209.85.220.69]) by mx.google.com with SMTPS id t89sor861231ili.126.2020.10.15.01.38.23 for <demo@domain.io> (Google Transport Security); Thu, 15 Oct 2020 01:38:23 -0700 (PDT)"
},
{
"Name": "Received-SPF",
"Value": "pass (google.com: domain of 3fgqixw4kblubnpdoz-ijmzkgtbjjbgz.xjhyzhjidhwgzyvov.dj@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) client-ip=209.85.220.69;"
},
{
"Name": "Authentication-Results",
"Value": "mx.google.com; userim=pass header.i=@google.com header.s=20161025 header.b=bvX9MVYr; spf=pass (google.com: domain of 3fgqixw4kblubnpdoz-ijmzkgtbjjbgz.xjhyzhjidhwgzyvov.dj@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) smtp.mailfrom=3fgqIXw4KBLUbnpdoZ-ijmZkgtbjjbgZ.XjhYZhjidhWgZYVoV.dj@scoutcamp.bounces.google.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com"
},
{
"Name": "userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:date:reply-to:feedback-id:message-id:subject:from:to; bh=Y3ZqZNVJw6xMlulEe1vZahBH7+HTnDug5V6Hzf3Un8A=; b=bvX9MVYrvwnJk04PzWZj20B+wYkKaUd5Q8mpVmtGr7kEpvOpt3Gs9CQcNB2zGUnGHH tNQoxgQm94IaphqEDEPV34JJAzGlpjLrqKHvBk7NkezW6f4plhsNZmPWnSnlsUuserar/s K4P8Vj+iWg49RnvC4KwDFIaI24Va2tChqSWE8Ecuserkf3qO20vkgXJfa9cVXhNZ3O8eim Ge/sFZ+XIGahtWoLnc/fQOTakLhTXHZB96WR4FBwms3uOTc9qgmJ4a4NdredahChQ8WA HAhjSxypEHCrDQn6obVvy8TASOwGu20zcQHwgslLr2yazr7aa95TyQIRIblRqWwzliOC WBAA=="
},
{
"Name": "X-Google-userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:date:reply-to:feedback-id :message-id:subject:from:to; bh=Y3ZqZNVJw6xMlulEe1vZahBH7+HTnDug5V6Hzf3Un8A=; b=Ra2XnSNMfL9rDPuLIK+eVqqIIOC0otWhWkSjxlzcmvx0HVmxEiHBHY+KnGf1Pi8EeT HR1thqs6cH73pk0EMPAFYb2+ADGJylDIbDjB1BkGvkCv9D+i4M3KkhuY5RI0Zz0cXjNA BZQF1072viGbMdIyop/hyFEglSd+oETW7fh0yyxP+pEUuserfA8StGZM5hnz2TZvj5kXzG YnjGKVgmTnHLLUzO0eXQrk5XtHBmUIzN1LCrWJc7zFgcoTjhufGupPwS7iPH37+rU5Id /m4UzisYx+8urGX4lP7ed40pFqugd/y2yQANH4cRRAY2jiJ/VvlYgdWSP/3JoiZViAk2 7/ZA=="
},
{
"Name": "X-Gm-Message-State",
"Value": "AOAM533jANXzvnHIQ6tH1XkZkXnsZGt9jhleBSRuserliLX6F8AbE79QaQ wnGOaZoHqpRBcrM="
},
{
"Name": "X-Google-Smtp-Source",
"Value": "ABdhPJzUjUWVMRywt1ccaYOMB6c2Kx1SPcFhHgIQeC/uTGpmpCTUKYc51oVIvecDl2EkTnS/cMcxvxU="
},
{
"Name": "MIME-Version",
"Value": "1.0"
},
{
"Name": "X-Received",
"Value": "by 2002:a05:6e02:13e8:: with SMTP id w8mr2392088ilj.139.1602751102957; Thu, 15 Oct 2020 01:38:22 -0700 (PDT)"
},
{
"Name": "Date",
"Value": "Thu, 15 Oct 2020 01:38:22 -0700"
},
{
"Name": "Reply-To",
"Value": "The G Suite Team <gsuite-noreply@google.com>"
},
{
"Name": "X-Google-Id",
"Value": "253939"
},
{
"Name": "Feedback-ID",
"Value": "P-10-0:C20060867:M110136315-en:gamma"
},
{
"Name": "X-Notifications",
"Value": "GAMMA:<8f3624478fcd3ee213c843e47693b42d32d9427c-20060867-110354355@google.com>"
},
{
"Name": "Message-ID",
"Value": "<8f3624478fcd3ee213c843e47693b42d32d9427c-20060867-110354355@google.com>"
},
{
"Name": "Subject",
"Value": "Your G Suite data transfer was successful for newaccount newdemo to drive activity"
},
{
"Name": "From",
"Value": "The G Suite Team <gsuite-noreply@google.com>"
},
{
"Name": "To",
"Value": "demo@domain.io"
},
{
"Name": "Content-Type",
"Value": "multipart/alternative; boundary=\"00000000000027ba2005b1b192f5\""
}
],
"ID": "1752b6902315fba8",
"RawData": null,
"Subject": "Your G Suite data transfer was successful for newaccount newdemo to drive activity",
"To": "demo@domain.io"
},
{
"Attachments": {
"entryID": ""
},
"BCC": [],
"Body/HTML": null,
"Body/Text": "\r\n",
"CC": [],
"Date": "Tue, 27 Oct 2020 21:58:33 -0700",
"Format": "text/plain",
"From": "user1 test1 <user@domain.io>",
"Headers": [
{
"Name": "To",
"Value": "3d_qYXxAPBdI0CAA2BHG-BCF2D9M1C0G.4CC492.0CA12Jy9B6Az921yHy.6C@docos.bounces.google.com"
},
{
"Name": "From",
"Value": "user1 test1 <user@domain.io>"
},
{
"Name": "Date",
"Value": "Tue, 27 Oct 2020 21:58:33 -0700"
},
{
"Name": "Message-ID",
"Value": "<CAKWG9FmfrWB2fqMySvy-ffjxPBAE81E_zJ2JV1G87ztq4j_Ojg@mail.gmail.com>"
},
{
"Name": "Subject",
"Value": "hello Re: Untitled document - @user@domain.io @user@domain..."
},
{
"Name": "MIME-Version",
"Value": "1.0"
},
{
"Name": "Content-Type",
"Value": "text/plain; charset=UTF-8"
},
{
"Name": "Content-Transfer-Encoding",
"Value": "7bit"
},
{
"Name": "Content-Disposition",
"Value": "inline"
},
{
"Name": "Precedence",
"Value": "bulk"
},
{
"Name": "X-Autoreply",
"Value": "yes"
},
{
"Name": "Auto-Submitted",
"Value": "auto-replied"
}
],
"ID": "1756d926adcca849",
"RawData": null,
"Subject": "hello Re: Untitled document - @user@domain.io @user@domain...",
"To": "3d_qYXxAPBdI0CAA2BHG-BCF2D9M1C0G.4CC492.0CA12Jy9B6Az921yHy.6C@docos.bounces.google.com"
},
{
"Attachment Names": "",
"Attachments": [],
"BCC": [],
"Body/HTML": "html",
"Body/Text": "Get the official Gmail app\r\n[image: Gmail]\r\n\r\nGet the official Gmail app\r\nThe best features of test Data Technologies Mail are only available on\r\nyour phone and tablet with the official Gmail app. Download the app or go\r\nto gmail.com on your computer or mobile device to get started.\r\n\r\n[image: Get it on Google Play]\r\n<https://play.google.com/store/apps/details?id=com.google.android.gm&hl=en>\r\n[image:\r\nApple App Store]\r\n<https://apps.apple.com/app/gmail-email-by-google/id422689480?l=en>\r\n\r\nHappy emailing,\r\nThe Gmail Team\r\n[image: Google Cloud]\r\n\r\n\u00a9 2020 Google LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043\r\n\r\n*You\u2019re receiving this mandatory email service announcement to update you\r\nabout important changes to your Google Cloud product or account.*\r\n",
"CC": [],
"Date": "Fri, 23 Oct 2020 03:38:26 -0700",
"Format": "multipart/alternative",
"From": "Gmail Team <mail-noreply@google.com>",
"Headers": [
{
"Name": "MIME-Version",
"Value": "1.0"
},
{
"Name": "x-no-auto-attachment",
"Value": "1"
},
{
"Name": "Received",
"Value": "by 2002:a5d:9390:0:0:0:0:0; Fri, 23 Oct 2020 03:38:26 -0700 (PDT)"
},
{
"Name": "Date",
"Value": "Fri, 23 Oct 2020 03:38:26 -0700"
},
{
"Name": "Message-ID",
"Value": "<CAP6sO1io-ROJjeUsh-EPQmnJO79-Us6Byd15jwBnOO8uKqZDiA@mail.gmail.com>"
},
{
"Name": "Subject",
"Value": "Get the official Gmail app"
},
{
"Name": "From",
"Value": "Gmail Team <mail-noreply@google.com>"
},
{
"Name": "To",
"Value": "user user <user@domain.io>"
},
{
"Name": "Content-Type",
"Value": "multipart/alternative; boundary=\"000000000000395d8f05b2542e2c\""
}
],
"ID": "1755509c8f043a8a",
"RawData": null,
"Subject": "Get the official Gmail app",
"To": "user user <user@domain.io>"
},
{
"Attachment Names": "",
"Attachments": [],
"BCC": [],
"Body/HTML": "<div>\r\n <meta http-equiv=Content-Type content=\"text/html; charset=utf-8\">\r\n <meta name=viewport content=width=device-width>\r\n <style>@media only screen{html{min-height:100%;background:#fafafa}}@media only screen and (max-width:640px){.small-float-center{margin:0 auto!important;float:none!important;text-align:center!important}}@media only screen and (max-width:640px){table.body img{width:auto;height:auto}table.body center{min-width:0!important}table.body .container{width:344px!important}table.body .columns{height:auto!important;-moz-box-sizing:border-box;-webkit-box-sizing:border-box;box-sizing:border-box;padding-left:40px!important;padding-right:40px!important}table.body .columns .columns{padding-left:0!important;padding-right:0!important}table.body .collapse .columns{padding-left:0!important;padding-right:0!important}th.small-1{display:inline-block!important;width:8.33333%!important}th.small-3{display:inline-block!important;width:25%!important}th.small-4{display:inline-block!important;width:33.33333%!important}th.small-6{display:inline-block!important;width:50%!important}th.small-8{display:inline-block!important;width:66.66667%!important}th.small-9{display:inline-block!important;width:75%!important}th.small-12{display:inline-block!important;width:100%!important}.columns th.small-12{display:block!important;width:100%!important}table.menu{width:100%!important}table.menu td,table.menu th{width:auto!important;display:inline-block!important}table.menu.vertical td,table.menu.vertical th{display:block!important}table.menu[align=center]{width:auto!important}}</style>\r\n <span class=preheader style=color:#fafafa;display:none!important;font-size:1px;line-height:1px;max-height:0;max-width:0;mso-hide:all!important;opacity:0;overflow:hidden;visibility:hidden></span>\r\n <table class=body style=Margin:0;background:#F8F9FA!important;border-collapse:collapse;border-spacing:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;height:100%;line-height:inherit;margin:0;padding:0;vertical-align:top;width:100%;text-align:left>\r\n <tr style=padding:0;vertical-align:top>\r\n <td class=center align=center valign=top style=-moz-hyphens:none;-webkit-hyphens:none;Margin:0;border-collapse:collapse!important;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;hyphens:none;line-height:inherit;margin:0;padding:0;vertical-align:top;word-wrap:keep-all>\r\n <center data-parsed=\"\" style=min-width:600px;width:100%>\r\n\r\n <table align=center class=\"container float-center\" style=\"Margin:0 auto;background:#fafafa;border-collapse:collapse;border-spacing:0;float:none;margin:0 auto;padding:0;text-align:left;vertical-align:top;width:600px\"><tbody><tr style=padding:0;vertical-align:top><td style=-moz-hyphens:none;-webkit-hyphens:none;Margin:0;border-collapse:collapse!important;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;hyphens:none;line-height:inherit;margin:0;padding:0;vertical-align:top;word-wrap:keep-all>\r\n <table class=\"row header\" style=background:#F8F9FA;border-collapse:collapse;border-spacing:0;display:table;font-size:12px;padding:0;position:relative;vertical-align:top;width:100%><tbody><tr style=padding:0;vertical-align:top>\r\n <th class=\"small-12 large-12 columns first last\" style=\"Margin:0 auto;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0 auto;padding:0;padding-bottom:24px;padding-left:40px;padding-right:40px;padding-top:12px;width:560px\"><table style=border-collapse:collapse;border-spacing:0;margin-bottom:0;padding:0;vertical-align:top;width:100%><tr style=padding:0;vertical-align:top><th style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0;text-align:left>\r\n\r\n <img src=https://storage.googleapis.com/support-kms-prod/BfxWlTCe6OCizPoUdUCwDz979TQRdnVdSMCG alt=\"G Suite\" height=30 style=-ms-interpolation-mode:bicubic;clear:both;display:block;margin-top:24px;max-height:30px;max-width:100%;outline:0;text-decoration:none;width:auto>\r\n\r\n </th>\r\n<th class=expander style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0!important;visibility:hidden;width:0></th></tr></table></th>\r\n </tr></tbody></table>\r\n\r\n <table class=\"row info\" style=align-items:center;background:#fff;border-collapse:collapse;border-color:#E8EAED;border-spacing:0;border-style:solid;border-width:1px;display:table;padding:0;position:relative;vertical-align:top;width:100%><tbody><tr style=padding:0;vertical-align:top>\r\n <th class=\"small-12 large-12 columns first last\" style=\"Margin:0 auto;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0 auto;padding:0;padding-bottom:0;padding-left:40px;padding-right:40px;width:560px\"><table style=border-collapse:collapse;border-spacing:0;padding:0;vertical-align:top;width:100%><tr style=padding:0;vertical-align:top><th style=\"Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0 0 24px;text-align:left\">\r\n <p style=Margin:0;Margin-bottom:16px;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:24px;margin:0;margin-bottom:16px;margin-top:24px;padding:0>Hello Admin,</p>\r\n\r\n<p style=Margin:0;Margin-bottom:16px;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:24px;margin:0;margin-bottom:16px;padding:0>G Suite recently processed a request from user test (user@domain.io) to transfer data for newaccount newdemo (demo@domain.io) to drive activity (driveactivity@domain.io).</p>\r\n\r\n<p style=Margin:0;Margin-bottom:16px;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:24px;margin:0;margin-bottom:16px;padding:0>The data transfer was successful.</p>\r\n\r\n<p style=\"margin-top:8px;color:#3C4043;font-family:Google Sans,Helvetica,Arial,sans-serif;font-size:14px;font-weight:700;line-height:24px;margin:0;margin-bottom:0px;padding:0\">Sincerely,</p>\r\n\r\n<p style=\"Margin:0;color:#3C4043;font-family:Google Sans,Helvetica,Arial,sans-serif;font-size:14px;font-weight:700;line-height:24px;margin:0;margin-bottom:0;padding:0\">The G Suite Team</p>\r\n </th></tr></table></th>\r\n </tr></tbody></table>\r\n\r\n <table class=\"row footer\" style=background:#F8F9FA;border-collapse:collapse;border-spacing:0;display:table;margin-top:0;padding:0;position:relative;vertical-align:top;width:100%><tbody><tr style=padding:0;vertical-align:top>\r\n <th class=\"small-12 large-12 columns first last\" style=\"Margin:0 auto;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0 auto;padding:0;padding-bottom:0;padding-left:40px;padding-right:40px;width:560px\"><table style=border-collapse:collapse;border-spacing:0;padding:0;vertical-align:top;width:100%><tr style=padding:0;vertical-align:top><th style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:24px;text-align:left>\r\n\r\n <img src=https://storage.googleapis.com/support-kms-prod/Yd1rPlunjtOKzNDXcw3eFmVCjI828xhBZqQy alt=\"Google Cloud\" height=30 style=-ms-interpolation-mode:bicubic;clear:both;display:block;margin-bottom:14px;max-width:100%;max-height:30px;outline:0;text-decoration:none;width:auto>\r\n <p style=Margin:0;Margin-bottom:16px;color:#6C737F;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:12px;font-weight:400;line-height:16px;margin:0;margin-bottom:14px;padding:0>\r\n \u00a9 2020 Google LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043\r\n </p>\r\n <p style=Margin:0;Margin-bottom:16px;color:#6C737F;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:12px;font-weight:400;line-height:16px;margin:0;margin-bottom:14px;padding:0>\r\n <em>You\u2019re receiving this mandatory email service announcement to update you about important changes to your Google Cloud product or account.</em>\r\n </p>\r\n </th>\r\n<th class=expander style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0!important;visibility:hidden;width:0></th></tr></table></th>\r\n </tr></tbody></table>\r\n </td></tr></tbody></table>\r\n\r\n </center>\r\n </td>\r\n </tr>\r\n </table>\r\n <!-- prevent Gmail on iOS font size manipulation -->\r\n <div style=\"display:none;white-space:nowrap;font:15px courier;line-height:0\"> </div>\r\n \r\n</div>\r\n",
"Body/Text": "From: \"The G Suite Team\" [gsuite-noreply@google.com]\r\nSubject: Your G Suite data transfer was successful for newaccount newdemo \r\nto drive activity\r\n\r\nHello Admin,\r\n\r\nG\u00a0Suite recently processed a request from user test \r\n(user@domain.io) to transfer data for newaccount newdemo \r\n(demo@domain.io) to drive activity (driveactivity@domain.io).\r\n\r\nThe data transfer was successful.\r\n\r\nSincerely,\r\n\r\nThe G\u00a0Suite Team\r\n\r\n\r\n[Google Cloud]\r\n\r\n(c) 2020 Google LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043 * \r\nGoogle Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland * Google \r\nAsia Pacific Pte. Ltd., 8 Marina View, #30-01, Asia Square 1, Singapore \r\n018960\r\n\r\nYou're receiving this mandatory email service announcement to update you \r\nabout important changes to your Google Cloud product or account.\r\n",
"CC": [],
"Date": "Thu, 15 Oct 2020 01:38:21 -0700",
"Format": "multipart/alternative",
"From": "The G Suite Team <gsuite-noreply@google.com>",
"Headers": [
{
"Name": "Delivered-To",
"Value": "driveactivity@domain.io"
},
{
"Name": "Received",
"Value": "by 2002:a1c:b38b:0:0:0:0:0 with SMTP id c133csp280423wmf; Thu, 15 Oct 2020 01:38:22 -0700 (PDT)"
},
{
"Name": "X-Received",
"Value": "by 2002:a6b:920b:: with SMTP id u11mr2323170iod.191.1602751102479; Thu, 15 Oct 2020 01:38:22 -0700 (PDT)"
},
{
"Name": "ARC-Seal",
"Value": "i=1; a=rsa-sha256; t=1602751102; cv=none; d=google.com; s=arc-20160816; b=BdG38MgajamZ8OYbq1Ozx7ZoPFfSiRaUxMC8Tkdixjh1V1HDtTwlU0qzQZBCOYqUNP DNTMS7ILJR9NxWxHfcTueUgiA15WjCUcXoBUbXJHJ6sN01isQ35juserFB8NneV21Kkffd u6Jl2FjHQnzPfJHUIQ3uCW+a8M8xk5wXFPN6Ny+wbvvBy1qAo3xdJCJi1NEXfF4aD2Wy P7sFpcDNAbboRtTGzB7Pf2FeGPXDB9tj+jo3RNDY1HJPxExKG2O7HjeOCkf7ofh/6bqA wMJzaLWaakjTw61rzUnh+vvI/GO/Di2C4vDt6gzfbqBRrN5NF5zsk17FtG1qEzrtfD9w TJVw=="
},
{
"Name": "ARC-Message-Signature",
"Value": "i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=to:from:subject:message-id:feedback-id:reply-to:date:mime-version :userim-signature; bh=hSvG69KscN/bxqwCM0EsKSB8EWCl5yNraTSDzP3sgKg=; b=FLZntKs7DsOG7pOQIgkeyCDHZCjjGQnzXeX3qoMFZIubDGZYSHyqqF3iXWxSdB1mxD D8nSSsRhPfG/RVeStdnxmZK/8hMaWo2L2ytI/2UsoV4iMdt/VOzdhmJeSXI0zbKofmBB kkAqgCDzgeF4egzoLR8APulsn+wInOVRiP/GjpXMq2bEo1hN981thCndyzC6ztNiN8KT CXJU3faPzrcgS8MrcNSGUcrTx43t1XNyTvAgh+kwWuserHD0nFKXV3Fga/4u7pYoSingmL Fv5SUZqbod/8at6DNrgp6aCGG7CPKMC8xKTlpe6zC+e6As6gwdg2svV4FJHHorQEn96Z kHgg=="
},
{
"Name": "ARC-Authentication-Results",
"Value": "i=1; mx.google.com; userim=pass header.i=@google.com header.s=20161025 header.b=rw78gql3; spf=pass (google.com: domain of 3fqqixw4kdbqamocny-hilyjfsaiiafy.wigxlcpyuwncpcnshcgvfyxunu.ci@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) smtp.mailfrom=3fQqIXw4KDbQamocnY-hilYjfsaiiafY.WigXlcpYUWncpcnshcgVfYXUnU.ci@scoutcamp.bounces.google.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com"
},
{
"Name": "Return-Path",
"Value": "<3fQqIXw4KDbQamocnY-hilYjfsaiiafY.WigXlcpYUWncpcnshcgVfYXUnU.ci@scoutcamp.bounces.google.com>"
},
{
"Name": "Received",
"Value": "from mail-sor-f69.google.com (mail-sor-f69.google.com. [209.85.220.69]) by mx.google.com with SMTPS id f12sor896603ilq.7.2020.10.15.01.38.22 for <driveactivity@domain.io> (Google Transport Security); Thu, 15 Oct 2020 01:38:22 -0700 (PDT)"
},
{
"Name": "Received-SPF",
"Value": "pass (google.com: domain of 3fqqixw4kdbqamocny-hilyjfsaiiafy.wigxlcpyuwncpcnshcgvfyxunu.ci@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) client-ip=209.85.220.69;"
},
{
"Name": "Authentication-Results",
"Value": "mx.google.com; userim=pass header.i=@google.com header.s=20161025 header.b=rw78gql3; spf=pass (google.com: domain of 3fqqixw4kdbqamocny-hilyjfsaiiafy.wigxlcpyuwncpcnshcgvfyxunu.ci@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) smtp.mailfrom=3fQqIXw4KDbQamocnY-hilYjfsaiiafY.WigXlcpYUWncpcnshcgVfYXUnU.ci@scoutcamp.bounces.google.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com"
},
{
"Name": "userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:date:reply-to:feedback-id:message-id:subject:from:to; bh=hSvG69KscN/bxqwCM0EsKSB8EWCl5yNraTSDzP3sgKg=; b=rw78gql31QvtrEUrSV7dGSuxdLbOHrG+eOBxBXfRQwXfHWzRxqf1s9qL8cysve2lol DwS5lNA7gX1ZwQLie5nRSJjmqFmfENDs/yv6Lqp9dh+lYs92N0ZYI3Xs5ZjdVn7JQe23 86S0/5lHS4GKjwCAJghS2B1eUXHdC5ZcQbB63/lpIsCQCbEH8Xuz6Qnen4S5jIxCUrJJ PQiO21Kwgfh8w8rqugqU4RJ1bdfinLdboubOQ8l1WICkgl/1AlPZSo6Uu6iDMwFuD8gb FRRNX3b4T+VG+M69pbpkeiJRmV8uzxyUqU03rC8T0yod6fZs/kISgQfw5YVGCcZAsyLG VWIw=="
},
{
"Name": "X-Google-userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:date:reply-to:feedback-id :message-id:subject:from:to; bh=hSvG69KscN/bxqwCM0EsKSB8EWCl5yNraTSDzP3sgKg=; b=PzDIgL0/tTttvAAiHVb7+3yCjKdj9KJGXMGCmdFkJP6hnKkWrYmyg4WnbPwjyKfscA UL+83pwGwcUar+9rHVwMTUyKCSudG1DrKX60uJhIo0+n4xASW0znzI7NNC05JDTaHZIZ Ar6PghlhVmhqfRjJY2MrFVQZXnNDmPDaS8QUT3mtcpaIpLRa/Z3cY0oxJIrOISd7VLDy KavhsI3CX4s++6/0XV2JiT3fB9nYgW7lG6Lw1g4UI3vCjIlG4CMmI30ByztQI8NXT1So x+hMHsaiQUmzIytQ25GPD+xCeo0Lp4pZ5etbZ4QydCeBzusergNWm+nxhKCs8crFWFca3v ztRg=="
},
{
"Name": "X-Gm-Message-State",
"Value": "AOAM5323IhsjRQxG2DjbZd1oQ0+Fx5me5rHz+N0b3IygMusD1p4LK2vo 2wCaSIiiRj3TSPI="
},
{
"Name": "X-Google-Smtp-Source",
"Value": "ABdhPJxt2cjGasXedys/7YIhFDpikc1Oe7q7pymfmO1FnrlAQzcGBOvRCscez5u8vFOhQmscY71F4S4="
},
{
"Name": "MIME-Version",
"Value": "1.0"
},
{
"Name": "X-Received",
"Value": "by 2002:a92:da0e:: with SMTP id z14mr2271398ilm.151.1602751101999; Thu, 15 Oct 2020 01:38:21 -0700 (PDT)"
},
{
"Name": "Date",
"Value": "Thu, 15 Oct 2020 01:38:21 -0700"
},
{
"Name": "Reply-To",
"Value": "The G Suite Team <gsuite-noreply@google.com>"
},
{
"Name": "X-Google-Id",
"Value": "253939"
},
{
"Name": "Feedback-ID",
"Value": "P-10-0:C20060867:M110136315-en:gamma"
},
{
"Name": "X-Notifications",
"Value": "GAMMA:<9e4ee645a2583b0ee9630a0b49b0637eab983a45-20060867-110354355@google.com>"
},
{
"Name": "Message-ID",
"Value": "<9e4ee645a2583b0ee9630a0b49b0637eab983a45-20060867-110354355@google.com>"
},
{
"Name": "Subject",
"Value": "Your G Suite data transfer was successful for newaccount newdemo to drive activity"
},
{
"Name": "From",
"Value": "The G Suite Team <gsuite-noreply@google.com>"
},
{
"Name": "To",
"Value": "driveactivity@domain.io"
},
{
"Name": "Content-Type",
"Value": "multipart/alternative; boundary=\"000000000000191c3505b1b1924e\""
}
],
"ID": "1752b68ff72484b5",
"RawData": null,
"Subject": "Your G Suite data transfer was successful for newaccount newdemo to drive activity",
"To": "driveactivity@domain.io"
},
{
"Attachment Names": "",
"Attachments": [],
"BCC": [],
"Body/HTML": "html",
"Body/Text": "html",
"CC": [],
"Date": "Thu, 24 Sep 2020 07:12:50 -0700",
"Format": "multipart/alternative",
"From": "\"user test (Google Docs)\" <comments-noreply@docs.google.com>",
"Headers": [
{
"Name": "Delivered-To",
"Value": "fetch.incident@domain.io"
},
{
"Name": "Received",
"Value": "by 2002:a05:6838:9584:0:0:0:0 with SMTP id c4csp253820nkl; Thu, 24 Sep 2020 07:12:51 -0700 (PDT)"
},
{
"Name": "X-Received",
"Value": "by 2002:a92:50c:: with SMTP id q12mr4112900ile.8.1600956771319; Thu, 24 Sep 2020 07:12:51 -0700 (PDT)"
},
{
"Name": "ARC-Seal",
"Value": "i=1; a=rsa-sha256; t=1600956771; cv=none; d=google.com; s=arc-20160816; b=jT+v3caRre/FCSucP/0amYmpvCDb6Dymbyubsmdf2lW4OIUnIW+3uLgQQDqo+xvU2a qpzB7tqAvnIMloOmNM5/eN6Ti7OKivN8IYcPkjZR2AOqbjQUh11Iu5VMr5Y6LCU5Y0I4 WU6NloBklndcc6ApS+P0sAeQr3lhWFUfg6np4YRDuser69kP+DtbJMSedYNZSh3Ld75tzB DV/tESJxDplDEmRG3EfmsP+gKa3ljZNsnO+09Q/VjaTDQnnf2j81NV2Myj7N6Zc0FC7C 4DWWfRe54hVO6KL4HwjJHba8gW5FcNfcmRgTrh4GDTNOujkMp2ECrCWkSM1U6mAwqHdA NEcg=="
},
{
"Name": "ARC-Message-Signature",
"Value": "i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=to:from:subject:message-id:reply-to:references:date:mime-version :userim-signature; bh=x0pLwDJClo0r0sf+s+oGS8AWH89omey8uCtXKLZYF7A=; b=UoH7msRXiYvLYq7zXZ9wS85dWmSibZAflIypey423O8jkg3BE9a4wKl0cUuspHng7J IkyqN1X+1I0oBN2BqbZ3o4ec/rVgF9EevqDC551js7GdvqMV+ISnpNWBVAi6nk534ZqZ ll1X8nGNcVkINc0NTZRZNcsuEH1EYGn+KQIjxcItWVaVb3dHXzG+az5EtUmytbF7J6B3 GE1IHZ+XM9L4dIskeqRWS3Il8MxkDm4oPj4OIUQRu9WvoCA69BF5fpU3becRpyYugKNI BHo7ncAql7PKyP+bC40YZxzIWNptC6gAFpt5kX4T7NRtUyJXpfcGS8AsmAHsMCmYZsZ5 QTtQ=="
},
{
"Name": "ARC-Authentication-Results",
"Value": "i=1; mx.google.com; userim=pass header.i=@docs.google.com header.s=20161025 header.b=TvrL8Xc1; spf=pass (google.com: domain of 3yqlsxxapagkjvttluaz-uvylwsfkvjz.nvvnsl.jvt@docos.bounces.google.com designates 209.85.220.69 as permitted sender) smtp.mailfrom=3YqlsXxAPAGkJVTTLUaZ-UVYLWSfKVJZ.NVVNSL.JVT@docos.bounces.google.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=docs.google.com"
},
{
"Name": "Return-Path",
"Value": "<3YqlsXxAPAGkJVTTLUaZ-UVYLWSfKVJZ.NVVNSL.JVT@docos.bounces.google.com>"
},
{
"Name": "Received",
"Value": "from mail-sor-f69.google.com (mail-sor-f69.google.com. [209.85.220.69]) by mx.google.com with SMTPS id u4sor1831509iol.95.2020.09.24.07.12.51 for <fetch.incident@domain.io> (Google Transport Security); Thu, 24 Sep 2020 07:12:51 -0700 (PDT)"
},
{
"Name": "Received-SPF",
"Value": "pass (google.com: domain of 3yqlsxxapagkjvttluaz-uvylwsfkvjz.nvvnsl.jvt@docos.bounces.google.com designates 209.85.220.69 as permitted sender) client-ip=209.85.220.69;"
},
{
"Name": "Authentication-Results",
"Value": "mx.google.com; userim=pass header.i=@docs.google.com header.s=20161025 header.b=TvrL8Xc1; spf=pass (google.com: domain of 3yqlsxxapagkjvttluaz-uvylwsfkvjz.nvvnsl.jvt@docos.bounces.google.com designates 209.85.220.69 as permitted sender) smtp.mailfrom=3YqlsXxAPAGkJVTTLUaZ-UVYLWSfKVJZ.NVVNSL.JVT@docos.bounces.google.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=docs.google.com"
},
{
"Name": "userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=docs.google.com; s=20161025; h=mime-version:date:references:reply-to:message-id:subject:from:to; bh=x0pLwDJClo0r0sf+s+oGS8AWH89omey8uCtXKLZYF7A=; b=TvrL8Xc1Nnr3juYF8B5WATxy5GUXO7VRjMYhvfQP73/vqUwvu1+dIVsVW/5U7MBEA6 sa6gmrXWb1YlfVDlKH7ibhdjrrZ8xamQSDIWmnx7GRWrGVqA6YG1Iw5h4UMSnQQ4Dpmh bUigcljeFP7jeJ6aSMAeCzU7e7eAMe5yPjJiaDwl+BQosO5sxnijDmDMcZlOyrgiTbny sTBMfc6/TwnCYtMrHJtY3JDlDTy+OJr1TBAqteKMU26/3fteRRA1rtfT1bbkQ4dYFOHb 7EimtSewbCR+83qYF7hZXYufuG6yyrwqv6SG4RqrvRczr/l4G1Z6vaMRlB+XSo8c2IpJ zYQQ=="
},
{
"Name": "X-Google-userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:date:references:reply-to:message-id :subject:from:to; bh=x0pLwDJClo0r0sf+s+oGS8AWH89omey8uCtXKLZYF7A=; b=tlnmXMXisPQ/aFvEkaA8UnaCwT6Xbxsd9F71mWlwYGd42IHPntJsnIJ+DigBaEX7XR a0IU0jVNFOdcsH7qNh7A/okFiORzWZrbCu17tWQ2ly32MREUZbOkZK/0vbARsOGCvdM5 fS+5Y78ukh8vPtKGgsUDJ9ups5oaD0J+Ifoy3q3BBHj9rdlwYOKzc3wFmWyjGh//9w87 R+Wfo+ScGKTdEkE9InDJ6UTQmH+sMwBKOZ+ISJx4nkPMEwt49+HzoLYZu2tIshzP2LPz bVMKuALH9VvBQw/DEM0x2VDbapMtVSYhrH9eBhZ7oIuEx4ZGY83tiCai5vYd/Dcl+njx DbZQ=="
},
{
"Name": "X-Gm-Message-State",
"Value": "AOAM5336PTxhFmQv6Q0A7P5iPi434E4lBZmpgJ5iGt5T1O0woubNNLCU zGuhdc+7ow=="
},
{
"Name": "X-Google-Smtp-Source",
"Value": "ABdhPJw2wbVdvuQ1YBp06PF5N0Qa0xRT4L5lzqUHEV+akfyQaO9UO1MOF5mKgtaSli8kmBAToA=="
},
{
"Name": "MIME-Version",
"Value": "1.0"
},
{
"Name": "X-Received",
"Value": "by 2002:a6b:c9d3:: with SMTP id z202mr3546946iof.156.1600956770697; Thu, 24 Sep 2020 07:12:50 -0700 (PDT)"
},
{
"Name": "Date",
"Value": "Thu, 24 Sep 2020 07:12:50 -0700"
},
{
"Name": "X-Document-ID",
"Value": "swjGHIhOPTvavMP196F2nng"
},
{
"Name": "References",
"Value": "<d+c3dqR0hJaE9QVHZhuser1QMTk2RjJubmc6@docs.google.com>"
},
{
"Name": "X-No-Auto-Attachment",
"Value": "1"
},
{
"Name": "Reply-to",
"Value": "No Reply <d+noreply@docs.google.com>"
},
{
"Name": "X-Notifications",
"Value": "839f5e45fd400000"
},
{
"Name": "Message-ID",
"Value": "<4qBWvAEfST34kWEvZqvMDA.0@notifications.google.com>"
},
{
"Name": "Subject",
"Value": "new"
},
{
"Name": "From",
"Value": "\"user test (Google Docs)\" <comments-noreply@docs.google.com>"
},
{
"Name": "To",
"Value": "fetch.incident@domain.io"
},
{
"Name": "Content-Type",
"Value": "multipart/alternative; boundary=\"0000000000009e41cc05b00fcb99\""
}
],
"ID": "174c075abaceb067",
"RawData": null,
"Subject": "new",
"To": "fetch.incident@domain.io"
},
{
"Attachment Names": "20-21-10.pdf",
"Attachments": [
{
"ID": "ANGjdJ-ouHq_KlVLgJoSGV8JCzi7p8yTraIHdEN9U2vAn4ThttcfqKgoTnglqMJ-luf6w55S-m5IzIBdINW35eq4N1uCHQCk_az3jjLucyKgv2u6_jibEcNi_ck47swLacuwrrG2atszDoKwM9KJ0jUovnBDO6hTg1LrT4sb-T677zO_yMxNgWuHwnxRUDN_a2OIRM9c7hoDOkZlU3fXzWAxjFmbIzLroqaHLTnmvrm7pmes-jyQFh1MZZzLvu9yyBkOIKanoJnYW7Mt6G7ysuFruDxcnE7wiX8BtLpIP3qgaSZcA25aNRbuqiVIj5eL05FDwezy3QmwdhjKdOgmmPApMRCLQ9bUrHlHZW09zcExUmPYZFJWbzWktiSYxOWu7aYr1bKZsfWLNkEtE7RK",
"Name": "20-21-10.pdf"
}
],
"BCC": [],
"Body/HTML": "<div dir=\"ltr\">Hi user,<br><div><br></div><div>Please find\u00a0the attached Invoice for payment.</div></div>\r\n",
"Body/Text": "Hi user,\r\n\r\nPlease find the attached Invoice for payment.\r\n",
"CC": [],
"Date": "Wed, 28 Oct 2020 10:44:36 +0530",
"Format": "multipart/mixed",
"From": "user test",
"Headers": [
{
"Name": "Delivered-To",
"Value": "user@domain.io"
},
{
"Name": "Received",
"Value": "by 2002:ac8:5045:0:0:0:0:0 with SMTP id h5csp227879qtm; Tue, 27 Oct 2020 22:14:48 -0700 (PDT)"
},
{
"Name": "X-Received",
"Value": "by 2002:adf:fc0d:: with SMTP id i13mr6693362wrr.156.1603862088572; Tue, 27 Oct 2020 22:14:48 -0700 (PDT)"
},
{
"Name": "ARC-Seal",
"Value": "i=1; a=rsa-sha256; t=1603862088; cv=none; d=google.com; s=arc-20160816; b=0AxbJ1pD/Rwz4MVZY+ZIxFmKOKhnAmcfEJxsZILtT7FBat7yzLwU5uAvXkF2nrk3m7 Uk5HYWpacr8/QLuZZ5lhFZYgttgZGW+AvgGDPcTGfoVygGgSJhKomlDuQ47kWs7acDxV dIRR72Qz5DctXsP9RLdrn0QibbyEjyWuHzyN+kczKJ/dDNXBVUBsi8iX9yG4PRkM0PVe syNBYD7YDvQqKgRZ9VOTtoRdYmrASmiZ+22CmOZ6S1ESV+04iuYwmqhLAp0/LBXC0c2T 4xpwcpH9mQzeRUBHqM6lDz14q7qOrPpERWYS4U0dR3U597mShq43Lwe0UFKCfkHsn942 CNFA=="
},
{
"Name": "ARC-Message-Signature",
"Value": "i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=to:subject:message-id:date:from:mime-version:userim-signature; bh=euBan4jEQqeDOU1gQty+R/vibmOWoysN/1z/y/FRJsk=; b=I995G/GW0uvXaHGu2e1N73XBtrAXs16vXRrtuE5wFhaan5qW1fE30mTC3wzre2jp1A 46rhac7VBeL+HN/3EpqZ9Ur1B2kIvL3CqSJPBBfsvi6bhfHKdQXflSFlPbezojCHEcx6 jGkHbc+fQx+lCLbdXn/JKAWouFcbxEn7A8NlYRdq9htiAEZzoS5cjs4lNX8VMh77PgeL 8lTbbUtZG0foZCIPXnWucyivI35co8PQ3MUdZJ9xarvUb+eSMoWiQlV6V165+uYVMRdy 9GnMulD+KfPa9whuG+re/zgUAYJD0A6762DVO9NS9wpVSnlEcgo30nF8P9uETzFo3Nzu MCJw=="
},
{
"Name": "ARC-Authentication-Results",
"Value": "i=1; mx.google.com; userim=pass header.i=@domain-com.20150623.gappssmtp.com header.s=20150623 header.b=sr3o+AEJ; spf=pass (google.com: domain of domain@domain.io designates 209.85.220.41 as permitted sender) smtp.mailfrom=domain@domain.io"
},
{
"Name": "Return-Path",
"Value": "<domain@domain.io>"
},
{
"Name": "Received",
"Value": "from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41]) by mx.google.com with SMTPS id x16sor2141465wmc.14.2020.10.27.22.14.47 for <user@domain.io> (Google Transport Security); Tue, 27 Oct 2020 22:14:48 -0700 (PDT)"
},
{
"Name": "Received-SPF",
"Value": "pass (google.com: domain of domain@domain.io designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41;"
},
{
"Name": "Authentication-Results",
"Value": "mx.google.com; userim=pass header.i=@domain-com.20150623.gappssmtp.com header.s=20150623 header.b=sr3o+AEJ; spf=pass (google.com: domain of domain@domain.io designates 209.85.220.41 as permitted sender) smtp.mailfrom=domain@domain.io"
},
{
"Name": "userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=domain-com.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=euBan4jEQqeDOU1gQty+R/vibmOWoysN/1z/y/FRJsk=; b=sr3o+AEJT0+acrlhSPeAViSkcAONL35nUE5EMEKG2IA9lnM+toPS2PpzvCCwD3AYz9 c0TENoE7b+r1dqlnuw3ow0YfGT/Ja+2UdX2fOXnhi823Z+nUFT/c3zVS1WLxQ4Q//iN9 b8LJHbF3Opi1NSsOrFvqy5s5ZYM86nk0+t5fJK3kjZulJwZtlmrPtgEBQXX5byp5ONQt IA+80Y9FOq4Wgr8eNWImq2tCWalGlDCP0Lygw+alGu4J1chK1hzL9MYQZerxMYnX0Wkz IT5+CkMhw+gXvcb+t4JazUmZ+YpRQmFm9jDjHnTZ9r9Y5NGG8NLeGugvLgISA0sRV4jC xN/g=="
},
{
"Name": "X-Google-userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=euBan4jEQqeDOU1gQty+R/vibmOWoysN/1z/y/FRJsk=; b=d0paN4GVIPRZ9oMrljP9DGCYUfaYj94QGBNgb4eiEf0BDl+lLHbPBJFxofS5ENcHFU RyiWJ97YbAMNBrYR0VcG4WAaYlpr4Icc3xIm/fAWDVhF9SORD+V0oI6BZPDFllZJI5td X2QIN+sTtCzQz8S2zXrzc6vHZvd0jUf6/ygEqhbd895yBck8VG6JnE+4lcYeopPc7mY+ aAW84VijDVxP6ex2YfTBgx1MQ/XPxp/iCIZYiUaLRzCX196wDySW7veFfIePup5msgO5 k21XsFktv3Mjo5HOeoQmDy5rYr0q+NBqiEGWww0cNJgEtir1Ndu/KsC0dLlGOYldUtM/ qHgA=="
},
{
"Name": "X-Gm-Message-State",
"Value": "AOAM532lbsItIIq6+Hi3u+n4f8XH5JSBhVQ27mitCw2HKc5GJom6JKGI TQjHVd6vZ5RcpDvk9ikKQ+O5ZmET7Rjzv7ZND1D/2eezYmo="
},
{
"Name": "X-Google-Smtp-Source",
"Value": "ABdhPJwN+izZRQqz7yZ5r7QiLz9HNZj3K2DfMtBSi50muUYduS/aS/224PRCBYtNhYxoRfJ+AobS5c+VMxxRxb4uteI="
},
{
"Name": "X-Received",
"Value": "by 2002:a1c:9cd8:: with SMTP id f207mr5895584wme.76.1603862087346; Tue, 27 Oct 2020 22:14:47 -0700 (PDT)"
},
{
"Name": "MIME-Version",
"Value": "1.0"
},
{
"Name": "From",
"Value": "user test"
},
{
"Name": "Date",
"Value": "Wed, 28 Oct 2020 10:44:36 +0530"
},
{
"Name": "Message-ID",
"Value": "<CAB4Yy=Y-sd_q46FNU9C8Ed4JeNR=ZR+kioPAEW3BD8xi2JQ0_Q@mail.gmail.com>"
},
{
"Name": "Subject",
"Value": "Invoice for Payment"
},
{
"Name": "To",
"Value": "user test <user@domain.io>"
},
{
"Name": "Content-Type",
"Value": "multipart/mixed; boundary=\"000000000000fc606205b2b43d45\""
}
],
"ID": "1756da14b84773d0",
"RawData": null,
"Subject": "Invoice for Payment",
"To": "user test <user@domain.io>"
},
{
"Attachments": {
"entryID": ""
},
"BCC": [],
"Body/HTML": null,
"Body/Text": "this is the body",
"CC": [],
"Date": "Wed, 28 Oct 2020 17:09:30 -0000",
"Format": "text/plain",
"From": "Cortex XSOAR <noreply@demisto.com>",
"Headers": [
{
"Name": "Delivered-To",
"Value": "user@domain.io"
},
{
"Name": "Received",
"Value": "by 2002:a19:f11e:0:0:0:0:0 with SMTP id p30csp641301lfh; Wed, 28 Oct 2020 10:09:33 -0700 (PDT)"
},
{
"Name": "X-Google-Smtp-Source",
"Value": "ABdhPJz8m1jT0ssqjmD2U8ThX6ThyqUzsc3cTpqrAD6LRhlEbM6+/a84n3/aJ1WKmfnd2tkYxLgT"
},
{
"Name": "X-Received",
"Value": "by 2002:aa7:84c6:0:b029:155:d56e:5191 with SMTP id x6-20020aa784c60000b0290155d56e5191mr260750pfn.41.1603904973536; Wed, 28 Oct 2020 10:09:33 -0700 (PDT)"
},
{
"Name": "ARC-Seal",
"Value": "i=1; a=rsa-sha256; t=1603904973; cv=none; d=google.com; s=arc-20160816; b=i1gaeYn9XfzOzmgiQOnRBIecU79tTy3BM8fkGJhaGgBvLni4aqy6cAmj8Y2G4bIgCc wva5DfOYQGI/kU92oskTaHCAfReknVevAtIQBzSSYJE8iAgQpI1vHNQwatawk1Z2GLOo ehvTTnzDtLeVctte5MsinzTk8QRBGy6Mm696A/EG3gQtPid//OeEZjsRsGVoS/DnDsBl PnADQW2iDCipleWV5/VvZcuGr6MfVU7Z/xHnwsA2cVzFNpkuipYFeES5aj9VEpyAcpQJ D7HydozpsyGRthQTOHNt88fMtNd/AsMNuserFb0OuvvT0yh5mlXUD1HZxWpAZVjoQEy4bi SN1g=="
},
{
"Name": "ARC-Message-Signature",
"Value": "i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=date:message-id:to:from:subject:content-transfer-encoding :mime-version; bh=zz9vmrR/QL1JlfZ+XVEukkZVu/dgGaMq/IFz/+BEn+s=; b=IYEM58RIbU8H5CSFmuserUtv79IPOgvMYXoo9BpJNnXRwHm3N2V0WS3m+dB6oiOQFZhi 26//IoWW779aL91gaRg955bbDLHXXUDnuUMYHEPYGxysNZlomAIs/JHBVEKN5Dynqxon PFxDwT7wDnL2cIhvZVAlXTM5aoJX+DjriZEETfgmDdFAOfV4cSr+6aH03GlmoyV/Kd8W Lx0Sk07znWfUZenHGcW+zG4WhKe5wjyFep6lAXCIKsvx1O/RhzGxQRl4ROn/VFFGjC38 fEJTgzhNsilNUVQxtTH6+JNY+bIUhtPH0gFCm8Ymxcaxi7ksaVOq36kJIxxr/MKnVlVk B6aQ=="
},
{
"Name": "ARC-Authentication-Results",
"Value": "i=1; mx.google.com; spf=neutral (google.com: 203.88.139.45 is neither permitted nor denied by best guess record for domain of noreply@demisto.com) smtp.mailfrom=noreply@demisto.com"
},
{
"Name": "Return-Path",
"Value": "<noreply@demisto.com>"
},
{
"Name": "Received",
"Value": "from mail.domain.io ([203.88.139.45]) by mx.google.com with ESMTPS id x82si5333777pgx.136.2020.10.28.10.09.33 for <user@domain.io> (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 28 Oct 2020 10:09:33 -0700 (PDT)"
},
{
"Name": "Received-SPF",
"Value": "neutral (google.com: 203.88.139.45 is neither permitted nor denied by best guess record for domain of noreply@demisto.com) client-ip=203.88.139.45;"
},
{
"Name": "Authentication-Results",
"Value": "mx.google.com; spf=neutral (google.com: 203.88.139.45 is neither permitted nor denied by best guess record for domain of noreply@demisto.com) smtp.mailfrom=noreply@demisto.com"
},
{
"Name": "Received",
"Value": "from localhost (localhost [127.0.0.1]) by mail.domain.io (Postfix) with ESMTP id 3FD0F282E7C for <user@domain.io>; Wed, 28 Oct 2020 22:39:31 +0530 (IST)"
},
{
"Name": "Received",
"Value": "from mail.domain.io ([127.0.0.1]) by localhost (mail.domain.io [127.0.0.1]) (amavisd-new, port 10032) with ESMTP id QetnjLjf9OqD for <user@domain.io>; Wed, 28 Oct 2020 22:39:30 +0530 (IST)"
},
{
"Name": "Received",
"Value": "from localhost (localhost [127.0.0.1]) by mail.domain.io (Postfix) with ESMTP id 95F66282E7D for <user@domain.io>; Wed, 28 Oct 2020 22:39:30 +0530 (IST)"
},
{
"Name": "X-Virus-Scanned",
"Value": "amavisd-new at domain.io"
},
{
"Name": "Received",
"Value": "from mail.domain.io ([127.0.0.1]) by localhost (mail.domain.io [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id aHmdVO4nDHTv for <user@domain.io>; Wed, 28 Oct 2020 22:39:30 +0530 (IST)"
},
{
"Name": "Received",
"Value": "from [172.17.0.2] (unknown [203.88.139.34]) by mail.domain.io (Postfix) with ESMTPSA id 69C2C282D7C for <user@domain.io>; Wed, 28 Oct 2020 22:39:30 +0530 (IST)"
},
{
"Name": "Content-Type",
"Value": "text/plain; charset=\"utf-8\""
},
{
"Name": "MIME-Version",
"Value": "1.0"
},
{
"Name": "Content-Transfer-Encoding",
"Value": "base64"
},
{
"Name": "Subject",
"Value": "this is the subject"
},
{
"Name": "From",
"Value": "Cortex XSOAR <noreply@demisto.com>"
},
{
"Name": "To",
"Value": "user@domain.io"
},
{
"Name": "Message-Id",
"Value": "<20201028170930.69C2C282D7C@mail.domain.io>"
},
{
"Name": "Date",
"Value": "Wed, 28 Oct 2020 22:39:30 +0530 (IST)"
}
],
"ID": "175702fab120ba01",
"RawData": null,
"Subject": "this is the subject",
"To": "user@domain.io"
},
{
"Attachment Names": "",
"Attachments": [],
"BCC": [],
"Body/HTML": "<div>\r\n <meta http-equiv=Content-Type content=\"text/html; charset=utf-8\">\r\n <meta name=viewport content=width=device-width>\r\n <style>@media only screen{html{min-height:100%;background:#fafafa}}@media only screen and (max-width:640px){.small-float-center{margin:0 auto!important;float:none!important;text-align:center!important}}@media only screen and (max-width:640px){table.body img{width:auto;height:auto}table.body center{min-width:0!important}table.body .container{width:344px!important}table.body .columns{height:auto!important;-moz-box-sizing:border-box;-webkit-box-sizing:border-box;box-sizing:border-box;padding-left:40px!important;padding-right:40px!important}table.body .columns .columns{padding-left:0!important;padding-right:0!important}table.body .collapse .columns{padding-left:0!important;padding-right:0!important}th.small-1{display:inline-block!important;width:8.33333%!important}th.small-3{display:inline-block!important;width:25%!important}th.small-4{display:inline-block!important;width:33.33333%!important}th.small-6{display:inline-block!important;width:50%!important}th.small-8{display:inline-block!important;width:66.66667%!important}th.small-9{display:inline-block!important;width:75%!important}th.small-12{display:inline-block!important;width:100%!important}.columns th.small-12{display:block!important;width:100%!important}table.menu{width:100%!important}table.menu td,table.menu th{width:auto!important;display:inline-block!important}table.menu.vertical td,table.menu.vertical th{display:block!important}table.menu[align=center]{width:auto!important}}</style>\r\n <span class=preheader style=color:#fafafa;display:none!important;font-size:1px;line-height:1px;max-height:0;max-width:0;mso-hide:all!important;opacity:0;overflow:hidden;visibility:hidden></span>\r\n <table class=body style=Margin:0;background:#F8F9FA!important;border-collapse:collapse;border-spacing:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;height:100%;line-height:inherit;margin:0;padding:0;vertical-align:top;width:100%;text-align:left>\r\n <tr style=padding:0;vertical-align:top>\r\n <td class=center align=center valign=top style=-moz-hyphens:none;-webkit-hyphens:none;Margin:0;border-collapse:collapse!important;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;hyphens:none;line-height:inherit;margin:0;padding:0;vertical-align:top;word-wrap:keep-all>\r\n <center data-parsed=\"\" style=min-width:600px;width:100%>\r\n\r\n <table align=center class=\"container float-center\" style=\"Margin:0 auto;background:#fafafa;border-collapse:collapse;border-spacing:0;float:none;margin:0 auto;padding:0;text-align:left;vertical-align:top;width:600px\"><tbody><tr style=padding:0;vertical-align:top><td style=-moz-hyphens:none;-webkit-hyphens:none;Margin:0;border-collapse:collapse!important;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;hyphens:none;line-height:inherit;margin:0;padding:0;vertical-align:top;word-wrap:keep-all>\r\n <table class=\"row header\" style=background:#F8F9FA;border-collapse:collapse;border-spacing:0;display:table;font-size:12px;padding:0;position:relative;vertical-align:top;width:100%><tbody><tr style=padding:0;vertical-align:top>\r\n <th class=\"small-12 large-12 columns first last\" style=\"Margin:0 auto;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0 auto;padding:0;padding-bottom:24px;padding-left:40px;padding-right:40px;padding-top:12px;width:560px\"><table style=border-collapse:collapse;border-spacing:0;margin-bottom:0;padding:0;vertical-align:top;width:100%><tr style=padding:0;vertical-align:top><th style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0;text-align:left>\r\n\r\n <img src=https://storage.googleapis.com/support-kms-prod/BfxWlTCe6OCizPoUdUCwDz979TQRdnVdSMCG alt=\"G Suite\" height=30 style=-ms-interpolation-mode:bicubic;clear:both;display:block;margin-top:24px;max-height:30px;max-width:100%;outline:0;text-decoration:none;width:auto>\r\n\r\n </th>\r\n<th class=expander style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0!important;visibility:hidden;width:0></th></tr></table></th>\r\n </tr></tbody></table>\r\n\r\n <table class=\"row info\" style=align-items:center;background:#fff;border-collapse:collapse;border-color:#E8EAED;border-spacing:0;border-style:solid;border-width:1px;display:table;padding:0;position:relative;vertical-align:top;width:100%><tbody><tr style=padding:0;vertical-align:top>\r\n <th class=\"small-12 large-12 columns first last\" style=\"Margin:0 auto;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0 auto;padding:0;padding-bottom:0;padding-left:40px;padding-right:40px;width:560px\"><table style=border-collapse:collapse;border-spacing:0;padding:0;vertical-align:top;width:100%><tr style=padding:0;vertical-align:top><th style=\"Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0 0 24px;text-align:left\">\r\n <p style=Margin:0;Margin-bottom:16px;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:24px;margin:0;margin-bottom:16px;margin-top:24px;padding:0>Hello Admin,</p>\r\n\r\n<p style=Margin:0;Margin-bottom:16px;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:24px;margin:0;margin-bottom:16px;padding:0>G Suite recently processed a request from test user (user@domain.io) to transfer data for user test (user@domain.io) to user test (user@domain.io).</p>\r\n\r\n<p style=Margin:0;Margin-bottom:16px;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:24px;margin:0;margin-bottom:16px;padding:0>The data transfer was successful.</p>\r\n\r\n<p style=\"margin-top:8px;color:#3C4043;font-family:Google Sans,Helvetica,Arial,sans-serif;font-size:14px;font-weight:700;line-height:24px;margin:0;margin-bottom:0px;padding:0\">Sincerely,</p>\r\n\r\n<p style=\"Margin:0;color:#3C4043;font-family:Google Sans,Helvetica,Arial,sans-serif;font-size:14px;font-weight:700;line-height:24px;margin:0;margin-bottom:0;padding:0\">The G Suite Team</p>\r\n </th></tr></table></th>\r\n </tr></tbody></table>\r\n\r\n <table class=\"row footer\" style=background:#F8F9FA;border-collapse:collapse;border-spacing:0;display:table;margin-top:0;padding:0;position:relative;vertical-align:top;width:100%><tbody><tr style=padding:0;vertical-align:top>\r\n <th class=\"small-12 large-12 columns first last\" style=\"Margin:0 auto;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0 auto;padding:0;padding-bottom:0;padding-left:40px;padding-right:40px;width:560px\"><table style=border-collapse:collapse;border-spacing:0;padding:0;vertical-align:top;width:100%><tr style=padding:0;vertical-align:top><th style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:24px;text-align:left>\r\n\r\n <img src=https://storage.googleapis.com/support-kms-prod/Yd1rPlunjtOKzNDXcw3eFmVCjI828xhBZqQy alt=\"Google Cloud\" height=30 style=-ms-interpolation-mode:bicubic;clear:both;display:block;margin-bottom:14px;max-width:100%;max-height:30px;outline:0;text-decoration:none;width:auto>\r\n <p style=Margin:0;Margin-bottom:16px;color:#6C737F;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:12px;font-weight:400;line-height:16px;margin:0;margin-bottom:14px;padding:0>\r\n \u00a9 2020 Google LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043\r\n </p>\r\n <p style=Margin:0;Margin-bottom:16px;color:#6C737F;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:12px;font-weight:400;line-height:16px;margin:0;margin-bottom:14px;padding:0>\r\n <em>You\u2019re receiving this mandatory email service announcement to update you about important changes to your Google Cloud product or account.</em>\r\n </p>\r\n </th>\r\n<th class=expander style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0!important;visibility:hidden;width:0></th></tr></table></th>\r\n </tr></tbody></table>\r\n </td></tr></tbody></table>\r\n\r\n </center>\r\n </td>\r\n </tr>\r\n </table>\r\n <!-- prevent Gmail on iOS font size manipulation -->\r\n <div style=\"display:none;white-space:nowrap;font:15px courier;line-height:0\"> </div>\r\n \r\n</div>\r\n",
"Body/Text": "From: \"The G Suite Team\" [gsuite-noreply@google.com]\r\nSubject: Your G Suite data transfer was successful for user test to \r\nuser test\r\n\r\nHello Admin,\r\n\r\nG\u00a0Suite recently processed a request from test user (user@domain.io) \r\nto transfer data for user test (user@domain.io) to user \r\ntest (user@domain.io).\r\n\r\nThe data transfer was successful.\r\n\r\nSincerely,\r\n\r\nThe G\u00a0Suite Team\r\n\r\n\r\n[Google Cloud]\r\n\r\n(c) 2020 Google LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043 * \r\nGoogle Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland * Google \r\nAsia Pacific Pte. Ltd., 8 Marina View, #30-01, Asia Square 1, Singapore \r\n018960\r\n\r\nYou're receiving this mandatory email service announcement to update you \r\nabout important changes to your Google Cloud product or account.\r\n",
"CC": [],
"Date": "Wed, 21 Oct 2020 03:19:45 -0700",
"Format": "multipart/alternative",
"From": "The G Suite Team <gsuite-noreply@google.com>",
"Headers": [
{
"Name": "Delivered-To",
"Value": "user@domain.io"
},
{
"Name": "Received",
"Value": "by 2002:ab4:9b4d:0:0:0:0:0 with SMTP id f13csp1113640ecz; Wed, 21 Oct 2020 03:19:46 -0700 (PDT)"
},
{
"Name": "X-Received",
"Value": "by 2002:a92:3608:: with SMTP id d8mr1854537ila.2.1603275586149; Wed, 21 Oct 2020 03:19:46 -0700 (PDT)"
},
{
"Name": "ARC-Seal",
"Value": "i=1; a=rsa-sha256; t=1603275586; cv=none; d=google.com; s=arc-20160816; b=IScKK1NudjmvdSd/MdeoPxyBETVwz6BqYU7l92NBoESsGvlgpVIIAeM73nRDjA3EY+ q5y0H39HgXxBSsRVRmY0nqsiFEx/oT4a/tzl+EDNR/vXDIknW/+4i7hcF9VVfZfH3hfJ 8lnuqafUFCoglkoYhUpScSRtomM9Caop8439x3snEPhjHMIxV1Yjpy5Ub8AmQLLMN9pZ UasLotRCbFhMu7i3a+NyJpKEX+5/MTjVyLe0GSTNItppNkgsKU76VjdC/PIxG8OurOKC VEZahMut7ll0PosBsgZmSCHoMH/9Lh0WuaUHHRQOih+w52qyNTC7Cj+duh7lfCi8tuR1 g/jg=="
},
{
"Name": "ARC-Message-Signature",
"Value": "i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=to:from:subject:message-id:feedback-id:reply-to:date:mime-version :userim-signature; bh=kfRxf4d6YTlZyBFf4xWJMjZiBq0HVOyRTFyfTXLbe2A=; b=rQN2CWMbTe1rrR1aK7NR/i6iucznTNo5KF9WoVDZVPsl8SNNtvc2sbu35TMckTEvc7 Fw7V35AU2hKSXiUmMMmpvlJc7/lZZQS+9ufJvOB5ERb3ZQvJ7vDntPLcWSWD+Z+zhA4L piHDuzNYQ6UTLunyrojovIYR7Kut32+56efMCnP+3STL/8GoDlWhg5Dl8nJaUw8scKVA tPbby0snklB7BEuppbXOkB+1Y/E6UMZEluMi1pXgNPTBGL0CvtZOmqeWgaTUS1pEaizO W/kPvQzCpLHHjrtSejS0LAWDQYGNDVap0+wxjpsc7HvCuS/A5DEaiw+17U0xU74MYscF WHVQ=="
},
{
"Name": "ARC-Authentication-Results",
"Value": "i=1; mx.google.com; userim=pass header.i=@google.com header.s=20161025 header.b=Vq6Vf70E; spf=pass (google.com: domain of 3qquqxw4kb5oamocn8-hil8jfsaiiaf8.6igmbcp4hahcg5f874n4.ci@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) smtp.mailfrom=3QQuQXw4KB5oAMOCN8-HIL8JFSAIIAF8.6IGMBCP4HAHCG5F874N4.CI@scoutcamp.bounces.google.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com"
},
{
"Name": "Return-Path",
"Value": "<3QQuQXw4KB5oAMOCN8-HIL8JFSAIIAF8.6IGMBCP4HAHCG5F874N4.CI@scoutcamp.bounces.google.com>"
},
{
"Name": "Received",
"Value": "from mail-sor-f69.google.com (mail-sor-f69.google.com. [209.85.220.69]) by mx.google.com with SMTPS id j84sor874916ili.67.2020.10.21.03.19.45 for <user@domain.io> (Google Transport Security); Wed, 21 Oct 2020 03:19:46 -0700 (PDT)"
},
{
"Name": "Received-SPF",
"Value": "pass (google.com: domain of 3qquqxw4kb5oamocn8-hil8jfsaiiaf8.6igmbcp4hahcg5f874n4.ci@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) client-ip=209.85.220.69;"
},
{
"Name": "Authentication-Results",
"Value": "mx.google.com; userim=pass header.i=@google.com header.s=20161025 header.b=Vq6Vf70E; spf=pass (google.com: domain of 3qquqxw4kb5oamocn8-hil8jfsaiiaf8.6igmbcp4hahcg5f874n4.ci@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) smtp.mailfrom=3QQuQXw4KB5oAMOCN8-HIL8JFSAIIAF8.6IGMBCP4HAHCG5F874N4.CI@scoutcamp.bounces.google.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com"
},
{
"Name": "userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:date:reply-to:feedback-id:message-id:subject:from:to; bh=kfRxf4d6YTlZyBFf4xWJMjZiBq0HVOyRTFyfTXLbe2A=; b=Vq6Vf70EwOBFHTM2cd3cdfjczrrz/DTgix9/F6vpKdsPG7gnxvdmAS8I8zYZDwCAOB OXn3wVZOoIbV/ebj4ruO3xAUOKPWDq+QsIg+GELHsz9vcjb1y8+ZsyZu1TR1pqjAxYY4 msupux3YVM0/Qij8oZA/RaX2R2zdurAcRHI8sVSLDVlI+q6S3ljgmSUa+cHJp4H7qjPP do8NpFGJNb5ZCjf5BgkniEBnCDhNDaT9HzVkWBeVQ1hbWOmswSQk4XDZqsD1VJoqtxFX YK7VgP59yA6+V3JufQFePt/v0qUWdxGXFjk+Z+uCiTJV+k71hDlcB43uCAszTrhuBgCF gkLQ=="
},
{
"Name": "X-Google-userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:date:reply-to:feedback-id :message-id:subject:from:to; bh=kfRxf4d6YTlZyBFf4xWJMjZiBq0HVOyRTFyfTXLbe2A=; b=npFEbCyyZrzyxt5KD7XGwoIxMwGPaLIoxCOmthILZQSZwHf4YR90e0PtZJYqexBTxP TIKGcbK8MX5JnG+SUaMsKvWHtOaFWiMq65c9v6Pa1yedBiPEcc81Fp0OIOkepcW5V7MP euTm57krNctjiaKjXAS8xZOrw6hIngRMDwNnm1U3HprnjMewQ4xtQLTP7N2IGlu2eeQl RgOmZFw1R/ptBAs84dVFjj8gz6xvD2Hc75jkErrcGoeICAFQP/qbyTzVpR/sOzRDgUqm xi0M/W9zbBGn73UEgLbsjlCcvb7KdjiMilq7J38WGhmrBLukUkKqvrlM46Q+VKvh8QOi 6XJQ=="
},
{
"Name": "X-Gm-Message-State",
"Value": "AOAM533kswxJuWLXsarIgxZqLeTqnvbq6Gw8vSiwiWaeP1Qcrgk2Uzz3 Q7mDm4WbaPiD39Y="
},
{
"Name": "X-Google-Smtp-Source",
"Value": "ABdhPJyjp+KhQ5RNoYBDfKXi+q4buqsqi57IVI9KQa19jKonPQNFj6qIdXjDmgopcoZyFkjAZY78YIg="
},
{
"Name": "MIME-Version",
"Value": "1.0"
},
{
"Name": "X-Received",
"Value": "by 2002:a05:6e02:11b4:: with SMTP id 20mr1889339ilj.271.1603275585914; Wed, 21 Oct 2020 03:19:45 -0700 (PDT)"
},
{
"Name": "Date",
"Value": "Wed, 21 Oct 2020 03:19:45 -0700"
},
{
"Name": "Reply-To",
"Value": "The G Suite Team <gsuite-noreply@google.com>"
},
{
"Name": "X-Google-Id",
"Value": "253939"
},
{
"Name": "Feedback-ID",
"Value": "P-10-0:C20060867:M110136315-en:gamma"
},
{
"Name": "X-Notifications",
"Value": "GAMMA:<dce5da70c09c512cd672d87e6a892b6822b64a89-20060867-110354355@google.com>"
},
{
"Name": "Message-ID",
"Value": "<dce5da70c09c512cd672d87e6a892b6822b64a89-20060867-110354355@google.com>"
},
{
"Name": "Subject",
"Value": "Your G Suite data transfer was successful for user test to user test"
},
{
"Name": "From",
"Value": "The G Suite Team <gsuite-noreply@google.com>"
},
{
"Name": "To",
"Value": "user@domain.io"
},
{
"Name": "Content-Type",
"Value": "multipart/alternative; boundary=\"000000000000c6873505b22baf3c\""
}
],
"ID": "1754aabfa1d53920",
"RawData": null,
"Subject": "Your G Suite data transfer was successful for user test to user test",
"To": "user@domain.io"
}
],
"Gmail": [
{
"Attachment Names": "",
"Attachments": [],
"Bcc": [],
"Body": "From: \"The G Suite Team\" [gsuite-noreply@google.com]\r\nSubject: Your G Suite data transfer was successful for admin admin to \r\nnewaccount newdemo\r\n\r\nHello Admin,\r\n\r\nG\u00a0Suite recently processed a request from test user (user@domain.io) \r\nto transfer data for admin admin (admin@domain.io) to newaccount \r\nnewdemo (demo@domain.io).\r\n\r\nThe data transfer was successful.\r\n\r\nSincerely,\r\n\r\nThe G\u00a0Suite Team\r\n\r\n\r\n[Google Cloud]\r\n\r\n(c) 2020 Google LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043 * \r\nGoogle Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland * Google \r\nAsia Pacific Pte. Ltd., 8 Marina View, #30-01, Asia Square 1, Singapore \r\n018960\r\n\r\nYou're receiving this mandatory email service announcement to update you \r\nabout important changes to your Google Cloud product or account.\r\n",
"Cc": [],
"Date": "Wed, 14 Oct 2020 05:41:24 -0700",
"Format": "multipart/alternative",
"From": "The G Suite Team <gsuite-noreply@google.com>",
"Headers": [
{
"Name": "Delivered-To",
"Value": "admin@domain.io"
},
{
"Name": "Received",
"Value": "by 2002:a02:7354:0:0:0:0:0 with SMTP id a20csp545510jae; Wed, 14 Oct 2020 05:41:28 -0700 (PDT)"
},
{
"Name": "X-Received",
"Value": "by 2002:ac8:5792:: with SMTP id v18mr548458qta.314.1602679284583; Wed, 14 Oct 2020 05:41:24 -0700 (PDT)"
},
{
"Name": "ARC-Seal",
"Value": "i=1; a=rsa-sha256; t=1602679284; cv=none; d=google.com; s=arc-20160816; b=inCsQKzjd3amLNvs3Bp/NvKnfT1kZepYeCarDm20s9rNbAsSQMAG4hs82ay7PdRWyQ wpF3gkwRhIBYRS+g9vzw0tm9is9DyDCZ6fDb1MD6cypJIv9s1if0yrb89BLfv8dobLkb /bA/rLqMOjz+aogJtYyXuzmOOzgd5O9t6SndWcDHXU39RxfortydOaRXDMs7v8MjY0ug QtKrcZMLS01+amO5am5PWz0hxORNpJ3eVvWDt2BdeyBjTfqKpHTeaoz1U9iF1ykiA3LZ ce9ojCi6ZE+cqha5N38Ymrb5q/4IHJqoRmeED/x0f5qfknCs+HH8EwIJKocklB0Xyyri rTDQ=="
},
{
"Name": "ARC-Message-Signature",
"Value": "i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=to:from:subject:message-id:feedback-id:reply-to:date:mime-version :userim-signature; bh=uHezP21QvUyC54yXw9TZPN19UBE4CUwtwmFkjlyW8yc=; b=SfF5gf8iUPvEjLbUf34ss15ub8BIsEFd9mqb8bLctUMFBeHYhvoI10A0hcef7sBMrR dGsjnLXCTUVWFG8KCDUq/4LU5Oxt/oynlymOMYXg4S4sgfwnn55YquSa7WkxSd56mCzu U3u9AiUXYPo3nXHkE2OpE56ZxZMZXybP7wqN5mtMTm1lgVIB0O+m9ZoXAfAHRrN/BlWm NyV3xYfKy4lxOXg2891Gqjor0cyxmdLnFfAUV1UhKtA6B8vdV8EYll8IgaGyF/ZV2nnv OcHCJN6P7nCAQjzfuftAfAKok8oH+wfJrK3NYZekkY3GY7yz5ecEQUUdUw+zlV7JEUU+ atsA=="
},
{
"Name": "ARC-Authentication-Results",
"Value": "i=1; mx.google.com; userim=pass header.i=@google.com header.s=20161025 header.b=i0zVcnln; spf=pass (google.com: domain of 39pggxw4kbfudprfqb-klobmivdlldib.zljxajfkkfjyibaxqx.fl@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) smtp.mailfrom=39PGGXw4KBfUdprfqb-klobmivdlldib.ZljXajfkkfjYibaXqX.fl@scoutcamp.bounces.google.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com"
},
{
"Name": "Return-Path",
"Value": "<39PGGXw4KBfUdprfqb-klobmivdlldib.ZljXajfkkfjYibaXqX.fl@scoutcamp.bounces.google.com>"
},
{
"Name": "Received",
"Value": "from mail-sor-f69.google.com (mail-sor-f69.google.com. [209.85.220.69]) by mx.google.com with SMTPS id x77sor1124176qkb.139.2020.10.14.05.41.24 for <admin@domain.io> (Google Transport Security); Wed, 14 Oct 2020 05:41:24 -0700 (PDT)"
},
{
"Name": "Received-SPF",
"Value": "pass (google.com: domain of 39pggxw4kbfudprfqb-klobmivdlldib.zljxajfkkfjyibaxqx.fl@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) client-ip=209.85.220.69;"
},
{
"Name": "Authentication-Results",
"Value": "mx.google.com; userim=pass header.i=@google.com header.s=20161025 header.b=i0zVcnln; spf=pass (google.com: domain of 39pggxw4kbfudprfqb-klobmivdlldib.zljxajfkkfjyibaxqx.fl@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) smtp.mailfrom=39PGGXw4KBfUdprfqb-klobmivdlldib.ZljXajfkkfjYibaXqX.fl@scoutcamp.bounces.google.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com"
},
{
"Name": "userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:date:reply-to:feedback-id:message-id:subject:from:to; bh=uHezP21QvUyC54yXw9TZPN19UBE4CUwtwmFkjlyW8yc=; b=i0zVcnln+GKJw0aTEwMcfE9LbIQpDTWDMUsBzRGyiTdzomU7SQ4wdfje3GlB+dJEJ3 aZyzP/LBE5Dn0ce3fDXlf2kVgip609YIHMbmCLpitcod/Y40Y3BOs54ppXgnTB8uuiaj K0gbEyk0ytwypf2YlpwSIG+IlkPsR7vh+r/XHtQZFMsFi/+lRwcVdd77RiAB3LSUu1VL FidSGkmo1/IWQafndOuGRoGESwYDSyKj3KH77Z67G8wLJycCoLwVRsz+1ypVZeXWjepC /BVtteMhC/wvG9yvqYfDN6O9b0RES3G6VVL8Q8Rct8Z6W+jfA4+Vjj8/0uucFFuhJUp1 VYAg=="
},
{
"Name": "X-Google-userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:date:reply-to:feedback-id :message-id:subject:from:to; bh=uHezP21QvUyC54yXw9TZPN19UBE4CUwtwmFkjlyW8yc=; b=sr5kUqJ8b3DtVKa6txI60W6YnjC4ut7/IS9vgrTFXYejb1kAz3S2T9kmusercByKpUgV d1dxJgc4IXWjvzXTGeiPhkd14yVU4o9yGVPyqpHWqh01wRzvm4A1XDCNpueqKzu3CCwD W0Gi5WDuxhyoXTVfbA5khNj3FKIzbsjEq9AuPmot7AGIU/KLqNNxZXTgmaEWjQAIOSNa ZO1yonkoJJzkiK8Ice77T9Z4sF8gK117uT+XGUJsBIETDC1CoLT0DMG2gIqGoACx7DNS ZCVEG9qgMvHQZG0n4QTM+X6C/y2eBX5+bo1GUXTzRLq+zipFtQB4Ub0JkiS8n85DQ3UI Vbog=="
},
{
"Name": "X-Gm-Message-State",
"Value": "AOAM532AtfkPzRtzg/pDi2pgJupb4kWVaPeUCv/m1zWUETSIukg/v3gr HJO17WVR4Xupop0="
},
{
"Name": "X-Google-Smtp-Source",
"Value": "ABdhPJykymec9GUMAf4Zaz8lfI9Oz5NpB0m6BlC1NDD5LoiZdBzpYwtPAXotrZpg2c+2eCjjPcToDgk="
},
{
"Name": "MIME-Version",
"Value": "1.0"
},
{
"Name": "X-Received",
"Value": "by 2002:a05:620a:22d4:: with SMTP id o20mr4626484qki.151.1602679284199; Wed, 14 Oct 2020 05:41:24 -0700 (PDT)"
},
{
"Name": "Date",
"Value": "Wed, 14 Oct 2020 05:41:24 -0700"
},
{
"Name": "Reply-To",
"Value": "The G Suite Team <gsuite-noreply@google.com>"
},
{
"Name": "X-Google-Id",
"Value": "253939"
},
{
"Name": "Feedback-ID",
"Value": "P-10-0:C20060867:M110136315-en:gamma"
},
{
"Name": "X-Notifications",
"Value": "GAMMA:<35c14aeaf7734b2245ba4e59e605c4a43f99137a-20060867-110354355@google.com>"
},
{
"Name": "Message-ID",
"Value": "<35c14aeaf7734b2245ba4e59e605c4a43f99137a-20060867-110354355@google.com>"
},
{
"Name": "Subject",
"Value": "Your G Suite data transfer was successful for admin admin to newaccount newdemo"
},
{
"Name": "From",
"Value": "The G Suite Team <gsuite-noreply@google.com>"
},
{
"Name": "To",
"Value": "admin@domain.io"
},
{
"Name": "Content-Type",
"Value": "multipart/alternative; boundary=\"0000000000006c713905b1a0d95d\""
}
],
"Html": "<div>\r\n <meta http-equiv=Content-Type content=\"text/html; charset=utf-8\">\r\n <meta name=viewport content=width=device-width>\r\n <style>@media only screen{html{min-height:100%;background:#fafafa}}@media only screen and (max-width:640px){.small-float-center{margin:0 auto!important;float:none!important;text-align:center!important}}@media only screen and (max-width:640px){table.body img{width:auto;height:auto}table.body center{min-width:0!important}table.body .container{width:344px!important}table.body .columns{height:auto!important;-moz-box-sizing:border-box;-webkit-box-sizing:border-box;box-sizing:border-box;padding-left:40px!important;padding-right:40px!important}table.body .columns .columns{padding-left:0!important;padding-right:0!important}table.body .collapse .columns{padding-left:0!important;padding-right:0!important}th.small-1{display:inline-block!important;width:8.33333%!important}th.small-3{display:inline-block!important;width:25%!important}th.small-4{display:inline-block!important;width:33.33333%!important}th.small-6{display:inline-block!important;width:50%!important}th.small-8{display:inline-block!important;width:66.66667%!important}th.small-9{display:inline-block!important;width:75%!important}th.small-12{display:inline-block!important;width:100%!important}.columns th.small-12{display:block!important;width:100%!important}table.menu{width:100%!important}table.menu td,table.menu th{width:auto!important;display:inline-block!important}table.menu.vertical td,table.menu.vertical th{display:block!important}table.menu[align=center]{width:auto!important}}</style>\r\n <span class=preheader style=color:#fafafa;display:none!important;font-size:1px;line-height:1px;max-height:0;max-width:0;mso-hide:all!important;opacity:0;overflow:hidden;visibility:hidden></span>\r\n <table class=body style=Margin:0;background:#F8F9FA!important;border-collapse:collapse;border-spacing:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;height:100%;line-height:inherit;margin:0;padding:0;vertical-align:top;width:100%;text-align:left>\r\n <tr style=padding:0;vertical-align:top>\r\n <td class=center align=center valign=top style=-moz-hyphens:none;-webkit-hyphens:none;Margin:0;border-collapse:collapse!important;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;hyphens:none;line-height:inherit;margin:0;padding:0;vertical-align:top;word-wrap:keep-all>\r\n <center data-parsed=\"\" style=min-width:600px;width:100%>\r\n\r\n <table align=center class=\"container float-center\" style=\"Margin:0 auto;background:#fafafa;border-collapse:collapse;border-spacing:0;float:none;margin:0 auto;padding:0;text-align:left;vertical-align:top;width:600px\"><tbody><tr style=padding:0;vertical-align:top><td style=-moz-hyphens:none;-webkit-hyphens:none;Margin:0;border-collapse:collapse!important;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;hyphens:none;line-height:inherit;margin:0;padding:0;vertical-align:top;word-wrap:keep-all>\r\n <table class=\"row header\" style=background:#F8F9FA;border-collapse:collapse;border-spacing:0;display:table;font-size:12px;padding:0;position:relative;vertical-align:top;width:100%><tbody><tr style=padding:0;vertical-align:top>\r\n <th class=\"small-12 large-12 columns first last\" style=\"Margin:0 auto;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0 auto;padding:0;padding-bottom:24px;padding-left:40px;padding-right:40px;padding-top:12px;width:560px\"><table style=border-collapse:collapse;border-spacing:0;margin-bottom:0;padding:0;vertical-align:top;width:100%><tr style=padding:0;vertical-align:top><th style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0;text-align:left>\r\n\r\n <img src=https://storage.googleapis.com/support-kms-prod/BfxWlTCe6OCizPoUdUCwDz979TQRdnVdSMCG alt=\"G Suite\" height=30 style=-ms-interpolation-mode:bicubic;clear:both;display:block;margin-top:24px;max-height:30px;max-width:100%;outline:0;text-decoration:none;width:auto>\r\n\r\n </th>\r\n<th class=expander style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0!important;visibility:hidden;width:0></th></tr></table></th>\r\n </tr></tbody></table>\r\n\r\n <table class=\"row info\" style=align-items:center;background:#fff;border-collapse:collapse;border-color:#E8EAED;border-spacing:0;border-style:solid;border-width:1px;display:table;padding:0;position:relative;vertical-align:top;width:100%><tbody><tr style=padding:0;vertical-align:top>\r\n <th class=\"small-12 large-12 columns first last\" style=\"Margin:0 auto;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0 auto;padding:0;padding-bottom:0;padding-left:40px;padding-right:40px;width:560px\"><table style=border-collapse:collapse;border-spacing:0;padding:0;vertical-align:top;width:100%><tr style=padding:0;vertical-align:top><th style=\"Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0 0 24px;text-align:left\">\r\n <p style=Margin:0;Margin-bottom:16px;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:24px;margin:0;margin-bottom:16px;margin-top:24px;padding:0>Hello Admin,</p>\r\n\r\n<p style=Margin:0;Margin-bottom:16px;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:24px;margin:0;margin-bottom:16px;padding:0>G Suite recently processed a request from test user (user@domain.io) to transfer data for admin admin (admin@domain.io) to newaccount newdemo (demo@domain.io).</p>\r\n\r\n<p style=Margin:0;Margin-bottom:16px;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:24px;margin:0;margin-bottom:16px;padding:0>The data transfer was successful.</p>\r\n\r\n<p style=\"margin-top:8px;color:#3C4043;font-family:Google Sans,Helvetica,Arial,sans-serif;font-size:14px;font-weight:700;line-height:24px;margin:0;margin-bottom:0px;padding:0\">Sincerely,</p>\r\n\r\n<p style=\"Margin:0;color:#3C4043;font-family:Google Sans,Helvetica,Arial,sans-serif;font-size:14px;font-weight:700;line-height:24px;margin:0;margin-bottom:0;padding:0\">The G Suite Team</p>\r\n </th></tr></table></th>\r\n </tr></tbody></table>\r\n\r\n <table class=\"row footer\" style=background:#F8F9FA;border-collapse:collapse;border-spacing:0;display:table;margin-top:0;padding:0;position:relative;vertical-align:top;width:100%><tbody><tr style=padding:0;vertical-align:top>\r\n <th class=\"small-12 large-12 columns first last\" style=\"Margin:0 auto;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0 auto;padding:0;padding-bottom:0;padding-left:40px;padding-right:40px;width:560px\"><table style=border-collapse:collapse;border-spacing:0;padding:0;vertical-align:top;width:100%><tr style=padding:0;vertical-align:top><th style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:24px;text-align:left>\r\n\r\n <img src=https://storage.googleapis.com/support-kms-prod/Yd1rPlunjtOKzNDXcw3eFmVCjI828xhBZqQy alt=\"Google Cloud\" height=30 style=-ms-interpolation-mode:bicubic;clear:both;display:block;margin-bottom:14px;max-width:100%;max-height:30px;outline:0;text-decoration:none;width:auto>\r\n <p style=Margin:0;Margin-bottom:16px;color:#6C737F;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:12px;font-weight:400;line-height:16px;margin:0;margin-bottom:14px;padding:0>\r\n \u00a9 2020 Google LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043\r\n </p>\r\n <p style=Margin:0;Margin-bottom:16px;color:#6C737F;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:12px;font-weight:400;line-height:16px;margin:0;margin-bottom:14px;padding:0>\r\n <em>You\u2019re receiving this mandatory email service announcement to update you about important changes to your Google Cloud product or account.</em>\r\n </p>\r\n </th>\r\n<th class=expander style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0!important;visibility:hidden;width:0></th></tr></table></th>\r\n </tr></tbody></table>\r\n </td></tr></tbody></table>\r\n\r\n </center>\r\n </td>\r\n </tr>\r\n </table>\r\n <!-- prevent Gmail on iOS font size manipulation -->\r\n <div style=\"display:none;white-space:nowrap;font:15px courier;line-height:0\"> </div>\r\n \r\n</div>\r\n",
"ID": "175272123add67b3",
"Labels": "UNREAD, CATEGORY_UPDATES, INBOX",
"Mailbox": "admin@domain.io",
"RawData": null,
"Subject": "Your G Suite data transfer was successful for admin admin to newaccount newdemo",
"ThreadId": "175272123add67b3",
"To": "admin@domain.io",
"Type": "Gmail"
},
{
"Attachment Names": "",
"Attachments": [],
"Bcc": [],
"Body": "Tips for using your new inbox\r\n[image: Gmail]\r\n\r\nWelcome to your inbox\r\n[image: Search]\r\nFind emails fast\r\nWith the power of Google Search in your inbox, you can archive\r\n<https://support.google.com/mail/answer/6576?hl=en&utm_source=gmailwelcomeemail&utm_medium=email&utm_campaign=gmailwelcome>\r\nall your email and find it\r\n<https://support.google.com/mail/answer/6593?hl=en&utm_source=gmailwelcomeemail&utm_medium=email&utm_campaign=gmailwelcome>\r\nlater in a flash. Your inbox stays tidy, and you never need to worry about\r\nwhat to keep.\r\n[image: Personalize]\r\nPersonalize test Data Technologies Mail\r\nCustomize inbox backgrounds, email signatures, and other options in test\r\nData Technologies Mail settings\r\n<https://support.google.com/mail/answer/6562?hl=en&utm_source=gmailwelcomeemail&utm_medium=email&utm_campaign=gmailwelcome>.\r\nReview and adjust your privacy and security settings at My Account\r\n<https://myaccount.google.com/>.\r\n[image: Organize]\r\nOrganize your email\r\nYou can organize email with labels\r\n<https://support.google.com/mail/answer/118708?hl=en&utm_source=gmailwelcomeemail&utm_medium=email&utm_campaign=gmailwelcome>,\r\nwhich are like folders, but you can add more than one label to a message.\r\nYou can also use filters\r\n<https://support.google.com/mail/answer/6579?hl=en&utm_source=gmailwelcomeemail&utm_medium=email&utm_campaign=gmailwelcome>\r\nto automatically sort and categorize messages as they come in.\r\n[image: Social]\r\nChat and meet from your inbox\r\nChat with contacts and start video meetings with up to 25 people in Google\r\nHangouts\r\n<https://support.google.com/hangouts/answer/3115176?hl=en&utm_source=gmailwelcomeemail&utm_medium=email&utm_campaign=gmailwelcome>\r\n.\r\n\r\nGet training and tips\r\nFind Gmail guides, tips, cheat sheets, help switching from Microsoft\u00ae\r\nOutlook\u00ae, and more at the G Suite Learning Center\r\n<https://support.google.com/a/users/answer/9259748?hl=en&utm_source=gmailwelcomeemail&utm_medium=email&utm_campaign=gmailwelcome>\r\n.\r\nVisit the Learning Center\r\n<https://support.google.com/a/users/answer/9259748?hl=en&utm_source=gmailwelcomeemail&utm_medium=email&utm_campaign=gmailwelcome>\r\n\r\nHappy emailing,\r\nThe Gmail Team\r\n[image: Google Cloud]\r\n\r\n\u00a9 2020 Google LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043\r\n\r\n*You\u2019re receiving this mandatory email service announcement to update you\r\nabout important changes to your Google Cloud product or account.*\r\n",
"Cc": [],
"Date": "Wed, 28 Oct 2020 09:13:51 -0700",
"Format": "multipart/alternative",
"From": "Gmail Team <mail-noreply@google.com>",
"Headers": [
{
"Name": "MIME-Version",
"Value": "1.0"
},
{
"Name": "x-no-auto-attachment",
"Value": "1"
},
{
"Name": "Received",
"Value": "by 2002:a9a:545:0:b029:96:b451:56b4; Wed, 28 Oct 2020 09:13:51 -0700 (PDT)"
},
{
"Name": "Date",
"Value": "Wed, 28 Oct 2020 09:13:51 -0700"
},
{
"Name": "Message-ID",
"Value": "<CAJ0=S95fT_hUQ5MMTB9GmQBaT7AqzGTyjwpdmLu5=REM5-F+_g@mail.gmail.com>"
},
{
"Name": "Subject",
"Value": "Tips for using your new inbox"
},
{
"Name": "From",
"Value": "Gmail Team <mail-noreply@google.com>"
},
{
"Name": "To",
"Value": "abcd12 a <azsa@domain.io>"
},
{
"Name": "Content-Type",
"Value": "multipart/alternative; boundary=\"0000000000000515ee05b2bd73a9\""
}
],
"Html": "html",
"ID": "1756ffcad693a98f",
"Labels": "UNREAD, INBOX",
"Mailbox": "azsa@domain.io",
"RawData": null,
"Subject": "Tips for using your new inbox",
"ThreadId": "1756ffcad693a98f",
"To": "abcd12 a <azsa@domain.io>",
"Type": "Gmail"
},
{
"Attachment Names": "",
"Attachments": [],
"Bcc": [],
"Body": "From: \"The G Suite Team\" [gsuite-noreply@google.com]\r\nSubject: Your G Suite data transfer was successful for newaccount newdemo \r\nto drive activity\r\n\r\nHello Admin,\r\n\r\nG\u00a0Suite recently processed a request from user test \r\n(user@domain.io) to transfer data for newaccount newdemo \r\n(demo@domain.io) to drive activity (driveactivity@domain.io).\r\n\r\nThe data transfer was successful.\r\n\r\nSincerely,\r\n\r\nThe G\u00a0Suite Team\r\n\r\n\r\n[Google Cloud]\r\n\r\n(c) 2020 Google LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043 * \r\nGoogle Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland * Google \r\nAsia Pacific Pte. Ltd., 8 Marina View, #30-01, Asia Square 1, Singapore \r\n018960\r\n\r\nYou're receiving this mandatory email service announcement to update you \r\nabout important changes to your Google Cloud product or account.\r\n",
"Cc": [],
"Date": "Thu, 15 Oct 2020 01:38:22 -0700",
"Format": "multipart/alternative",
"From": "The G Suite Team <gsuite-noreply@google.com>",
"Headers": [
{
"Name": "Delivered-To",
"Value": "demo@domain.io"
},
{
"Name": "Received",
"Value": "by 2002:a50:af21:0:0:0:0:0 with SMTP id g30csp212233edd; Thu, 15 Oct 2020 01:38:23 -0700 (PDT)"
},
{
"Name": "X-Received",
"Value": "by 2002:a6b:8dca:: with SMTP id p193mr2390539iod.77.1602751103584; Thu, 15 Oct 2020 01:38:23 -0700 (PDT)"
},
{
"Name": "ARC-Seal",
"Value": "i=1; a=rsa-sha256; t=1602751103; cv=none; d=google.com; s=arc-20160816; b=aBcIUB9Cpn0j7zKAvs9iT9OreqI9h4NpnQtb0QOfYPUV2ELm/TzFaITNIpxrCuNmaL H1Azc1/FIH7jAw93MB0ppnzud+WAYpDHJ/1dfdgkXVxocKsicWD5s658TMqZKZNewkpG puR4GIt/xQULVvmMgjuRnbVPdXm4Xch8JTZJz7lnni5CRUyIqLXcvlF0uVtwwr4ajgAB FbjeIwlgsNttMyPyP90EVWG1dbbo4z4MRMjEJ42lve+YZ0cmtRaM7rkLaJ2Z2Mml6Ui3 8yapFa2VME7s9qdtO3lgfdw5/U/1Yw5X8cjdYmtQrRbHfu9MLsRDdM9ugb07gBcu0cVK /yRQ=="
},
{
"Name": "ARC-Message-Signature",
"Value": "i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=to:from:subject:message-id:feedback-id:reply-to:date:mime-version :userim-signature; bh=Y3ZqZNVJw6xMlulEe1vZahBH7+HTnDug5V6Hzf3Un8A=; b=y0QuwIKW9pmokqDGOLWQPsiyq57ek3ZRQlDIRT1/rIS3aBzRHov7LujIYD/PuGRhBL H3J3PUEAdm2zuBTSHYulAm1rxa06vJO+w/WLP1KmzlYvAU5s0WdhiVedBTbBhUyRTMAM 1C8c+Yqhs6quII/mtLB4u7iFyAatEAsM/4W6SCS7wteJvGN3kvNio/d1auser8RK4Kqd6r FlZQU6tFn79W7vm++tvLjy+owZWN6akpEUHBqPir17Rgciw7bKDZkfpjD7MgjhcP3t9X 0ISf7wPgvtE6BXkmdWuuCuHNmmrH7IoS7rrPSr0CylXcGp2IrLZbdZ78LVRpNRBarrRz FW5g=="
},
{
"Name": "ARC-Authentication-Results",
"Value": "i=1; mx.google.com; userim=pass header.i=@google.com header.s=20161025 header.b=bvX9MVYr; spf=pass (google.com: domain of 3fgqixw4kblubnpdoz-ijmzkgtbjjbgz.xjhyzhjidhwgzyvov.dj@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) smtp.mailfrom=3fgqIXw4KBLUbnpdoZ-ijmZkgtbjjbgZ.XjhYZhjidhWgZYVoV.dj@scoutcamp.bounces.google.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com"
},
{
"Name": "Return-Path",
"Value": "<3fgqIXw4KBLUbnpdoZ-ijmZkgtbjjbgZ.XjhYZhjidhWgZYVoV.dj@scoutcamp.bounces.google.com>"
},
{
"Name": "Received",
"Value": "from mail-sor-f69.google.com (mail-sor-f69.google.com. [209.85.220.69]) by mx.google.com with SMTPS id t89sor861231ili.126.2020.10.15.01.38.23 for <demo@domain.io> (Google Transport Security); Thu, 15 Oct 2020 01:38:23 -0700 (PDT)"
},
{
"Name": "Received-SPF",
"Value": "pass (google.com: domain of 3fgqixw4kblubnpdoz-ijmzkgtbjjbgz.xjhyzhjidhwgzyvov.dj@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) client-ip=209.85.220.69;"
},
{
"Name": "Authentication-Results",
"Value": "mx.google.com; userim=pass header.i=@google.com header.s=20161025 header.b=bvX9MVYr; spf=pass (google.com: domain of 3fgqixw4kblubnpdoz-ijmzkgtbjjbgz.xjhyzhjidhwgzyvov.dj@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) smtp.mailfrom=3fgqIXw4KBLUbnpdoZ-ijmZkgtbjjbgZ.XjhYZhjidhWgZYVoV.dj@scoutcamp.bounces.google.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com"
},
{
"Name": "userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:date:reply-to:feedback-id:message-id:subject:from:to; bh=Y3ZqZNVJw6xMlulEe1vZahBH7+HTnDug5V6Hzf3Un8A=; b=bvX9MVYrvwnJk04PzWZj20B+wYkKaUd5Q8mpVmtGr7kEpvOpt3Gs9CQcNB2zGUnGHH tNQoxgQm94IaphqEDEPV34JJAzGlpjLrqKHvBk7NkezW6f4plhsNZmPWnSnlsUuserar/s K4P8Vj+iWg49RnvC4KwDFIaI24Va2tChqSWE8Ecuserkf3qO20vkgXJfa9cVXhNZ3O8eim Ge/sFZ+XIGahtWoLnc/fQOTakLhTXHZB96WR4FBwms3uOTc9qgmJ4a4NdredahChQ8WA HAhjSxypEHCrDQn6obVvy8TASOwGu20zcQHwgslLr2yazr7aa95TyQIRIblRqWwzliOC WBAA=="
},
{
"Name": "X-Google-userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:date:reply-to:feedback-id :message-id:subject:from:to; bh=Y3ZqZNVJw6xMlulEe1vZahBH7+HTnDug5V6Hzf3Un8A=; b=Ra2XnSNMfL9rDPuLIK+eVqqIIOC0otWhWkSjxlzcmvx0HVmxEiHBHY+KnGf1Pi8EeT HR1thqs6cH73pk0EMPAFYb2+ADGJylDIbDjB1BkGvkCv9D+i4M3KkhuY5RI0Zz0cXjNA BZQF1072viGbMdIyop/hyFEglSd+oETW7fh0yyxP+pEUuserfA8StGZM5hnz2TZvj5kXzG YnjGKVgmTnHLLUzO0eXQrk5XtHBmUIzN1LCrWJc7zFgcoTjhufGupPwS7iPH37+rU5Id /m4UzisYx+8urGX4lP7ed40pFqugd/y2yQANH4cRRAY2jiJ/VvlYgdWSP/3JoiZViAk2 7/ZA=="
},
{
"Name": "X-Gm-Message-State",
"Value": "AOAM533jANXzvnHIQ6tH1XkZkXnsZGt9jhleBSRuserliLX6F8AbE79QaQ wnGOaZoHqpRBcrM="
},
{
"Name": "X-Google-Smtp-Source",
"Value": "ABdhPJzUjUWVMRywt1ccaYOMB6c2Kx1SPcFhHgIQeC/uTGpmpCTUKYc51oVIvecDl2EkTnS/cMcxvxU="
},
{
"Name": "MIME-Version",
"Value": "1.0"
},
{
"Name": "X-Received",
"Value": "by 2002:a05:6e02:13e8:: with SMTP id w8mr2392088ilj.139.1602751102957; Thu, 15 Oct 2020 01:38:22 -0700 (PDT)"
},
{
"Name": "Date",
"Value": "Thu, 15 Oct 2020 01:38:22 -0700"
},
{
"Name": "Reply-To",
"Value": "The G Suite Team <gsuite-noreply@google.com>"
},
{
"Name": "X-Google-Id",
"Value": "253939"
},
{
"Name": "Feedback-ID",
"Value": "P-10-0:C20060867:M110136315-en:gamma"
},
{
"Name": "X-Notifications",
"Value": "GAMMA:<8f3624478fcd3ee213c843e47693b42d32d9427c-20060867-110354355@google.com>"
},
{
"Name": "Message-ID",
"Value": "<8f3624478fcd3ee213c843e47693b42d32d9427c-20060867-110354355@google.com>"
},
{
"Name": "Subject",
"Value": "Your G Suite data transfer was successful for newaccount newdemo to drive activity"
},
{
"Name": "From",
"Value": "The G Suite Team <gsuite-noreply@google.com>"
},
{
"Name": "To",
"Value": "demo@domain.io"
},
{
"Name": "Content-Type",
"Value": "multipart/alternative; boundary=\"00000000000027ba2005b1b192f5\""
}
],
"Html": "<div>\r\n <meta http-equiv=Content-Type content=\"text/html; charset=utf-8\">\r\n <meta name=viewport content=width=device-width>\r\n <style>@media only screen{html{min-height:100%;background:#fafafa}}@media only screen and (max-width:640px){.small-float-center{margin:0 auto!important;float:none!important;text-align:center!important}}@media only screen and (max-width:640px){table.body img{width:auto;height:auto}table.body center{min-width:0!important}table.body .container{width:344px!important}table.body .columns{height:auto!important;-moz-box-sizing:border-box;-webkit-box-sizing:border-box;box-sizing:border-box;padding-left:40px!important;padding-right:40px!important}table.body .columns .columns{padding-left:0!important;padding-right:0!important}table.body .collapse .columns{padding-left:0!important;padding-right:0!important}th.small-1{display:inline-block!important;width:8.33333%!important}th.small-3{display:inline-block!important;width:25%!important}th.small-4{display:inline-block!important;width:33.33333%!important}th.small-6{display:inline-block!important;width:50%!important}th.small-8{display:inline-block!important;width:66.66667%!important}th.small-9{display:inline-block!important;width:75%!important}th.small-12{display:inline-block!important;width:100%!important}.columns th.small-12{display:block!important;width:100%!important}table.menu{width:100%!important}table.menu td,table.menu th{width:auto!important;display:inline-block!important}table.menu.vertical td,table.menu.vertical th{display:block!important}table.menu[align=center]{width:auto!important}}</style>\r\n <span class=preheader style=color:#fafafa;display:none!important;font-size:1px;line-height:1px;max-height:0;max-width:0;mso-hide:all!important;opacity:0;overflow:hidden;visibility:hidden></span>\r\n <table class=body style=Margin:0;background:#F8F9FA!important;border-collapse:collapse;border-spacing:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;height:100%;line-height:inherit;margin:0;padding:0;vertical-align:top;width:100%;text-align:left>\r\n <tr style=padding:0;vertical-align:top>\r\n <td class=center align=center valign=top style=-moz-hyphens:none;-webkit-hyphens:none;Margin:0;border-collapse:collapse!important;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;hyphens:none;line-height:inherit;margin:0;padding:0;vertical-align:top;word-wrap:keep-all>\r\n <center data-parsed=\"\" style=min-width:600px;width:100%>\r\n\r\n <table align=center class=\"container float-center\" style=\"Margin:0 auto;background:#fafafa;border-collapse:collapse;border-spacing:0;float:none;margin:0 auto;padding:0;text-align:left;vertical-align:top;width:600px\"><tbody><tr style=padding:0;vertical-align:top><td style=-moz-hyphens:none;-webkit-hyphens:none;Margin:0;border-collapse:collapse!important;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;hyphens:none;line-height:inherit;margin:0;padding:0;vertical-align:top;word-wrap:keep-all>\r\n <table class=\"row header\" style=background:#F8F9FA;border-collapse:collapse;border-spacing:0;display:table;font-size:12px;padding:0;position:relative;vertical-align:top;width:100%><tbody><tr style=padding:0;vertical-align:top>\r\n <th class=\"small-12 large-12 columns first last\" style=\"Margin:0 auto;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0 auto;padding:0;padding-bottom:24px;padding-left:40px;padding-right:40px;padding-top:12px;width:560px\"><table style=border-collapse:collapse;border-spacing:0;margin-bottom:0;padding:0;vertical-align:top;width:100%><tr style=padding:0;vertical-align:top><th style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0;text-align:left>\r\n\r\n <img src=https://storage.googleapis.com/support-kms-prod/BfxWlTCe6OCizPoUdUCwDz979TQRdnVdSMCG alt=\"G Suite\" height=30 style=-ms-interpolation-mode:bicubic;clear:both;display:block;margin-top:24px;max-height:30px;max-width:100%;outline:0;text-decoration:none;width:auto>\r\n\r\n </th>\r\n<th class=expander style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0!important;visibility:hidden;width:0></th></tr></table></th>\r\n </tr></tbody></table>\r\n\r\n <table class=\"row info\" style=align-items:center;background:#fff;border-collapse:collapse;border-color:#E8EAED;border-spacing:0;border-style:solid;border-width:1px;display:table;padding:0;position:relative;vertical-align:top;width:100%><tbody><tr style=padding:0;vertical-align:top>\r\n <th class=\"small-12 large-12 columns first last\" style=\"Margin:0 auto;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0 auto;padding:0;padding-bottom:0;padding-left:40px;padding-right:40px;width:560px\"><table style=border-collapse:collapse;border-spacing:0;padding:0;vertical-align:top;width:100%><tr style=padding:0;vertical-align:top><th style=\"Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0 0 24px;text-align:left\">\r\n <p style=Margin:0;Margin-bottom:16px;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:24px;margin:0;margin-bottom:16px;margin-top:24px;padding:0>Hello Admin,</p>\r\n\r\n<p style=Margin:0;Margin-bottom:16px;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:24px;margin:0;margin-bottom:16px;padding:0>G Suite recently processed a request from user test (user@domain.io) to transfer data for newaccount newdemo (demo@domain.io) to drive activity (driveactivity@domain.io).</p>\r\n\r\n<p style=Margin:0;Margin-bottom:16px;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:24px;margin:0;margin-bottom:16px;padding:0>The data transfer was successful.</p>\r\n\r\n<p style=\"margin-top:8px;color:#3C4043;font-family:Google Sans,Helvetica,Arial,sans-serif;font-size:14px;font-weight:700;line-height:24px;margin:0;margin-bottom:0px;padding:0\">Sincerely,</p>\r\n\r\n<p style=\"Margin:0;color:#3C4043;font-family:Google Sans,Helvetica,Arial,sans-serif;font-size:14px;font-weight:700;line-height:24px;margin:0;margin-bottom:0;padding:0\">The G Suite Team</p>\r\n </th></tr></table></th>\r\n </tr></tbody></table>\r\n\r\n <table class=\"row footer\" style=background:#F8F9FA;border-collapse:collapse;border-spacing:0;display:table;margin-top:0;padding:0;position:relative;vertical-align:top;width:100%><tbody><tr style=padding:0;vertical-align:top>\r\n <th class=\"small-12 large-12 columns first last\" style=\"Margin:0 auto;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0 auto;padding:0;padding-bottom:0;padding-left:40px;padding-right:40px;width:560px\"><table style=border-collapse:collapse;border-spacing:0;padding:0;vertical-align:top;width:100%><tr style=padding:0;vertical-align:top><th style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:24px;text-align:left>\r\n\r\n <img src=https://storage.googleapis.com/support-kms-prod/Yd1rPlunjtOKzNDXcw3eFmVCjI828xhBZqQy alt=\"Google Cloud\" height=30 style=-ms-interpolation-mode:bicubic;clear:both;display:block;margin-bottom:14px;max-width:100%;max-height:30px;outline:0;text-decoration:none;width:auto>\r\n <p style=Margin:0;Margin-bottom:16px;color:#6C737F;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:12px;font-weight:400;line-height:16px;margin:0;margin-bottom:14px;padding:0>\r\n \u00a9 2020 Google LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043\r\n </p>\r\n <p style=Margin:0;Margin-bottom:16px;color:#6C737F;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:12px;font-weight:400;line-height:16px;margin:0;margin-bottom:14px;padding:0>\r\n <em>You\u2019re receiving this mandatory email service announcement to update you about important changes to your Google Cloud product or account.</em>\r\n </p>\r\n </th>\r\n<th class=expander style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0!important;visibility:hidden;width:0></th></tr></table></th>\r\n </tr></tbody></table>\r\n </td></tr></tbody></table>\r\n\r\n </center>\r\n </td>\r\n </tr>\r\n </table>\r\n <!-- prevent Gmail on iOS font size manipulation -->\r\n <div style=\"display:none;white-space:nowrap;font:15px courier;line-height:0\"> </div>\r\n \r\n</div>\r\n",
"ID": "1752b6902315fba8",
"Labels": "UNREAD, CATEGORY_UPDATES, INBOX",
"Mailbox": "demo@domain.io",
"RawData": null,
"Subject": "Your G Suite data transfer was successful for newaccount newdemo to drive activity",
"ThreadId": "1752b6902315fba8",
"To": "demo@domain.io",
"Type": "Gmail"
},
{
"Attachments": "",
"Bcc": [],
"Body": "\r\n",
"Cc": [],
"Date": "Tue, 27 Oct 2020 21:58:33 -0700",
"Format": "text/plain",
"From": "user1 test1 <user@domain.io>",
"Headers": [
{
"Name": "To",
"Value": "3d_qYXxAPBdI0CAA2BHG-BCF2D9M1C0G.4CC492.0CA12Jy9B6Az921yHy.6C@docos.bounces.google.com"
},
{
"Name": "From",
"Value": "user1 test1 <user@domain.io>"
},
{
"Name": "Date",
"Value": "Tue, 27 Oct 2020 21:58:33 -0700"
},
{
"Name": "Message-ID",
"Value": "<CAKWG9FmfrWB2fqMySvy-ffjxPBAE81E_zJ2JV1G87ztq4j_Ojg@mail.gmail.com>"
},
{
"Name": "Subject",
"Value": "hello Re: Untitled document - @user@domain.io @user@domain..."
},
{
"Name": "MIME-Version",
"Value": "1.0"
},
{
"Name": "Content-Type",
"Value": "text/plain; charset=UTF-8"
},
{
"Name": "Content-Transfer-Encoding",
"Value": "7bit"
},
{
"Name": "Content-Disposition",
"Value": "inline"
},
{
"Name": "Precedence",
"Value": "bulk"
},
{
"Name": "X-Autoreply",
"Value": "yes"
},
{
"Name": "Auto-Submitted",
"Value": "auto-replied"
}
],
"Html": null,
"ID": "1756d926adcca849",
"Labels": "SENT",
"Mailbox": "user@domain.io",
"RawData": null,
"Subject": "hello Re: Untitled document - @user@domain.io @user@domain...",
"ThreadId": "1756d926adcca849",
"To": "3d_qYXxAPBdI0CAA2BHG-BCF2D9M1C0G.4CC492.0CA12Jy9B6Az921yHy.6C@docos.bounces.google.com",
"Type": "Gmail"
},
{
"Attachment Names": "",
"Attachments": [],
"Bcc": [],
"Body": "Get the official Gmail app\r\n[image: Gmail]\r\n\r\nGet the official Gmail app\r\nThe best features of test Data Technologies Mail are only available on\r\nyour phone and tablet with the official Gmail app. Download the app or go\r\nto gmail.com on your computer or mobile device to get started.\r\n\r\n[image: Get it on Google Play]\r\n<https://play.google.com/store/apps/details?id=com.google.android.gm&hl=en>\r\n[image:\r\nApple App Store]\r\n<https://apps.apple.com/app/gmail-email-by-google/id422689480?l=en>\r\n\r\nHappy emailing,\r\nThe Gmail Team\r\n[image: Google Cloud]\r\n\r\n\u00a9 2020 Google LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043\r\n\r\n*You\u2019re receiving this mandatory email service announcement to update you\r\nabout important changes to your Google Cloud product or account.*\r\n",
"Cc": [],
"Date": "Fri, 23 Oct 2020 03:38:26 -0700",
"Format": "multipart/alternative",
"From": "Gmail Team <mail-noreply@google.com>",
"Headers": [
{
"Name": "MIME-Version",
"Value": "1.0"
},
{
"Name": "x-no-auto-attachment",
"Value": "1"
},
{
"Name": "Received",
"Value": "by 2002:a5d:9390:0:0:0:0:0; Fri, 23 Oct 2020 03:38:26 -0700 (PDT)"
},
{
"Name": "Date",
"Value": "Fri, 23 Oct 2020 03:38:26 -0700"
},
{
"Name": "Message-ID",
"Value": "<CAP6sO1io-ROJjeUsh-EPQmnJO79-Us6Byd15jwBnOO8uKqZDiA@mail.gmail.com>"
},
{
"Name": "Subject",
"Value": "Get the official Gmail app"
},
{
"Name": "From",
"Value": "Gmail Team <mail-noreply@google.com>"
},
{
"Name": "To",
"Value": "user user <user@domain.io>"
},
{
"Name": "Content-Type",
"Value": "multipart/alternative; boundary=\"000000000000395d8f05b2542e2c\""
}
],
"Html": "html",
"ID": "1755509c8f043a8a",
"Labels": "UNREAD, INBOX",
"Mailbox": "user@domain.io",
"RawData": null,
"Subject": "Get the official Gmail app",
"ThreadId": "1755509c8f043a8a",
"To": "user user <user@domain.io>",
"Type": "Gmail"
},
{
"Attachment Names": "",
"Attachments": [],
"Bcc": [],
"Body": "From: \"The G Suite Team\" [gsuite-noreply@google.com]\r\nSubject: Your G Suite data transfer was successful for newaccount newdemo \r\nto drive activity\r\n\r\nHello Admin,\r\n\r\nG\u00a0Suite recently processed a request from user test \r\n(user@domain.io) to transfer data for newaccount newdemo \r\n(demo@domain.io) to drive activity (driveactivity@domain.io).\r\n\r\nThe data transfer was successful.\r\n\r\nSincerely,\r\n\r\nThe G\u00a0Suite Team\r\n\r\n\r\n[Google Cloud]\r\n\r\n(c) 2020 Google LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043 * \r\nGoogle Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland * Google \r\nAsia Pacific Pte. Ltd., 8 Marina View, #30-01, Asia Square 1, Singapore \r\n018960\r\n\r\nYou're receiving this mandatory email service announcement to update you \r\nabout important changes to your Google Cloud product or account.\r\n",
"Cc": [],
"Date": "Thu, 15 Oct 2020 01:38:21 -0700",
"Format": "multipart/alternative",
"From": "The G Suite Team <gsuite-noreply@google.com>",
"Headers": [
{
"Name": "Delivered-To",
"Value": "driveactivity@domain.io"
},
{
"Name": "Received",
"Value": "by 2002:a1c:b38b:0:0:0:0:0 with SMTP id c133csp280423wmf; Thu, 15 Oct 2020 01:38:22 -0700 (PDT)"
},
{
"Name": "X-Received",
"Value": "by 2002:a6b:920b:: with SMTP id u11mr2323170iod.191.1602751102479; Thu, 15 Oct 2020 01:38:22 -0700 (PDT)"
},
{
"Name": "ARC-Seal",
"Value": "i=1; a=rsa-sha256; t=1602751102; cv=none; d=google.com; s=arc-20160816; b=BdG38MgajamZ8OYbq1Ozx7ZoPFfSiRaUxMC8Tkdixjh1V1HDtTwlU0qzQZBCOYqUNP DNTMS7ILJR9NxWxHfcTueUgiA15WjCUcXoBUbXJHJ6sN01isQ35juserFB8NneV21Kkffd u6Jl2FjHQnzPfJHUIQ3uCW+a8M8xk5wXFPN6Ny+wbvvBy1qAo3xdJCJi1NEXfF4aD2Wy P7sFpcDNAbboRtTGzB7Pf2FeGPXDB9tj+jo3RNDY1HJPxExKG2O7HjeOCkf7ofh/6bqA wMJzaLWaakjTw61rzUnh+vvI/GO/Di2C4vDt6gzfbqBRrN5NF5zsk17FtG1qEzrtfD9w TJVw=="
},
{
"Name": "ARC-Message-Signature",
"Value": "i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=to:from:subject:message-id:feedback-id:reply-to:date:mime-version :userim-signature; bh=hSvG69KscN/bxqwCM0EsKSB8EWCl5yNraTSDzP3sgKg=; b=FLZntKs7DsOG7pOQIgkeyCDHZCjjGQnzXeX3qoMFZIubDGZYSHyqqF3iXWxSdB1mxD D8nSSsRhPfG/RVeStdnxmZK/8hMaWo2L2ytI/2UsoV4iMdt/VOzdhmJeSXI0zbKofmBB kkAqgCDzgeF4egzoLR8APulsn+wInOVRiP/GjpXMq2bEo1hN981thCndyzC6ztNiN8KT CXJU3faPzrcgS8MrcNSGUcrTx43t1XNyTvAgh+kwWuserHD0nFKXV3Fga/4u7pYoSingmL Fv5SUZqbod/8at6DNrgp6aCGG7CPKMC8xKTlpe6zC+e6As6gwdg2svV4FJHHorQEn96Z kHgg=="
},
{
"Name": "ARC-Authentication-Results",
"Value": "i=1; mx.google.com; userim=pass header.i=@google.com header.s=20161025 header.b=rw78gql3; spf=pass (google.com: domain of 3fqqixw4kdbqamocny-hilyjfsaiiafy.wigxlcpyuwncpcnshcgvfyxunu.ci@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) smtp.mailfrom=3fQqIXw4KDbQamocnY-hilYjfsaiiafY.WigXlcpYUWncpcnshcgVfYXUnU.ci@scoutcamp.bounces.google.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com"
},
{
"Name": "Return-Path",
"Value": "<3fQqIXw4KDbQamocnY-hilYjfsaiiafY.WigXlcpYUWncpcnshcgVfYXUnU.ci@scoutcamp.bounces.google.com>"
},
{
"Name": "Received",
"Value": "from mail-sor-f69.google.com (mail-sor-f69.google.com. [209.85.220.69]) by mx.google.com with SMTPS id f12sor896603ilq.7.2020.10.15.01.38.22 for <driveactivity@domain.io> (Google Transport Security); Thu, 15 Oct 2020 01:38:22 -0700 (PDT)"
},
{
"Name": "Received-SPF",
"Value": "pass (google.com: domain of 3fqqixw4kdbqamocny-hilyjfsaiiafy.wigxlcpyuwncpcnshcgvfyxunu.ci@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) client-ip=209.85.220.69;"
},
{
"Name": "Authentication-Results",
"Value": "mx.google.com; userim=pass header.i=@google.com header.s=20161025 header.b=rw78gql3; spf=pass (google.com: domain of 3fqqixw4kdbqamocny-hilyjfsaiiafy.wigxlcpyuwncpcnshcgvfyxunu.ci@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) smtp.mailfrom=3fQqIXw4KDbQamocnY-hilYjfsaiiafY.WigXlcpYUWncpcnshcgVfYXUnU.ci@scoutcamp.bounces.google.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com"
},
{
"Name": "userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:date:reply-to:feedback-id:message-id:subject:from:to; bh=hSvG69KscN/bxqwCM0EsKSB8EWCl5yNraTSDzP3sgKg=; b=rw78gql31QvtrEUrSV7dGSuxdLbOHrG+eOBxBXfRQwXfHWzRxqf1s9qL8cysve2lol DwS5lNA7gX1ZwQLie5nRSJjmqFmfENDs/yv6Lqp9dh+lYs92N0ZYI3Xs5ZjdVn7JQe23 86S0/5lHS4GKjwCAJghS2B1eUXHdC5ZcQbB63/lpIsCQCbEH8Xuz6Qnen4S5jIxCUrJJ PQiO21Kwgfh8w8rqugqU4RJ1bdfinLdboubOQ8l1WICkgl/1AlPZSo6Uu6iDMwFuD8gb FRRNX3b4T+VG+M69pbpkeiJRmV8uzxyUqU03rC8T0yod6fZs/kISgQfw5YVGCcZAsyLG VWIw=="
},
{
"Name": "X-Google-userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:date:reply-to:feedback-id :message-id:subject:from:to; bh=hSvG69KscN/bxqwCM0EsKSB8EWCl5yNraTSDzP3sgKg=; b=PzDIgL0/tTttvAAiHVb7+3yCjKdj9KJGXMGCmdFkJP6hnKkWrYmyg4WnbPwjyKfscA UL+83pwGwcUar+9rHVwMTUyKCSudG1DrKX60uJhIo0+n4xASW0znzI7NNC05JDTaHZIZ Ar6PghlhVmhqfRjJY2MrFVQZXnNDmPDaS8QUT3mtcpaIpLRa/Z3cY0oxJIrOISd7VLDy KavhsI3CX4s++6/0XV2JiT3fB9nYgW7lG6Lw1g4UI3vCjIlG4CMmI30ByztQI8NXT1So x+hMHsaiQUmzIytQ25GPD+xCeo0Lp4pZ5etbZ4QydCeBzusergNWm+nxhKCs8crFWFca3v ztRg=="
},
{
"Name": "X-Gm-Message-State",
"Value": "AOAM5323IhsjRQxG2DjbZd1oQ0+Fx5me5rHz+N0b3IygMusD1p4LK2vo 2wCaSIiiRj3TSPI="
},
{
"Name": "X-Google-Smtp-Source",
"Value": "ABdhPJxt2cjGasXedys/7YIhFDpikc1Oe7q7pymfmO1FnrlAQzcGBOvRCscez5u8vFOhQmscY71F4S4="
},
{
"Name": "MIME-Version",
"Value": "1.0"
},
{
"Name": "X-Received",
"Value": "by 2002:a92:da0e:: with SMTP id z14mr2271398ilm.151.1602751101999; Thu, 15 Oct 2020 01:38:21 -0700 (PDT)"
},
{
"Name": "Date",
"Value": "Thu, 15 Oct 2020 01:38:21 -0700"
},
{
"Name": "Reply-To",
"Value": "The G Suite Team <gsuite-noreply@google.com>"
},
{
"Name": "X-Google-Id",
"Value": "253939"
},
{
"Name": "Feedback-ID",
"Value": "P-10-0:C20060867:M110136315-en:gamma"
},
{
"Name": "X-Notifications",
"Value": "GAMMA:<9e4ee645a2583b0ee9630a0b49b0637eab983a45-20060867-110354355@google.com>"
},
{
"Name": "Message-ID",
"Value": "<9e4ee645a2583b0ee9630a0b49b0637eab983a45-20060867-110354355@google.com>"
},
{
"Name": "Subject",
"Value": "Your G Suite data transfer was successful for newaccount newdemo to drive activity"
},
{
"Name": "From",
"Value": "The G Suite Team <gsuite-noreply@google.com>"
},
{
"Name": "To",
"Value": "driveactivity@domain.io"
},
{
"Name": "Content-Type",
"Value": "multipart/alternative; boundary=\"000000000000191c3505b1b1924e\""
}
],
"Html": "<div>\r\n <meta http-equiv=Content-Type content=\"text/html; charset=utf-8\">\r\n <meta name=viewport content=width=device-width>\r\n <style>@media only screen{html{min-height:100%;background:#fafafa}}@media only screen and (max-width:640px){.small-float-center{margin:0 auto!important;float:none!important;text-align:center!important}}@media only screen and (max-width:640px){table.body img{width:auto;height:auto}table.body center{min-width:0!important}table.body .container{width:344px!important}table.body .columns{height:auto!important;-moz-box-sizing:border-box;-webkit-box-sizing:border-box;box-sizing:border-box;padding-left:40px!important;padding-right:40px!important}table.body .columns .columns{padding-left:0!important;padding-right:0!important}table.body .collapse .columns{padding-left:0!important;padding-right:0!important}th.small-1{display:inline-block!important;width:8.33333%!important}th.small-3{display:inline-block!important;width:25%!important}th.small-4{display:inline-block!important;width:33.33333%!important}th.small-6{display:inline-block!important;width:50%!important}th.small-8{display:inline-block!important;width:66.66667%!important}th.small-9{display:inline-block!important;width:75%!important}th.small-12{display:inline-block!important;width:100%!important}.columns th.small-12{display:block!important;width:100%!important}table.menu{width:100%!important}table.menu td,table.menu th{width:auto!important;display:inline-block!important}table.menu.vertical td,table.menu.vertical th{display:block!important}table.menu[align=center]{width:auto!important}}</style>\r\n <span class=preheader style=color:#fafafa;display:none!important;font-size:1px;line-height:1px;max-height:0;max-width:0;mso-hide:all!important;opacity:0;overflow:hidden;visibility:hidden></span>\r\n <table class=body style=Margin:0;background:#F8F9FA!important;border-collapse:collapse;border-spacing:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;height:100%;line-height:inherit;margin:0;padding:0;vertical-align:top;width:100%;text-align:left>\r\n <tr style=padding:0;vertical-align:top>\r\n <td class=center align=center valign=top style=-moz-hyphens:none;-webkit-hyphens:none;Margin:0;border-collapse:collapse!important;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;hyphens:none;line-height:inherit;margin:0;padding:0;vertical-align:top;word-wrap:keep-all>\r\n <center data-parsed=\"\" style=min-width:600px;width:100%>\r\n\r\n <table align=center class=\"container float-center\" style=\"Margin:0 auto;background:#fafafa;border-collapse:collapse;border-spacing:0;float:none;margin:0 auto;padding:0;text-align:left;vertical-align:top;width:600px\"><tbody><tr style=padding:0;vertical-align:top><td style=-moz-hyphens:none;-webkit-hyphens:none;Margin:0;border-collapse:collapse!important;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;hyphens:none;line-height:inherit;margin:0;padding:0;vertical-align:top;word-wrap:keep-all>\r\n <table class=\"row header\" style=background:#F8F9FA;border-collapse:collapse;border-spacing:0;display:table;font-size:12px;padding:0;position:relative;vertical-align:top;width:100%><tbody><tr style=padding:0;vertical-align:top>\r\n <th class=\"small-12 large-12 columns first last\" style=\"Margin:0 auto;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0 auto;padding:0;padding-bottom:24px;padding-left:40px;padding-right:40px;padding-top:12px;width:560px\"><table style=border-collapse:collapse;border-spacing:0;margin-bottom:0;padding:0;vertical-align:top;width:100%><tr style=padding:0;vertical-align:top><th style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0;text-align:left>\r\n\r\n <img src=https://storage.googleapis.com/support-kms-prod/BfxWlTCe6OCizPoUdUCwDz979TQRdnVdSMCG alt=\"G Suite\" height=30 style=-ms-interpolation-mode:bicubic;clear:both;display:block;margin-top:24px;max-height:30px;max-width:100%;outline:0;text-decoration:none;width:auto>\r\n\r\n </th>\r\n<th class=expander style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0!important;visibility:hidden;width:0></th></tr></table></th>\r\n </tr></tbody></table>\r\n\r\n <table class=\"row info\" style=align-items:center;background:#fff;border-collapse:collapse;border-color:#E8EAED;border-spacing:0;border-style:solid;border-width:1px;display:table;padding:0;position:relative;vertical-align:top;width:100%><tbody><tr style=padding:0;vertical-align:top>\r\n <th class=\"small-12 large-12 columns first last\" style=\"Margin:0 auto;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0 auto;padding:0;padding-bottom:0;padding-left:40px;padding-right:40px;width:560px\"><table style=border-collapse:collapse;border-spacing:0;padding:0;vertical-align:top;width:100%><tr style=padding:0;vertical-align:top><th style=\"Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0 0 24px;text-align:left\">\r\n <p style=Margin:0;Margin-bottom:16px;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:24px;margin:0;margin-bottom:16px;margin-top:24px;padding:0>Hello Admin,</p>\r\n\r\n<p style=Margin:0;Margin-bottom:16px;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:24px;margin:0;margin-bottom:16px;padding:0>G Suite recently processed a request from user test (user@domain.io) to transfer data for newaccount newdemo (demo@domain.io) to drive activity (driveactivity@domain.io).</p>\r\n\r\n<p style=Margin:0;Margin-bottom:16px;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:24px;margin:0;margin-bottom:16px;padding:0>The data transfer was successful.</p>\r\n\r\n<p style=\"margin-top:8px;color:#3C4043;font-family:Google Sans,Helvetica,Arial,sans-serif;font-size:14px;font-weight:700;line-height:24px;margin:0;margin-bottom:0px;padding:0\">Sincerely,</p>\r\n\r\n<p style=\"Margin:0;color:#3C4043;font-family:Google Sans,Helvetica,Arial,sans-serif;font-size:14px;font-weight:700;line-height:24px;margin:0;margin-bottom:0;padding:0\">The G Suite Team</p>\r\n </th></tr></table></th>\r\n </tr></tbody></table>\r\n\r\n <table class=\"row footer\" style=background:#F8F9FA;border-collapse:collapse;border-spacing:0;display:table;margin-top:0;padding:0;position:relative;vertical-align:top;width:100%><tbody><tr style=padding:0;vertical-align:top>\r\n <th class=\"small-12 large-12 columns first last\" style=\"Margin:0 auto;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0 auto;padding:0;padding-bottom:0;padding-left:40px;padding-right:40px;width:560px\"><table style=border-collapse:collapse;border-spacing:0;padding:0;vertical-align:top;width:100%><tr style=padding:0;vertical-align:top><th style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:24px;text-align:left>\r\n\r\n <img src=https://storage.googleapis.com/support-kms-prod/Yd1rPlunjtOKzNDXcw3eFmVCjI828xhBZqQy alt=\"Google Cloud\" height=30 style=-ms-interpolation-mode:bicubic;clear:both;display:block;margin-bottom:14px;max-width:100%;max-height:30px;outline:0;text-decoration:none;width:auto>\r\n <p style=Margin:0;Margin-bottom:16px;color:#6C737F;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:12px;font-weight:400;line-height:16px;margin:0;margin-bottom:14px;padding:0>\r\n \u00a9 2020 Google LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043\r\n </p>\r\n <p style=Margin:0;Margin-bottom:16px;color:#6C737F;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:12px;font-weight:400;line-height:16px;margin:0;margin-bottom:14px;padding:0>\r\n <em>You\u2019re receiving this mandatory email service announcement to update you about important changes to your Google Cloud product or account.</em>\r\n </p>\r\n </th>\r\n<th class=expander style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0!important;visibility:hidden;width:0></th></tr></table></th>\r\n </tr></tbody></table>\r\n </td></tr></tbody></table>\r\n\r\n </center>\r\n </td>\r\n </tr>\r\n </table>\r\n <!-- prevent Gmail on iOS font size manipulation -->\r\n <div style=\"display:none;white-space:nowrap;font:15px courier;line-height:0\"> </div>\r\n \r\n</div>\r\n",
"ID": "1752b68ff72484b5",
"Labels": "UNREAD, CATEGORY_UPDATES, INBOX",
"Mailbox": "driveactivity@domain.io",
"RawData": null,
"Subject": "Your G Suite data transfer was successful for newaccount newdemo to drive activity",
"ThreadId": "1752b68ff72484b5",
"To": "driveactivity@domain.io",
"Type": "Gmail"
},
{
"Attachment Names": "",
"Attachments": [],
"Bcc": [],
"Body": "",
"Cc": [],
"Date": "Thu, 24 Sep 2020 07:12:50 -0700",
"Format": "multipart/alternative",
"From": "\"user test (Google Docs)\" <comments-noreply@docs.google.com>",
"Headers": [
{
"Name": "Delivered-To",
"Value": "fetch.incident@domain.io"
},
{
"Name": "Received",
"Value": "by 2002:a05:6838:9584:0:0:0:0 with SMTP id c4csp253820nkl; Thu, 24 Sep 2020 07:12:51 -0700 (PDT)"
},
{
"Name": "X-Received",
"Value": "by 2002:a92:50c:: with SMTP id q12mr4112900ile.8.1600956771319; Thu, 24 Sep 2020 07:12:51 -0700 (PDT)"
},
{
"Name": "ARC-Seal",
"Value": "i=1; a=rsa-sha256; t=1600956771; cv=none; d=google.com; s=arc-20160816; b=jT+v3caRre/FCSucP/0amYmpvCDb6Dymbyubsmdf2lW4OIUnIW+3uLgQQDqo+xvU2a qpzB7tqAvnIMloOmNM5/eN6Ti7OKivN8IYcPkjZR2AOqbjQUh11Iu5VMr5Y6LCU5Y0I4 WU6NloBklndcc6ApS+P0sAeQr3lhWFUfg6np4YRDuser69kP+DtbJMSedYNZSh3Ld75tzB DV/tESJxDplDEmRG3EfmsP+gKa3ljZNsnO+09Q/VjaTDQnnf2j81NV2Myj7N6Zc0FC7C 4DWWfRe54hVO6KL4HwjJHba8gW5FcNfcmRgTrh4GDTNOujkMp2ECrCWkSM1U6mAwqHdA NEcg=="
},
{
"Name": "ARC-Message-Signature",
"Value": "i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=to:from:subject:message-id:reply-to:references:date:mime-version :userim-signature; bh=x0pLwDJClo0r0sf+s+oGS8AWH89omey8uCtXKLZYF7A=; b=UoH7msRXiYvLYq7zXZ9wS85dWmSibZAflIypey423O8jkg3BE9a4wKl0cUuspHng7J IkyqN1X+1I0oBN2BqbZ3o4ec/rVgF9EevqDC551js7GdvqMV+ISnpNWBVAi6nk534ZqZ ll1X8nGNcVkINc0NTZRZNcsuEH1EYGn+KQIjxcItWVaVb3dHXzG+az5EtUmytbF7J6B3 GE1IHZ+XM9L4dIskeqRWS3Il8MxkDm4oPj4OIUQRu9WvoCA69BF5fpU3becRpyYugKNI BHo7ncAql7PKyP+bC40YZxzIWNptC6gAFpt5kX4T7NRtUyJXpfcGS8AsmAHsMCmYZsZ5 QTtQ=="
},
{
"Name": "ARC-Authentication-Results",
"Value": "i=1; mx.google.com; userim=pass header.i=@docs.google.com header.s=20161025 header.b=TvrL8Xc1; spf=pass (google.com: domain of 3yqlsxxapagkjvttluaz-uvylwsfkvjz.nvvnsl.jvt@docos.bounces.google.com designates 209.85.220.69 as permitted sender) smtp.mailfrom=3YqlsXxAPAGkJVTTLUaZ-UVYLWSfKVJZ.NVVNSL.JVT@docos.bounces.google.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=docs.google.com"
},
{
"Name": "Return-Path",
"Value": "<3YqlsXxAPAGkJVTTLUaZ-UVYLWSfKVJZ.NVVNSL.JVT@docos.bounces.google.com>"
},
{
"Name": "Received",
"Value": "from mail-sor-f69.google.com (mail-sor-f69.google.com. [209.85.220.69]) by mx.google.com with SMTPS id u4sor1831509iol.95.2020.09.24.07.12.51 for <fetch.incident@domain.io> (Google Transport Security); Thu, 24 Sep 2020 07:12:51 -0700 (PDT)"
},
{
"Name": "Received-SPF",
"Value": "pass (google.com: domain of 3yqlsxxapagkjvttluaz-uvylwsfkvjz.nvvnsl.jvt@docos.bounces.google.com designates 209.85.220.69 as permitted sender) client-ip=209.85.220.69;"
},
{
"Name": "Authentication-Results",
"Value": "mx.google.com; userim=pass header.i=@docs.google.com header.s=20161025 header.b=TvrL8Xc1; spf=pass (google.com: domain of 3yqlsxxapagkjvttluaz-uvylwsfkvjz.nvvnsl.jvt@docos.bounces.google.com designates 209.85.220.69 as permitted sender) smtp.mailfrom=3YqlsXxAPAGkJVTTLUaZ-UVYLWSfKVJZ.NVVNSL.JVT@docos.bounces.google.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=docs.google.com"
},
{
"Name": "userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=docs.google.com; s=20161025; h=mime-version:date:references:reply-to:message-id:subject:from:to; bh=x0pLwDJClo0r0sf+s+oGS8AWH89omey8uCtXKLZYF7A=; b=TvrL8Xc1Nnr3juYF8B5WATxy5GUXO7VRjMYhvfQP73/vqUwvu1+dIVsVW/5U7MBEA6 sa6gmrXWb1YlfVDlKH7ibhdjrrZ8xamQSDIWmnx7GRWrGVqA6YG1Iw5h4UMSnQQ4Dpmh bUigcljeFP7jeJ6aSMAeCzU7e7eAMe5yPjJiaDwl+BQosO5sxnijDmDMcZlOyrgiTbny sTBMfc6/TwnCYtMrHJtY3JDlDTy+OJr1TBAqteKMU26/3fteRRA1rtfT1bbkQ4dYFOHb 7EimtSewbCR+83qYF7hZXYufuG6yyrwqv6SG4RqrvRczr/l4G1Z6vaMRlB+XSo8c2IpJ zYQQ=="
},
{
"Name": "X-Google-userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:date:references:reply-to:message-id :subject:from:to; bh=x0pLwDJClo0r0sf+s+oGS8AWH89omey8uCtXKLZYF7A=; b=tlnmXMXisPQ/aFvEkaA8UnaCwT6Xbxsd9F71mWlwYGd42IHPntJsnIJ+DigBaEX7XR a0IU0jVNFOdcsH7qNh7A/okFiORzWZrbCu17tWQ2ly32MREUZbOkZK/0vbARsOGCvdM5 fS+5Y78ukh8vPtKGgsUDJ9ups5oaD0J+Ifoy3q3BBHj9rdlwYOKzc3wFmWyjGh//9w87 R+Wfo+ScGKTdEkE9InDJ6UTQmH+sMwBKOZ+ISJx4nkPMEwt49+HzoLYZu2tIshzP2LPz bVMKuALH9VvBQw/DEM0x2VDbapMtVSYhrH9eBhZ7oIuEx4ZGY83tiCai5vYd/Dcl+njx DbZQ=="
},
{
"Name": "X-Gm-Message-State",
"Value": "AOAM5336PTxhFmQv6Q0A7P5iPi434E4lBZmpgJ5iGt5T1O0woubNNLCU zGuhdc+7ow=="
},
{
"Name": "X-Google-Smtp-Source",
"Value": "ABdhPJw2wbVdvuQ1YBp06PF5N0Qa0xRT4L5lzqUHEV+akfyQaO9UO1MOF5mKgtaSli8kmBAToA=="
},
{
"Name": "MIME-Version",
"Value": "1.0"
},
{
"Name": "X-Received",
"Value": "by 2002:a6b:c9d3:: with SMTP id z202mr3546946iof.156.1600956770697; Thu, 24 Sep 2020 07:12:50 -0700 (PDT)"
},
{
"Name": "Date",
"Value": "Thu, 24 Sep 2020 07:12:50 -0700"
},
{
"Name": "X-Document-ID",
"Value": "swjGHIhOPTvavMP196F2nng"
},
{
"Name": "References",
"Value": "<d+c3dqR0hJaE9QVHZhuser1QMTk2RjJubmc6@docs.google.com>"
},
{
"Name": "X-No-Auto-Attachment",
"Value": "1"
},
{
"Name": "Reply-to",
"Value": "No Reply <d+noreply@docs.google.com>"
},
{
"Name": "X-Notifications",
"Value": "839f5e45fd400000"
},
{
"Name": "Message-ID",
"Value": "<4qBWvAEfST34kWEvZqvMDA.0@notifications.google.com>"
},
{
"Name": "Subject",
"Value": "new"
},
{
"Name": "From",
"Value": "\"user test (Google Docs)\" <comments-noreply@docs.google.com>"
},
{
"Name": "To",
"Value": "fetch.incident@domain.io"
},
{
"Name": "Content-Type",
"Value": "multipart/alternative; boundary=\"0000000000009e41cc05b00fcb99\""
}
],
"Html": "<div itemscope itemtype=\"http://schema.org/EmailMessage\" style=\"font: 14px Roboto, sans-serif;\"><div itemprop=\"about\" itemscope itemtype=\"http://schema.org/CreativeWork\"><meta itemprop=\"name\" content=\"new\"><meta itemprop=\"url\" content=\"https://docs.google.com/document/d/1Ypfuu-n5CiaL4aNFpxei7kADN9m5iTj_VN7KKxg3Yt8/edit?disco=AAAAG_oiO_c&ts=5f6ca962&usp=comment_email_document\"><div style=\"width: 100%; padding: 24px 0 16px 0; background-color: white; text-align: center;\"><div style=\"display: inline-block; width: 90%; max-width: 700px;min-width: 280px; text-align: left; font-family: Roboto,Arial,Helvetica,sans-serif;\"><div style=\"border: 1px solid #dadce0; border-radius: 8px;\"><div style=\"padding: 4.5%;\" dir=\"ltr\"><h1 style=\"display: block; font: 400 18px "Google Sans", Roboto, sans-serif; color: #3c4043; margin: 0;\">user test added action items to the following document</h1><a href=\"https://docs.google.com/document/d/1Ypfuu-n5CiaL4aNFpxei7kADN9m5iTj_VN7KKxg3Yt8/edit?disco=AAAAG_oiO_c&ts=5f6ca962&usp=comment_email_document&usp_dm=false\" target=\"_blank\" style=\"border: 1px solid #dadce0; border-radius: 16px; color: #3c4043; display: inline-block; max-width: 100%; text-decoration: none; vertical-align: top;margin-top:12px;\"><div style=\"line-height: 18px; overflow: hidden; padding: 6px 12px; text-overflow: ellipsis; white-space: nowrap;\"><div style=\"display: inline-block; vertical-align: top; width: 26px;\"><img src=\"https://ssl.gstatic.com/docs/doclist/images/mediatype/icon_1_document_x64.png\" width=\"18px\" height=\"18px\" style=\"vertical-align: top;\" role=\"presentation\"></div><div style=\"display: inline; font: 500 14px/18px "Google Sans", Roboto, sans-serif; letter-spacing: 0.2px;\">new</div></div></a><div style=\"margin: 18px 0; height: 1px; background-color: #eee;\"></div><table role=\"presentation\" cellpadding=\"0\" cellspacing=\"0\" style=\"display: table; width: 100%;\"><tr><td style=\"display: table-cell; padding-right: 12.5px; vertical-align: middle;\"><table role=\"presentation\" cellpadding=\"0\" cellspacing=\"0\"><tr><td><strong style=\"display: inline-block; font: 500 14px Roboto, sans-serif; margin: 0; line-height: 20px; letter-spacing: .25px; color: #3c4043;\">New</strong></td></tr><tr><td height=\"4\" style=\"height: 4px;\" colspan=\"0\"></td></tr><tr><td><span style=\"font: 400 14px Roboto, sans-serif; line-height: 20px; letter-spacing: .2px;color: #3c4043;\">1 action item</span></td></tr></table></td><td style=\"display: table-cell; width: 50%; padding-left: 12.5px; vertical-align: middle;\"><table role=\"presentation\" cellpadding=\"0\" cellspacing=\"0\"><tr><td><strong style=\"display: inline-block; font: 500 14px Roboto, sans-serif; margin: 0; line-height: 20px; letter-spacing: .25px; color: #3c4043;\">Resolved</strong></td></tr><tr><td height=\"4\" style=\"height: 4px;\" colspan=\"0\"></td></tr><tr><td><span style=\"font: 400 14px Roboto, sans-serif; line-height: 20px; letter-spacing: .2px;color: #3c4043;\">1 action item</span></td></tr></table></td></tr></table></div></div><div style=\"height: 14px;\"></div><div style=\"border: 1px solid #dadce0; border-radius: 8px;\"><div style=\"padding: 4.5%;\" dir=\"ltr\"><h2 style=\"display: block; font: 400 18px "Google Sans", Roboto, sans-serif; color: #3c4043; margin: 0;\">Action Items</h2><div itemprop=\"action\" itemscope itemtype=\"http://schema.org/ViewAction\"><meta itemprop=\"url\" content=\"https://docs.google.com/document/d/1Ypfuu-n5CiaL4aNFpxei7kADN9m5iTj_VN7KKxg3Yt8/edit?disco=AAAAG_oiO_c&usp=todo_email_discussion&ts=5f6ca962\"><meta itemprop=\"name\" content=\"Open Discussion\"></div><div style=\"margin: 18px 0; height: 1px; background-color: #eee;\"></div><div style=\"overflow: visible; line-height: 20px;\"><div class=\"discussion-post-quote\" style=\"padding: 7px 12px; box-shadow: 0 1px 2px 0 rgba(60,64,67,0.302), 0 2px 6px 2px rgba(60,64,67,0.149); border: 1px solid #d3d3d3; border-radius: 8px; overflow-wrap: break-word; word-break: break-word;\"><span class=\"notranslate\" style=\"font: 400 14px Roboto, sans-serif; line-height: 20px; color: #3c4043;\">hnew</span></div><div style=\"margin-top: 18px; word-break: break-word; word-wrap: break-word;\"><table role=\"presentation\" cellpadding=\"0\" cellspacing=\"0\" style=\"width: 100%;color: #3c4043;\"><tr><td style=\"vertical-align: top; width: 44px;\"><img src=\"https://lh5.googleusercontent.com/-waX5OXEmoIk/AAAAAAAAAAI/AAAAAAAAAAA/AMZuucnDiJqGBkcIhHyvMjNr8MBNnuoruQ/s50-c-k-no/photo.jpg\" style=\"border-radius: 50%; display: block;\" alt=\"User profile picture user test\" height=\"32\" width=\"32\"></td><td><h3 style=\"display: inline-block; font: 500 14px "Google Sans", Roboto, sans-serif;; letter-spacing: .25px; line-height: 20px; margin: 6px 0 2px 0;\">user test</h3><h4 style=\"background: #1a73e8; border-radius: 8px; color: #fff; display: inline-block; font: 700 12px/16px Roboto, sans-serif; margin-bottom: 0; margin-top: 0; margin-left: 10px; padding: 0 6px;\">New</h4><div style=\"font: 400 14px Roboto, sans-serif; line-height: 20px; letter-spacing: .2px;\"><div style=\"margin-top: 6px;\" class=\"notranslate\">@<a href=\"mailto:fetch.incident@domain.io\" target=\"_blank\">fetch.incident@domain.io</a></div><div style=\"margin-top: 6px;\"><i>Assigned to you</i></div></div></td></tr></table></div><div style=\"margin: 10px 0 0 42px; overflow: auto; padding: 2px;\"><a href=\"mailTo:Reply%20%3Cd+AORGpRf_-QR4xJegmzFioLY6Vi6pCm2VPeUhGVVZwUXxo6t-YSq8mhF5l27hisc-WQFGG0LoTTTXNqustHfQzQqvgvTP_3GM26OM33NYLUPPtPpCbTj5oGkieqpNCYfWw-NYlyApNPYY@docs.google.com%3E?subject=new\" class=\"material-button material-button-transparent\" target=\"_blank\" tabindex=\"0\" role=\"button\" style=\"padding: 0 8px;border: none; border-radius: 4px; box-sizing: border-box; display: inline-block; font: 500 14px "Google Sans", Roboto, sans-serif; letter-spacing: .25px; line-height: 36px; min-height: 36px; text-align: center; text-decoration: none;background-color: transparent; color: #1a73e8; cursor: pointer;margin-right: 12px;\">Reply</a><a href=\"https://docs.google.com/document/d/1Ypfuu-n5CiaL4aNFpxei7kADN9m5iTj_VN7KKxg3Yt8/edit?disco=AAAAG_oiO_c&usp=todo_email_discussion&usp_dm=false&ts=5f6ca962\" class=\"material-button material-button-transparent\" target=\"_blank\" tabindex=\"0\" role=\"button\" style=\"padding: 0 8px;border: none; border-radius: 4px; box-sizing: border-box; display: inline-block; font: 500 14px "Google Sans", Roboto, sans-serif; letter-spacing: .25px; line-height: 36px; min-height: 36px; text-align: center; text-decoration: none;background-color: transparent; color: #1a73e8; cursor: pointer;float: right;\">Open</a></div></div></div></div><div style=\"height: 14px;\"></div><div style=\"border: 1px solid #dadce0; border-radius: 8px;\"><div style=\"padding: 4.5%;\" dir=\"ltr\"><h2 style=\"font: normal 24px "Google Sans", Roboto, sans-serif; line-height: 32px; color: #3c4043; margin: 0 0 18px 0;\">Resolved</h2><h2 style=\"display: block; font: 400 18px "Google Sans", Roboto, sans-serif; color: #3c4043; margin: 0;\">Action Items</h2><div itemprop=\"action\" itemscope itemtype=\"http://schema.org/ViewAction\"><meta itemprop=\"url\" content=\"https://docs.google.com/document/d/1Ypfuu-n5CiaL4aNFpxei7kADN9m5iTj_VN7KKxg3Yt8/edit?disco=AAAAG_oiO9Y&usp=todo_email_discussion&ts=5f6ca962\"><meta itemprop=\"name\" content=\"Open Discussion\"></div><div style=\"margin: 18px 0; height: 1px; background-color: #eee;\"></div><div style=\"overflow: visible; line-height: 20px;\"><div class=\"discussion-post-quote\" style=\"padding: 7px 12px; box-shadow: 0 1px 2px 0 rgba(60,64,67,0.302), 0 2px 6px 2px rgba(60,64,67,0.149); border: 1px solid #d3d3d3; border-radius: 8px; overflow-wrap: break-word; word-break: break-word;\"><span class=\"notranslate\" style=\"font: 400 14px Roboto, sans-serif; line-height: 20px; color: #3c4043;\">hnew</span></div><div style=\"margin-top: 18px; word-break: break-word; word-wrap: break-word;\"><table role=\"presentation\" cellpadding=\"0\" cellspacing=\"0\" style=\"width: 100%;color: #777777;\"><tr><td style=\"vertical-align: top; width: 44px;\"><img src=\"https://lh5.googleusercontent.com/-waX5OXEmoIk/AAAAAAAAAAI/AAAAAAAAAAA/AMZuucnDiJqGBkcIhHyvMjNr8MBNnuoruQ/s50-c-k-no/photo.jpg\" style=\"border-radius: 50%; display: block;\" alt=\"User profile picture user test\" height=\"32\" width=\"32\"></td><td><h3 style=\"display: inline-block; font: 500 14px "Google Sans", Roboto, sans-serif;; letter-spacing: .25px; line-height: 20px; margin: 6px 0 2px 0;\">user test</h3><div style=\"font: 400 14px Roboto, sans-serif; line-height: 20px; letter-spacing: .2px;\"><div style=\"margin-top: 6px;\" class=\"notranslate\">@<a href=\"mailto:fetch.incident@domain.io\" target=\"_blank\">fetch.incident@domain.io</a><br>@<a href=\"mailto:fetch.incident@domain.io\" target=\"_blank\">fetch.incident@domain.io</a><br>@<a href=\"mailto:user@domain.com\" target=\"_blank\">user@domain.com</a></div><div style=\"margin-top: 6px;\"><i>Assigned to you</i></div></div></td></tr></table></div><div style=\"margin-top: 12px; word-break: break-word; word-wrap: break-word;\"><table role=\"presentation\" cellpadding=\"0\" cellspacing=\"0\" style=\"width: 100%;color: #3c4043;\"><tr><td style=\"vertical-align: top; width: 44px;\"><img src=\"https://lh5.googleusercontent.com/-waX5OXEmoIk/AAAAAAAAAAI/AAAAAAAAAAA/AMZuucnDiJqGBkcIhHyvMjNr8MBNnuoruQ/s50-c-k-no/photo.jpg\" style=\"border-radius: 50%; display: block;\" alt=\"User profile picture user test\" height=\"32\" width=\"32\"></td><td><h3 style=\"display: inline-block; font: 500 14px "Google Sans", Roboto, sans-serif;; letter-spacing: .25px; line-height: 20px; margin: 6px 0 2px 0;\">user test</h3><h4 style=\"background: #1a73e8; border-radius: 8px; color: #fff; display: inline-block; font: 700 12px/16px Roboto, sans-serif; margin-bottom: 0; margin-top: 0; margin-left: 10px; padding: 0 6px;\">New</h4><div style=\"font: 400 14px Roboto, sans-serif; line-height: 20px; letter-spacing: .2px;\"><div style=\"margin-top: 6px;\"><i>Marked as done</i></div></div></td></tr></table></div><div style=\"margin: 10px 0 0 42px; overflow: auto; padding: 2px;\"><a href=\"mailTo:Reply%20%3Cd+AORGpRc-nSlkzua0b9Nh7qVGzfOQP_z4ACBToeN83vCrfpYneGYzq6qgR3pKbX0WEaONjmwvB33fVWYxlXgRsd74SC_SzP7CbCzfy6xYvanQ5FHUetSATXkhNig_3W-tWncMELIY_tQ0@docs.google.com%3E?subject=new\" class=\"material-button material-button-transparent\" target=\"_blank\" tabindex=\"0\" role=\"button\" style=\"padding: 0 8px;border: none; border-radius: 4px; box-sizing: border-box; display: inline-block; font: 500 14px "Google Sans", Roboto, sans-serif; letter-spacing: .25px; line-height: 36px; min-height: 36px; text-align: center; text-decoration: none;background-color: transparent; color: #1a73e8; cursor: pointer;margin-right: 12px;\">Reply</a><a href=\"https://docs.google.com/document/d/1Ypfuu-n5CiaL4aNFpxei7kADN9m5iTj_VN7KKxg3Yt8/edit?disco=AAAAG_oiO9Y&usp=todo_email_discussion&usp_dm=false&ts=5f6ca962\" class=\"material-button material-button-transparent\" target=\"_blank\" tabindex=\"0\" role=\"button\" style=\"padding: 0 8px;border: none; border-radius: 4px; box-sizing: border-box; display: inline-block; font: 500 14px "Google Sans", Roboto, sans-serif; letter-spacing: .25px; line-height: 36px; min-height: 36px; text-align: center; text-decoration: none;background-color: transparent; color: #1a73e8; cursor: pointer;float: right;\">Open</a></div></div></div></div><table style=\"padding: 14px 10px 0 10px;\" role=\"presentation\" dir=\"ltr\"><tr><td style=\"width: 100%; font: 12px Roboto,Arial,Helvetica,sans-serif; color:#5f6368; line-height: 16px; min-height: 40px; letter-spacing: .3px; vertical-align: middle;\"><p style=\"margin: 0; padding: 0;\"><span style=\"padding-right: 5px;\">Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA</span><br><br><span style=\"padding-right: 5px;\">You have received this email because you are a participant in the updated discussion threads.</span><span style=\"padding-right: 5px;\"><a href=\"https://docs.google.com/document/u/113716761692464219843/docos/notify?id=1Ypfuu-n5CiaL4aNFpxei7kADN9m5iTj_VN7KKxg3Yt8&title=new\" target=\"_blank\" style=\"color: #4285f4; text-decoration: none;\">Change what Google Docs sends you.</a></span><span>You can not reply to this email.</span></p></td><td style=\"padding-left: 20px; vertical-align: middle;\"><img src=\"https://www.gstatic.com/images/branding/googlelogo/2x/googlelogo_tm_black54_color_96x40dp.png\" width=\"96px\" height=\"40px\" style=\"vertical-align: middle; margin-left: 22px;\"></td></tr></table></div></div></div></div>",
"ID": "174c075abaceb067",
"Labels": "UNREAD, CATEGORY_UPDATES, INBOX",
"Mailbox": "fetch.incident@domain.io",
"RawData": null,
"Subject": "new",
"ThreadId": "174bf91ce512c701",
"To": "fetch.incident@domain.io",
"Type": "Gmail"
},
{
"Attachment Names": "CDS 20-21-10.pdf",
"Attachments": [
{
"ID": "ANGjdJ-ouHq_KlVLgJoSGV8JCzi7p8yTraIHdEN9U2vAn4ThttcfqKgoTnglqMJ-luf6w55S-m5IzIBdINW35eq4N1uCHQCk_az3jjLucyKgv2u6_jibEcNi_ck47swLacuwrrG2atszDoKwM9KJ0jUovnBDO6hTg1LrT4sb-T677zO_yMxNgWuHwnxRUDN_a2OIRM9c7hoDOkZlU3fXzWAxjFmbIzLroqaHLTnmvrm7pmes-jyQFh1MZZzLvu9yyBkOIKanoJnYW7Mt6G7ysuFruDxcnE7wiX8BtLpIP3qgaSZcA25aNRbuqiVIj5eL05FDwezy3QmwdhjKdOgmmPApMRCLQ9bUrHlHZW09zcExUmPYZFJWbzWktiSYxOWu7aYr1bKZsfWLNkEtE7RK",
"Name": "CDS 20-21-10.pdf"
}
],
"Bcc": [],
"Body": "Hi user,\r\n\r\nPlease find the attached Invoice for payment.\r\n",
"Cc": [],
"Date": "Wed, 28 Oct 2020 10:44:36 +0530",
"Format": "multipart/mixed",
"From": "user test",
"Headers": [
{
"Name": "Delivered-To",
"Value": "user@domain.io"
},
{
"Name": "Received",
"Value": "by 2002:ac8:5045:0:0:0:0:0 with SMTP id h5csp227879qtm; Tue, 27 Oct 2020 22:14:48 -0700 (PDT)"
},
{
"Name": "X-Received",
"Value": "by 2002:adf:fc0d:: with SMTP id i13mr6693362wrr.156.1603862088572; Tue, 27 Oct 2020 22:14:48 -0700 (PDT)"
},
{
"Name": "ARC-Seal",
"Value": "i=1; a=rsa-sha256; t=1603862088; cv=none; d=google.com; s=arc-20160816; b=0AxbJ1pD/Rwz4MVZY+ZIxFmKOKhnAmcfEJxsZILtT7FBat7yzLwU5uAvXkF2nrk3m7 Uk5HYWpacr8/QLuZZ5lhFZYgttgZGW+AvgGDPcTGfoVygGgSJhKomlDuQ47kWs7acDxV dIRR72Qz5DctXsP9RLdrn0QibbyEjyWuHzyN+kczKJ/dDNXBVUBsi8iX9yG4PRkM0PVe syNBYD7YDvQqKgRZ9VOTtoRdYmrASmiZ+22CmOZ6S1ESV+04iuYwmqhLAp0/LBXC0c2T 4xpwcpH9mQzeRUBHqM6lDz14q7qOrPpERWYS4U0dR3U597mShq43Lwe0UFKCfkHsn942 CNFA=="
},
{
"Name": "ARC-Message-Signature",
"Value": "i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=to:subject:message-id:date:from:mime-version:userim-signature; bh=euBan4jEQqeDOU1gQty+R/vibmOWoysN/1z/y/FRJsk=; b=I995G/GW0uvXaHGu2e1N73XBtrAXs16vXRrtuE5wFhaan5qW1fE30mTC3wzre2jp1A 46rhac7VBeL+HN/3EpqZ9Ur1B2kIvL3CqSJPBBfsvi6bhfHKdQXflSFlPbezojCHEcx6 jGkHbc+fQx+lCLbdXn/JKAWouFcbxEn7A8NlYRdq9htiAEZzoS5cjs4lNX8VMh77PgeL 8lTbbUtZG0foZCIPXnWucyivI35co8PQ3MUdZJ9xarvUb+eSMoWiQlV6V165+uYVMRdy 9GnMulD+KfPa9whuG+re/zgUAYJD0A6762DVO9NS9wpVSnlEcgo30nF8P9uETzFo3Nzu MCJw=="
},
{
"Name": "ARC-Authentication-Results",
"Value": "i=1; mx.google.com; userim=pass header.i=@domain-com.20150623.gappssmtp.com header.s=20150623 header.b=sr3o+AEJ; spf=pass (google.com: domain of domain@domain.io designates 209.85.220.41 as permitted sender) smtp.mailfrom=domain@domain.io"
},
{
"Name": "Return-Path",
"Value": "<domain@domain.io>"
},
{
"Name": "Received",
"Value": "from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41]) by mx.google.com with SMTPS id x16sor2141465wmc.14.2020.10.27.22.14.47 for <user@domain.io> (Google Transport Security); Tue, 27 Oct 2020 22:14:48 -0700 (PDT)"
},
{
"Name": "Received-SPF",
"Value": "pass (google.com: domain of domain@domain.io designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41;"
},
{
"Name": "Authentication-Results",
"Value": "mx.google.com; userim=pass header.i=@domain-com.20150623.gappssmtp.com header.s=20150623 header.b=sr3o+AEJ; spf=pass (google.com: domain of domain@domain.io designates 209.85.220.41 as permitted sender) smtp.mailfrom=domain@domain.io"
},
{
"Name": "userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=domain-com.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=euBan4jEQqeDOU1gQty+R/vibmOWoysN/1z/y/FRJsk=; b=sr3o+AEJT0+acrlhSPeAViSkcAONL35nUE5EMEKG2IA9lnM+toPS2PpzvCCwD3AYz9 c0TENoE7b+r1dqlnuw3ow0YfGT/Ja+2UdX2fOXnhi823Z+nUFT/c3zVS1WLxQ4Q//iN9 b8LJHbF3Opi1NSsOrFvqy5s5ZYM86nk0+t5fJK3kjZulJwZtlmrPtgEBQXX5byp5ONQt IA+80Y9FOq4Wgr8eNWImq2tCWalGlDCP0Lygw+alGu4J1chK1hzL9MYQZerxMYnX0Wkz IT5+CkMhw+gXvcb+t4JazUmZ+YpRQmFm9jDjHnTZ9r9Y5NGG8NLeGugvLgISA0sRV4jC xN/g=="
},
{
"Name": "X-Google-userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=euBan4jEQqeDOU1gQty+R/vibmOWoysN/1z/y/FRJsk=; b=d0paN4GVIPRZ9oMrljP9DGCYUfaYj94QGBNgb4eiEf0BDl+lLHbPBJFxofS5ENcHFU RyiWJ97YbAMNBrYR0VcG4WAaYlpr4Icc3xIm/fAWDVhF9SORD+V0oI6BZPDFllZJI5td X2QIN+sTtCzQz8S2zXrzc6vHZvd0jUf6/ygEqhbd895yBck8VG6JnE+4lcYeopPc7mY+ aAW84VijDVxP6ex2YfTBgx1MQ/XPxp/iCIZYiUaLRzCX196wDySW7veFfIePup5msgO5 k21XsFktv3Mjo5HOeoQmDy5rYr0q+NBqiEGWww0cNJgEtir1Ndu/KsC0dLlGOYldUtM/ qHgA=="
},
{
"Name": "X-Gm-Message-State",
"Value": "AOAM532lbsItIIq6+Hi3u+n4f8XH5JSBhVQ27mitCw2HKc5GJom6JKGI TQjHVd6vZ5RcpDvk9ikKQ+O5ZmET7Rjzv7ZND1D/2eezYmo="
},
{
"Name": "X-Google-Smtp-Source",
"Value": "ABdhPJwN+izZRQqz7yZ5r7QiLz9HNZj3K2DfMtBSi50muUYduS/aS/224PRCBYtNhYxoRfJ+AobS5c+VMxxRxb4uteI="
},
{
"Name": "X-Received",
"Value": "by 2002:a1c:9cd8:: with SMTP id f207mr5895584wme.76.1603862087346; Tue, 27 Oct 2020 22:14:47 -0700 (PDT)"
},
{
"Name": "MIME-Version",
"Value": "1.0"
},
{
"Name": "From",
"Value": "user test"
},
{
"Name": "Date",
"Value": "Wed, 28 Oct 2020 10:44:36 +0530"
},
{
"Name": "Message-ID",
"Value": "<CAB4Yy=Y-sd_q46FNU9C8Ed4JeNR=ZR+kioPAEW3BD8xi2JQ0_Q@mail.gmail.com>"
},
{
"Name": "Subject",
"Value": "Invoice for Payment"
},
{
"Name": "To",
"Value": "user test <user@domain.io>"
},
{
"Name": "Content-Type",
"Value": "multipart/mixed; boundary=\"000000000000fc606205b2b43d45\""
}
],
"Html": "<div dir=\"ltr\">Hi user,<br><div><br></div><div>Please find\u00a0the attached Invoice for payment.</div></div>\r\n",
"ID": "1756da14b84773d0",
"Labels": "UNREAD, IMPORTANT, CATEGORY_PERSONAL, INBOX",
"Mailbox": "user@domain.io",
"RawData": null,
"Subject": "Invoice for Payment",
"ThreadId": "1756da14b84773d0",
"To": "user test <user@domain.io>",
"Type": "Gmail"
},
{
"Attachments": "",
"Bcc": [],
"Body": "this is the body",
"Cc": [],
"Date": "Wed, 28 Oct 2020 17:09:30 -0000",
"Format": "text/plain",
"From": "Cortex XSOAR <noreply@demisto.com>",
"Headers": [
{
"Name": "Delivered-To",
"Value": "user@domain.io"
},
{
"Name": "Received",
"Value": "by 2002:a19:f11e:0:0:0:0:0 with SMTP id p30csp641301lfh; Wed, 28 Oct 2020 10:09:33 -0700 (PDT)"
},
{
"Name": "X-Google-Smtp-Source",
"Value": "ABdhPJz8m1jT0ssqjmD2U8ThX6ThyqUzsc3cTpqrAD6LRhlEbM6+/a84n3/aJ1WKmfnd2tkYxLgT"
},
{
"Name": "X-Received",
"Value": "by 2002:aa7:84c6:0:b029:155:d56e:5191 with SMTP id x6-20020aa784c60000b0290155d56e5191mr260750pfn.41.1603904973536; Wed, 28 Oct 2020 10:09:33 -0700 (PDT)"
},
{
"Name": "ARC-Seal",
"Value": "i=1; a=rsa-sha256; t=1603904973; cv=none; d=google.com; s=arc-20160816; b=i1gaeYn9XfzOzmgiQOnRBIecU79tTy3BM8fkGJhaGgBvLni4aqy6cAmj8Y2G4bIgCc wva5DfOYQGI/kU92oskTaHCAfReknVevAtIQBzSSYJE8iAgQpI1vHNQwatawk1Z2GLOo ehvTTnzDtLeVctte5MsinzTk8QRBGy6Mm696A/EG3gQtPid//OeEZjsRsGVoS/DnDsBl PnADQW2iDCipleWV5/VvZcuGr6MfVU7Z/xHnwsA2cVzFNpkuipYFeES5aj9VEpyAcpQJ D7HydozpsyGRthQTOHNt88fMtNd/AsMNuserFb0OuvvT0yh5mlXUD1HZxWpAZVjoQEy4bi SN1g=="
},
{
"Name": "ARC-Message-Signature",
"Value": "i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=date:message-id:to:from:subject:content-transfer-encoding :mime-version; bh=zz9vmrR/QL1JlfZ+XVEukkZVu/dgGaMq/IFz/+BEn+s=; b=IYEM58RIbU8H5CSFmuserUtv79IPOgvMYXoo9BpJNnXRwHm3N2V0WS3m+dB6oiOQFZhi 26//IoWW779aL91gaRg955bbDLHXXUDnuUMYHEPYGxysNZlomAIs/JHBVEKN5Dynqxon PFxDwT7wDnL2cIhvZVAlXTM5aoJX+DjriZEETfgmDdFAOfV4cSr+6aH03GlmoyV/Kd8W Lx0Sk07znWfUZenHGcW+zG4WhKe5wjyFep6lAXCIKsvx1O/RhzGxQRl4ROn/VFFGjC38 fEJTgzhNsilNUVQxtTH6+JNY+bIUhtPH0gFCm8Ymxcaxi7ksaVOq36kJIxxr/MKnVlVk B6aQ=="
},
{
"Name": "ARC-Authentication-Results",
"Value": "i=1; mx.google.com; spf=neutral (google.com: 203.88.139.45 is neither permitted nor denied by best guess record for domain of noreply@demisto.com) smtp.mailfrom=noreply@demisto.com"
},
{
"Name": "Return-Path",
"Value": "<noreply@demisto.com>"
},
{
"Name": "Received",
"Value": "from mail.domain.io ([203.88.139.45]) by mx.google.com with ESMTPS id x82si5333777pgx.136.2020.10.28.10.09.33 for <user@domain.io> (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 28 Oct 2020 10:09:33 -0700 (PDT)"
},
{
"Name": "Received-SPF",
"Value": "neutral (google.com: 203.88.139.45 is neither permitted nor denied by best guess record for domain of noreply@demisto.com) client-ip=203.88.139.45;"
},
{
"Name": "Authentication-Results",
"Value": "mx.google.com; spf=neutral (google.com: 203.88.139.45 is neither permitted nor denied by best guess record for domain of noreply@demisto.com) smtp.mailfrom=noreply@demisto.com"
},
{
"Name": "Received",
"Value": "from localhost (localhost [127.0.0.1]) by mail.domain.io (Postfix) with ESMTP id 3FD0F282E7C for <user@domain.io>; Wed, 28 Oct 2020 22:39:31 +0530 (IST)"
},
{
"Name": "Received",
"Value": "from mail.domain.io ([127.0.0.1]) by localhost (mail.domain.io [127.0.0.1]) (amavisd-new, port 10032) with ESMTP id QetnjLjf9OqD for <user@domain.io>; Wed, 28 Oct 2020 22:39:30 +0530 (IST)"
},
{
"Name": "Received",
"Value": "from localhost (localhost [127.0.0.1]) by mail.domain.io (Postfix) with ESMTP id 95F66282E7D for <user@domain.io>; Wed, 28 Oct 2020 22:39:30 +0530 (IST)"
},
{
"Name": "X-Virus-Scanned",
"Value": "amavisd-new at domain.io"
},
{
"Name": "Received",
"Value": "from mail.domain.io ([127.0.0.1]) by localhost (mail.domain.io [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id aHmdVO4nDHTv for <user@domain.io>; Wed, 28 Oct 2020 22:39:30 +0530 (IST)"
},
{
"Name": "Received",
"Value": "from [172.17.0.2] (unknown [203.88.139.34]) by mail.domain.io (Postfix) with ESMTPSA id 69C2C282D7C for <user@domain.io>; Wed, 28 Oct 2020 22:39:30 +0530 (IST)"
},
{
"Name": "Content-Type",
"Value": "text/plain; charset=\"utf-8\""
},
{
"Name": "MIME-Version",
"Value": "1.0"
},
{
"Name": "Content-Transfer-Encoding",
"Value": "base64"
},
{
"Name": "Subject",
"Value": "this is the subject"
},
{
"Name": "From",
"Value": "Cortex XSOAR <noreply@demisto.com>"
},
{
"Name": "To",
"Value": "user@domain.io"
},
{
"Name": "Message-Id",
"Value": "<20201028170930.69C2C282D7C@mail.domain.io>"
},
{
"Name": "Date",
"Value": "Wed, 28 Oct 2020 22:39:30 +0530 (IST)"
}
],
"Html": null,
"ID": "175702fab120ba01",
"Labels": "UNREAD, IMPORTANT, CATEGORY_PERSONAL",
"Mailbox": "user@domain.io",
"RawData": null,
"Subject": "this is the subject",
"ThreadId": "175702a3f7c6c785",
"To": "user@domain.io",
"Type": "Gmail"
},
{
"Attachment Names": "",
"Attachments": [],
"Bcc": [],
"Body": "Body",
"Cc": [],
"Date": "Wed, 21 Oct 2020 03:19:45 -0700",
"Format": "multipart/alternative",
"From": "The G Suite Team <gsuite-noreply@google.com>",
"Headers": [
{
"Name": "Delivered-To",
"Value": "user@domain.io"
},
{
"Name": "Received",
"Value": "by 2002:ab4:9b4d:0:0:0:0:0 with SMTP id f13csp1113640ecz; Wed, 21 Oct 2020 03:19:46 -0700 (PDT)"
},
{
"Name": "X-Received",
"Value": "by 2002:a92:3608:: with SMTP id d8mr1854537ila.2.1603275586149; Wed, 21 Oct 2020 03:19:46 -0700 (PDT)"
},
{
"Name": "ARC-Seal",
"Value": "i=1; a=rsa-sha256; t=1603275586; cv=none; d=google.com; s=arc-20160816; b=IScKK1NudjmvdSd/MdeoPxyBETVwz6BqYU7l92NBoESsGvlgpVIIAeM73nRDjA3EY+ q5y0H39HgXxBSsRVRmY0nqsiFEx/oT4a/tzl+EDNR/vXDIknW/+4i7hcF9VVfZfH3hfJ 8lnuqafUFCoglkoYhUpScSRtomM9Caop8439x3snEPhjHMIxV1Yjpy5Ub8AmQLLMN9pZ UasLotRCbFhMu7i3a+NyJpKEX+5/MTjVyLe0GSTNItppNkgsKU76VjdC/PIxG8OurOKC VEZahMut7ll0PosBsgZmSCHoMH/9Lh0WuaUHHRQOih+w52qyNTC7Cj+duh7lfCi8tuR1 g/jg=="
},
{
"Name": "ARC-Message-Signature",
"Value": "i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=to:from:subject:message-id:feedback-id:reply-to:date:mime-version :userim-signature; bh=kfRxf4d6YTlZyBFf4xWJMjZiBq0HVOyRTFyfTXLbe2A=; b=rQN2CWMbTe1rrR1aK7NR/i6iucznTNo5KF9WoVDZVPsl8SNNtvc2sbu35TMckTEvc7 Fw7V35AU2hKSXiUmMMmpvlJc7/lZZQS+9ufJvOB5ERb3ZQvJ7vDntPLcWSWD+Z+zhA4L piHDuzNYQ6UTLunyrojovIYR7Kut32+56efMCnP+3STL/8GoDlWhg5Dl8nJaUw8scKVA tPbby0snklB7BEuppbXOkB+1Y/E6UMZEluMi1pXgNPTBGL0CvtZOmqeWgaTUS1pEaizO W/kPvQzCpLHHjrtSejS0LAWDQYGNDVap0+wxjpsc7HvCuS/A5DEaiw+17U0xU74MYscF WHVQ=="
},
{
"Name": "ARC-Authentication-Results",
"Value": "i=1; mx.google.com; userim=pass header.i=@google.com header.s=20161025 header.b=Vq6Vf70E; spf=pass (google.com: domain of 3qquqxw4kb5oamocn8-hil8jfsaiiaf8.6igmbcp4hahcg5f874n4.ci@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) smtp.mailfrom=3QQuQXw4KB5oAMOCN8-HIL8JFSAIIAF8.6IGMBCP4HAHCG5F874N4.CI@scoutcamp.bounces.google.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com"
},
{
"Name": "Return-Path",
"Value": "<3QQuQXw4KB5oAMOCN8-HIL8JFSAIIAF8.6IGMBCP4HAHCG5F874N4.CI@scoutcamp.bounces.google.com>"
},
{
"Name": "Received",
"Value": "from mail-sor-f69.google.com (mail-sor-f69.google.com. [209.85.220.69]) by mx.google.com with SMTPS id j84sor874916ili.67.2020.10.21.03.19.45 for <user@domain.io> (Google Transport Security); Wed, 21 Oct 2020 03:19:46 -0700 (PDT)"
},
{
"Name": "Received-SPF",
"Value": "pass (google.com: domain of 3qquqxw4kb5oamocn8-hil8jfsaiiaf8.6igmbcp4hahcg5f874n4.ci@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) client-ip=209.85.220.69;"
},
{
"Name": "Authentication-Results",
"Value": "mx.google.com; userim=pass header.i=@google.com header.s=20161025 header.b=Vq6Vf70E; spf=pass (google.com: domain of 3qquqxw4kb5oamocn8-hil8jfsaiiaf8.6igmbcp4hahcg5f874n4.ci@scoutcamp.bounces.google.com designates 209.85.220.69 as permitted sender) smtp.mailfrom=3QQuQXw4KB5oAMOCN8-HIL8JFSAIIAF8.6IGMBCP4HAHCG5F874N4.CI@scoutcamp.bounces.google.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com"
},
{
"Name": "userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:date:reply-to:feedback-id:message-id:subject:from:to; bh=kfRxf4d6YTlZyBFf4xWJMjZiBq0HVOyRTFyfTXLbe2A=; b=Vq6Vf70EwOBFHTM2cd3cdfjczrrz/DTgix9/F6vpKdsPG7gnxvdmAS8I8zYZDwCAOB OXn3wVZOoIbV/ebj4ruO3xAUOKPWDq+QsIg+GELHsz9vcjb1y8+ZsyZu1TR1pqjAxYY4 msupux3YVM0/Qij8oZA/RaX2R2zdurAcRHI8sVSLDVlI+q6S3ljgmSUa+cHJp4H7qjPP do8NpFGJNb5ZCjf5BgkniEBnCDhNDaT9HzVkWBeVQ1hbWOmswSQk4XDZqsD1VJoqtxFX YK7VgP59yA6+V3JufQFePt/v0qUWdxGXFjk+Z+uCiTJV+k71hDlcB43uCAszTrhuBgCF gkLQ=="
},
{
"Name": "X-Google-userIM-Signature",
"Value": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:date:reply-to:feedback-id :message-id:subject:from:to; bh=kfRxf4d6YTlZyBFf4xWJMjZiBq0HVOyRTFyfTXLbe2A=; b=npFEbCyyZrzyxt5KD7XGwoIxMwGPaLIoxCOmthILZQSZwHf4YR90e0PtZJYqexBTxP TIKGcbK8MX5JnG+SUaMsKvWHtOaFWiMq65c9v6Pa1yedBiPEcc81Fp0OIOkepcW5V7MP euTm57krNctjiaKjXAS8xZOrw6hIngRMDwNnm1U3HprnjMewQ4xtQLTP7N2IGlu2eeQl RgOmZFw1R/ptBAs84dVFjj8gz6xvD2Hc75jkErrcGoeICAFQP/qbyTzVpR/sOzRDgUqm xi0M/W9zbBGn73UEgLbsjlCcvb7KdjiMilq7J38WGhmrBLukUkKqvrlM46Q+VKvh8QOi 6XJQ=="
},
{
"Name": "X-Gm-Message-State",
"Value": "AOAM533kswxJuWLXsarIgxZqLeTqnvbq6Gw8vSiwiWaeP1Qcrgk2Uzz3 Q7mDm4WbaPiD39Y="
},
{
"Name": "X-Google-Smtp-Source",
"Value": "ABdhPJyjp+KhQ5RNoYBDfKXi+q4buqsqi57IVI9KQa19jKonPQNFj6qIdXjDmgopcoZyFkjAZY78YIg="
},
{
"Name": "MIME-Version",
"Value": "1.0"
},
{
"Name": "X-Received",
"Value": "by 2002:a05:6e02:11b4:: with SMTP id 20mr1889339ilj.271.1603275585914; Wed, 21 Oct 2020 03:19:45 -0700 (PDT)"
},
{
"Name": "Date",
"Value": "Wed, 21 Oct 2020 03:19:45 -0700"
},
{
"Name": "Reply-To",
"Value": "The G Suite Team <gsuite-noreply@google.com>"
},
{
"Name": "X-Google-Id",
"Value": "253939"
},
{
"Name": "Feedback-ID",
"Value": "P-10-0:C20060867:M110136315-en:gamma"
},
{
"Name": "X-Notifications",
"Value": "GAMMA:<dce5da70c09c512cd672d87e6a892b6822b64a89-20060867-110354355@google.com>"
},
{
"Name": "Message-ID",
"Value": "<dce5da70c09c512cd672d87e6a892b6822b64a89-20060867-110354355@google.com>"
},
{
"Name": "Subject",
"Value": "Your G Suite data transfer was successful for user test to user test"
},
{
"Name": "From",
"Value": "The G Suite Team <gsuite-noreply@google.com>"
},
{
"Name": "To",
"Value": "user@domain.io"
},
{
"Name": "Content-Type",
"Value": "multipart/alternative; boundary=\"000000000000c6873505b22baf3c\""
}
],
"Html": "<div>\r\n <meta http-equiv=Content-Type content=\"text/html; charset=utf-8\">\r\n <meta name=viewport content=width=device-width>\r\n <style>@media only screen{html{min-height:100%;background:#fafafa}}@media only screen and (max-width:640px){.small-float-center{margin:0 auto!important;float:none!important;text-align:center!important}}@media only screen and (max-width:640px){table.body img{width:auto;height:auto}table.body center{min-width:0!important}table.body .container{width:344px!important}table.body .columns{height:auto!important;-moz-box-sizing:border-box;-webkit-box-sizing:border-box;box-sizing:border-box;padding-left:40px!important;padding-right:40px!important}table.body .columns .columns{padding-left:0!important;padding-right:0!important}table.body .collapse .columns{padding-left:0!important;padding-right:0!important}th.small-1{display:inline-block!important;width:8.33333%!important}th.small-3{display:inline-block!important;width:25%!important}th.small-4{display:inline-block!important;width:33.33333%!important}th.small-6{display:inline-block!important;width:50%!important}th.small-8{display:inline-block!important;width:66.66667%!important}th.small-9{display:inline-block!important;width:75%!important}th.small-12{display:inline-block!important;width:100%!important}.columns th.small-12{display:block!important;width:100%!important}table.menu{width:100%!important}table.menu td,table.menu th{width:auto!important;display:inline-block!important}table.menu.vertical td,table.menu.vertical th{display:block!important}table.menu[align=center]{width:auto!important}}</style>\r\n <span class=preheader style=color:#fafafa;display:none!important;font-size:1px;line-height:1px;max-height:0;max-width:0;mso-hide:all!important;opacity:0;overflow:hidden;visibility:hidden></span>\r\n <table class=body style=Margin:0;background:#F8F9FA!important;border-collapse:collapse;border-spacing:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;height:100%;line-height:inherit;margin:0;padding:0;vertical-align:top;width:100%;text-align:left>\r\n <tr style=padding:0;vertical-align:top>\r\n <td class=center align=center valign=top style=-moz-hyphens:none;-webkit-hyphens:none;Margin:0;border-collapse:collapse!important;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;hyphens:none;line-height:inherit;margin:0;padding:0;vertical-align:top;word-wrap:keep-all>\r\n <center data-parsed=\"\" style=min-width:600px;width:100%>\r\n\r\n <table align=center class=\"container float-center\" style=\"Margin:0 auto;background:#fafafa;border-collapse:collapse;border-spacing:0;float:none;margin:0 auto;padding:0;text-align:left;vertical-align:top;width:600px\"><tbody><tr style=padding:0;vertical-align:top><td style=-moz-hyphens:none;-webkit-hyphens:none;Margin:0;border-collapse:collapse!important;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;hyphens:none;line-height:inherit;margin:0;padding:0;vertical-align:top;word-wrap:keep-all>\r\n <table class=\"row header\" style=background:#F8F9FA;border-collapse:collapse;border-spacing:0;display:table;font-size:12px;padding:0;position:relative;vertical-align:top;width:100%><tbody><tr style=padding:0;vertical-align:top>\r\n <th class=\"small-12 large-12 columns first last\" style=\"Margin:0 auto;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0 auto;padding:0;padding-bottom:24px;padding-left:40px;padding-right:40px;padding-top:12px;width:560px\"><table style=border-collapse:collapse;border-spacing:0;margin-bottom:0;padding:0;vertical-align:top;width:100%><tr style=padding:0;vertical-align:top><th style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0;text-align:left>\r\n\r\n <img src=https://storage.googleapis.com/support-kms-prod/BfxWlTCe6OCizPoUdUCwDz979TQRdnVdSMCG alt=\"G Suite\" height=30 style=-ms-interpolation-mode:bicubic;clear:both;display:block;margin-top:24px;max-height:30px;max-width:100%;outline:0;text-decoration:none;width:auto>\r\n\r\n </th>\r\n<th class=expander style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0!important;visibility:hidden;width:0></th></tr></table></th>\r\n </tr></tbody></table>\r\n\r\n <table class=\"row info\" style=align-items:center;background:#fff;border-collapse:collapse;border-color:#E8EAED;border-spacing:0;border-style:solid;border-width:1px;display:table;padding:0;position:relative;vertical-align:top;width:100%><tbody><tr style=padding:0;vertical-align:top>\r\n <th class=\"small-12 large-12 columns first last\" style=\"Margin:0 auto;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0 auto;padding:0;padding-bottom:0;padding-left:40px;padding-right:40px;width:560px\"><table style=border-collapse:collapse;border-spacing:0;padding:0;vertical-align:top;width:100%><tr style=padding:0;vertical-align:top><th style=\"Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0 0 24px;text-align:left\">\r\n <p style=Margin:0;Margin-bottom:16px;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:24px;margin:0;margin-bottom:16px;margin-top:24px;padding:0>Hello Admin,</p>\r\n\r\n<p style=Margin:0;Margin-bottom:16px;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:24px;margin:0;margin-bottom:16px;padding:0>G Suite recently processed a request from test user (user@domain.io) to transfer data for user test (user@domain.io) to user test (user@domain.io).</p>\r\n\r\n<p style=Margin:0;Margin-bottom:16px;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:24px;margin:0;margin-bottom:16px;padding:0>The data transfer was successful.</p>\r\n\r\n<p style=\"margin-top:8px;color:#3C4043;font-family:Google Sans,Helvetica,Arial,sans-serif;font-size:14px;font-weight:700;line-height:24px;margin:0;margin-bottom:0px;padding:0\">Sincerely,</p>\r\n\r\n<p style=\"Margin:0;color:#3C4043;font-family:Google Sans,Helvetica,Arial,sans-serif;font-size:14px;font-weight:700;line-height:24px;margin:0;margin-bottom:0;padding:0\">The G Suite Team</p>\r\n </th></tr></table></th>\r\n </tr></tbody></table>\r\n\r\n <table class=\"row footer\" style=background:#F8F9FA;border-collapse:collapse;border-spacing:0;display:table;margin-top:0;padding:0;position:relative;vertical-align:top;width:100%><tbody><tr style=padding:0;vertical-align:top>\r\n <th class=\"small-12 large-12 columns first last\" style=\"Margin:0 auto;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0 auto;padding:0;padding-bottom:0;padding-left:40px;padding-right:40px;width:560px\"><table style=border-collapse:collapse;border-spacing:0;padding:0;vertical-align:top;width:100%><tr style=padding:0;vertical-align:top><th style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:24px;text-align:left>\r\n\r\n <img src=https://storage.googleapis.com/support-kms-prod/Yd1rPlunjtOKzNDXcw3eFmVCjI828xhBZqQy alt=\"Google Cloud\" height=30 style=-ms-interpolation-mode:bicubic;clear:both;display:block;margin-bottom:14px;max-width:100%;max-height:30px;outline:0;text-decoration:none;width:auto>\r\n <p style=Margin:0;Margin-bottom:16px;color:#6C737F;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:12px;font-weight:400;line-height:16px;margin:0;margin-bottom:14px;padding:0>\r\n \u00a9 2020 Google LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043\r\n </p>\r\n <p style=Margin:0;Margin-bottom:16px;color:#6C737F;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:12px;font-weight:400;line-height:16px;margin:0;margin-bottom:14px;padding:0>\r\n <em>You\u2019re receiving this mandatory email service announcement to update you about important changes to your Google Cloud product or account.</em>\r\n </p>\r\n </th>\r\n<th class=expander style=Margin:0;color:#3C4043;font-family:Roboto,Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:inherit;margin:0;padding:0!important;visibility:hidden;width:0></th></tr></table></th>\r\n </tr></tbody></table>\r\n </td></tr></tbody></table>\r\n\r\n </center>\r\n </td>\r\n </tr>\r\n </table>\r\n <!-- prevent Gmail on iOS font size manipulation -->\r\n <div style=\"display:none;white-space:nowrap;font:15px courier;line-height:0\"> </div>\r\n \r\n</div>\r\n",
"ID": "1754aabfa1d53920",
"Labels": "UNREAD, CATEGORY_UPDATES, INBOX",
"Mailbox": "user@domain.io",
"RawData": null,
"Subject": "Your G Suite data transfer was successful for user test to user test",
"ThreadId": "1754a5bed4eef193",
"To": "user@domain.io",
"Type": "Gmail"
}
]
}
Human Readable Output
Search completed
gmail-list-users
Lists all Google users in a domain.
Base Command
gmail-list-users
Input
| Argument Name | Description | Required |
|---|---|---|
| projection | The subset of fields to fetch for the user. Can be “basic”: Do not include any custom fields for the user. (default), “custom”: Include custom fields from schemas requested in customFieldMask, “full”: Include all fields associated with this user. Possible values are: basic, custom, full. | Optional |
| domain | The domain name. Use this field to get fields from only one domain. To return all domains for a customer account, use the customer query parameter. | Optional |
| customer | The unique ID for the customer’s Google account. Default is the value specified in the integration configuration. For a multi-domain account, to fetch all groups for a customer, use this field instead of domain. | Optional |
| max-results | Maximum number of results to return. Default is 100. Maximum is 500. Can be 1 to 500, inclusive. | Optional |
| custom-field-mask | A comma-separated list of schema names. All fields from these schemas are fetched. Must be set when projection=custom. | Optional |
| query | Query string search. Should be of the form “”. Complete documentation is at https://developers.google.com/admin-sdk/directory/v1/guides/search-users. | Optional |
| show-deleted | If true, retrieves the list of deleted users. Default is false. Possible values are: False, True. | Optional |
| sort-order | How to sort the results. Can be ASCENDING/DESCENDING. Possible values are: ASCENDING, DESCENDING. | Optional |
| token | Token to authorize and authenticate the action. | Optional |
| view-type-public-domain | Whether to fetch either the administrator or public view of the user. Can be admin_view (default), which includes both administrator and domain-public fields or “domain_public”(includes fields for the user that are publicly visible to other users in the domain). Possible values are: admin_view, domain_public. Default is admin_view. | Optional |
| page-token | Token to specify next page in the list. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Account.Type | String | The account type. For example, “AD”, “LocalOS”, “Google”, or “AppleID”. |
| Account.ID | String | The unique ID for the account (integration specific). For AD accounts this is the Distinguished Name (DN). |
| Account.DisplayName | String | The display name. |
| Account.Gmail.Address | string | The email assigned with the current account. |
| Account.Email.Adderss | String | The email address of the account. |
| Account.Groups | String | Groups to which the account belongs (integration specific). For example, for AD these are the groups in which the account is member. |
| Account.Domain | String | The domain of the account. |
| Account.Username | String | The username of the account. |
| Account.OrganizationUnit | String | The Organization Unit (OU) of the account. |
Command Example
!gmail-list-users query=user show-deleted=False
Context Example
{
"Account": {
"CustomerId": "C03puekhd",
"DisplayName": "user test",
"Domain": "domain.io",
"Email": {
"Address": "user@domain.io"
},
"Gmail": {
"Address": "user@domain.io"
},
"Group": "admin#directory#user",
"Groups": "admin#directory#user",
"ID": "113493660192005193453",
"Type": "Google",
"UserName": "user",
"Username": "user",
"VisibleInDirectory": true
}
}
Human Readable Output
Users
Type ID Username DisplayName Groups CustomerId Domain VisibleInDirectory 113493660192005193453 user user test admin#directory#user C03puekhd domain.io Address: user@domain.io true
gmail-list-labels
Lists all labels in the user’s mailbox.
Base Command
gmail-list-labels
Input
| Argument Name | Description | Required |
|---|---|---|
| user-id | The user’s email address. The “me” special value can be used to indicate the authenticated user. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| GmailLabel.UserID | String | The UserID the label belongs to. |
| GmailLabel.Name | String | The name of the label. |
| GmailLabel.ID | String | The label ID. |
| GmailLabel.Type | String | The label type. |
| GmailLabel.MessageListVisibility | String | The label message list visibility. |
| GmailLabel.LabelListVisibility | String | The label list visibility. |
Command Example
!gmail-list-labels user-id=me
Context Example
{
"GmailLabel":
[
{
"ID": "INBOX",
"LabelListVisibility": "labelHide",
"MessageListVisibility:: "hide",
"Name": "INBOX",
"Type": "system",
"UserID": "user@domain.io"
}
]
}
Human Readable Output
Labels for UserID me
Name ID Type MessageListVisibility LabelListVisibility INBOX INBOX system SPAM SPAM system hide labelShowIfUnread
gmail-revoke-user-role
Revokes a role for a specified Google user.
Base Command
gmail-revoke-user-role
Input
| Argument Name | Description | Required |
|---|---|---|
| user-id | The user’s email address. The special value me can be used to indicate the authenticated user. | Optional |
| role-assignment-id | The immutable ID of the role assignment. | Required |
Context Output
There is no context output for this command.
Command Example
!gmail-revoke-user-role role-assignment-id=role1
Human Readable Output
Role has been deleted.
gmail-create-user
Creates a new Gmail user.
Base Command
gmail-create-user
Input
| Argument Name | Description | Required |
|---|---|---|
| The user’s primary email address. The primary email address must be unique and cannot be an alias of another user. | Required | |
| first-name | The user’s first name. | Required |
| family-name | The user’s last name. | Required |
| password | Stores the password for the user account. A password can contain any combination of ASCII characters. A minimum of 8 characters is required. The maximum length is 100 characters. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Account.Type | String | The account type. For example, “AD”, “LocalOS”, “Google”, or “AppleID”. |
| Account.ID | String | The unique ID for the account (integration specific). For AD accounts this is the Distinguished Name (DN). |
| Account.DisplayName | string | The display name. |
| Account.Gmail.Address | string | The email assigned with the current account. |
| Account.Email.Address | String | The email address of the account. |
| Account.Username | String | The username of the account. |
| Account.Groups | String | Groups to which the account belongs (integration specific). For example, for AD these are groups in which the account is a member. |
| Account.Domain | String | The domain of the account. |
| Account.OrganizationUnit | String | The Organization Unit (OU) of the account. |
Command Example
!gmail-create-user email=user1@domain.io first-name=John family-name=Snow password=WinterIsComing
Context Example
{
"Account": {
"CustomerId": "C03puekhd",
"DisplayName": "John Testmanw",
"Domain": "domain.io",
"Email": {
"Address": "user1@domain.io"
},
"Gmail": {
"Address": "user1@domain.io"
},
"Group": "admin#directory#user",
"Groups": "admin#directory#user",
"ID": "103470368646956060577",
"Type": "Google",
"UserName": "John",
"Username": "John",
"VisibleInDirectory": null
}
}
Human Readable Output
New User
Type ID Username DisplayName Groups CustomerId Domain 103470368646956060577 John John Testmanw admin#directory#user C03puekhd domain.io Address: user1@domain.io
gmail-delete-mail
Deletes an email in the user’s mailbox.
Base Command
gmail-delete-mail
Input
| Argument Name | Description | Required |
|---|---|---|
| user-id | The user’s email address. The special value me can be used to indicate the authenticated user. | Required |
| message-id | The ID of the email to delete. You can get the ID by running the gmail-search command, or by fetching mails and copy the incident.labels.Email/ID value from the fetched incident context. | Required |
| permanent | Whether to delete the email permanently or move it to trash (default). Possible values are: False, True. | Optional |
Context Output
There is no context output for this command.
Command Example
!gmail-delete-mail user-id=admin@demistodev.com message-id=16d4316a25a332e4
Human Readable Output
Email has been successfully moved to trash.
gmail-get-thread
Returns all messages in a thread.
Base Command
gmail-get-thread
Input
| Argument Name | Description | Required |
|---|---|---|
| user-id | The user’s email address. The special value me can be used to indicate the authenticated user. | Required |
| thread-id | The ID of the thread to retrieve. | Required |
| format | The format in which to return the message. Can be: “full”: Returns the full email message data with body content parsed in the payload field; the raw field is not used. (default) / “metadata”: Returns only email message ID, labels, and email headers / “minimal”: Returns only email message ID and labels; does not return the email headers, body, or payload / “raw”: Returns the full email message data with body content in the raw field as a base64url encoded string; the payload field is not used. Possible values are: full, metadata, minimal, raw. Default is full. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Gmail.ID | string | The inner ID of the Gmail message. |
| Gmail.ThreadId | string | The thread ID. |
| Gmail.Format | string | The MIME type of email. |
| Gmail.Labels | string | The labels of the specific email. |
| Gmail.To | string | The email address of the receiver. |
| Gmail.From | string | The email address of the sender. |
| Gmail.Cc | string | The additional recipient email address (CC). |
| Gmail.Bcc | string | The additional recipient email address (BCC). |
| Gmail.Subject | string | The subject of a specific email. |
| Gmail.Body | string | The content of the email. |
| Gmail.Attachments | unknown | The attachments of the email. IDs are separated by commas. |
| Gmail.Headers | unknown | All headers of the specific email (list). |
| Gmail.Mailbox | string | The Gmail mailbox. |
| Email.To | String | The recipient of the email. |
| Email.From | String | The sender of the email. |
| Email.CC | String | The additional recipient email address (CC). |
| Email.BCC | String | The additional recipient email address (BCC). |
| Email.Format | String | The format of the email. |
| Email.Body/HTML | String | The HTML version of the email. |
| Email.Body/Text | String | The plain-text version of the email. |
| Email.Subject | String | The subject of the email. |
| Email.Headers | String | The headers of the email. |
| Email.Attachments.entryID | Unknown | Email Attachments. IDs are separated by commas. |
| Email.Date | String | The date the email was received. |
Command Example
!gmail-get-thread user-id=user@domain.io thread-id=1756d926adcca849
Context Example
{
"Email": {
"Attachments": {
"entryID": ""
},
"BCC": [],
"Body/HTML": null,
"Body/Text": "\r\n",
"CC": [],
"Date": "Tue, 27 Oct 2020 21:58:33 -0700",
"Format": "text/plain",
"From": "user1 test1 <user@domain.io>",
"Headers": [
{
"Name": "To",
"Value": "3d_qYXxAPBdI0CAA2BHG-BCF2D9M1C0G.4CC492.0CA12Jy9B6Az921yHy.6C@docos.bounces.google.com"
},
{
"Name": "From",
"Value": "user1 test1 <user@domain.io>"
},
{
"Name": "Date",
"Value": "Tue, 27 Oct 2020 21:58:33 -0700"
},
{
"Name": "Message-ID",
"Value": "<CAKWG9FmfrWB2fqMySvy-ffjxPBAE81E_zJ2JV1G87ztq4j_Ojg@mail.gmail.com>"
},
{
"Name": "Subject",
"Value": "hello Re: Untitled document - @user@domain.io @user@domain..."
},
{
"Name": "MIME-Version",
"Value": "1.0"
},
{
"Name": "Content-Type",
"Value": "text/plain; charset=UTF-8"
},
{
"Name": "Content-Transfer-Encoding",
"Value": "7bit"
},
{
"Name": "Content-Disposition",
"Value": "inline"
},
{
"Name": "Precedence",
"Value": "bulk"
},
{
"Name": "X-Autoreply",
"Value": "yes"
},
{
"Name": "Auto-Submitted",
"Value": "auto-replied"
}
],
"ID": "1756d926adcca849",
"RawData": null,
"Subject": "hello Re: Untitled document - @user@domain.io @user@domain...",
"To": "3d_qYXxAPBdI0CAA2BHG-BCF2D9M1C0G.4CC492.0CA12Jy9B6Az921yHy.6C@docos.bounces.google.com"
},
"Gmail": {
"Attachments": "",
"Bcc": [],
"Body": "\r\n",
"Cc": [],
"Date": "Tue, 27 Oct 2020 21:58:33 -0700",
"Format": "text/plain",
"From": "user1 test1 <user@domain.io>",
"Headers": [
{
"Name": "To",
"Value": "3d_qYXxAPBdI0CAA2BHG-BCF2D9M1C0G.4CC492.0CA12Jy9B6Az921yHy.6C@docos.bounces.google.com"
},
{
"Name": "From",
"Value": "user1 test1 <user@domain.io>"
},
{
"Name": "Date",
"Value": "Tue, 27 Oct 2020 21:58:33 -0700"
},
{
"Name": "Message-ID",
"Value": "<CAKWG9FmfrWB2fqMySvy-ffjxPBAE81E_zJ2JV1G87ztq4j_Ojg@mail.gmail.com>"
},
{
"Name": "Subject",
"Value": "hello Re: Untitled document - @user@domain.io @user@domain..."
},
{
"Name": "MIME-Version",
"Value": "1.0"
},
{
"Name": "Content-Type",
"Value": "text/plain; charset=UTF-8"
},
{
"Name": "Content-Transfer-Encoding",
"Value": "7bit"
},
{
"Name": "Content-Disposition",
"Value": "inline"
},
{
"Name": "Precedence",
"Value": "bulk"
},
{
"Name": "X-Autoreply",
"Value": "yes"
},
{
"Name": "Auto-Submitted",
"Value": "auto-replied"
}
],
"Html": null,
"ID": "1756d926adcca849",
"Labels": "SENT",
"Mailbox": "user@domain.io",
"RawData": null,
"Subject": "hello Re: Untitled document - @user@domain.io @user@domain...",
"ThreadId": "1756d926adcca849",
"To": "3d_qYXxAPBdI0CAA2BHG-BCF2D9M1C0G.4CC492.0CA12Jy9B6Az921yHy.6C@docos.bounces.google.com",
"Type": "Gmail"
}
}
Human Readable Output
Emails of Thread
Mailbox ID Subject From To Labels Format Body user@domain.io 1756d926adcca849 hello Re: Untitled document - @user@domain.io @user@domain… user1 test1 user@domain.io 3d_qYXxAPBdI0CAA2BHG-BCF2D9M1C0G.4CC492.0CA12Jy9B6Az921yHy.6C@docos.bounces.google.com SENT text/plain
gmail-move-mail
Moves an email to a different folder.
Base Command
gmail-move-mail
Input
| Argument Name | Description | Required |
|---|---|---|
| user-id | The user’s email address. The “me” special value can be used to indicate the authenticated user. | Required |
| message-id | The ID of the emaill to retrieve. You can get the ID by running the gmail-search command, or by fetching mails and copy the incident.labels.Email/ID value from the fetched incident context. | Required |
| add-labels | A comma-separated list of labels to add to the email. | Optional |
| remove-labels | A comma-separated list of labels to remove from the email. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Gmail.ID | string | The inner ID of the Gmail message. |
| Gmail.ThreadId | string | The thread ID. |
| Gmail.Format | string | The MIME type of email. |
| Gmail.Labels | string | The labels of the specific email. |
| Gmail.To | string | The Gmail address of the receiver. |
| Gmail.From | string | The Gmail address of the sender. |
| Gmail.Cc | string | The additional recipient email address (CC). |
| Gmail.Bcc | string | The additional recipient email address (BCC). |
| Gmail.Subject | string | The subject of the specific email. |
| Gmail.Body | string | The content of the email. |
| Gmail.Attachments | unknown | The attachments of the email. IDs are separated by commas. |
| Gmail.Headers | unknown | All headers of the specific email (list). |
| Gmail.Mailbox | string | The Gmail mailbox. |
| Email.To | String | The recipient of the email. |
| Email.From | String | The sender of the email. |
| Email.CC | Unknown | The additional recipient email address (CC). |
| Email.BCC | Unknown | The additional recipient email address (BCC). |
| Email.Format | String | The format of the email. |
| Email.Body/HTML | String | The HTML version of the email. |
| Email.Body/Text | String | The plain-text version of the email. |
| Email.Subject | String | The subject of the email. |
| Email.Headers | String | The headers of the email. |
| Email.Attachments.entryID | Unknown | Email attachments. IDs are separated by commas. |
| Email.Date | String | The date the email was received. |
Command Example
!gmail-move-mail user-id=user@domain.io message-id=1756ad6c1dc2956a add-labels=INBOX remove-labels=TRASH
Context Example
{
"Email": {
"Attachments": {
"entryID": ""
},
"BCC": [],
"Body/HTML": null,
"Body/Text": "",
"CC": [],
"Date": "Tue, 27 Oct 2020 16:14:20 -0000",
"Format": "",
"From": null,
"Headers": [],
"ID": "1756ad6c1dc2956a",
"RawData": null,
"Subject": null,
"To": null
},
"Gmail": {
"Attachments": "",
"Bcc": [],
"Body": "",
"Cc": [],
"Date": "Tue, 27 Oct 2020 16:14:20 -0000",
"Format": "",
"From": null,
"Headers": [],
"Html": null,
"ID": "1756ad6c1dc2956a",
"Labels": "SENT, INBOX",
"Mailbox": "user@domain.io",
"RawData": null,
"Subject": null,
"ThreadId": "1756acc01dcdedd4",
"To": null,
"Type": "Gmail"
}
}
Human Readable Output
Mailbox ID Labels user@domain.io 1756ad6c1dc2956a SENT, INBOX
gmail-move-mail-to-mailbox
Moves an email to a different mailbox.
Base Command
gmail-move-mail-to-mailbox
Input
| Argument Name | Description | Required |
|---|---|---|
| src-user-id | The source user’s email address. The “me” special value can be used to indicate the authenticated user. | Required |
| message-id | The ID of the email to retrieve. You can get the ID by running the gmail-search command, or by fetching mails and copy the incident.labels.Email/ID value from the fetched incident context. | Required |
| dst-user-id | The destination user’s email address. The “me” special value can be used to indicate the authenticated user. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Gmail.ID | string | The inner ID of the Gmail message. |
| Gmail.ThreadId | string | The thread ID. |
| Gmail.Format | string | The MIME type of email. |
| Gmail.Labels | string | The labels of the specific email. |
| Gmail.To | string | The Gmail address of the receiver. |
| Gmail.From | string | The Gmail address of the sender. |
| Gmail.Cc | string | The additional recipient email address (CC). |
| Gmail.Bcc | string | The additional recipient email address (BCC). |
| Gmail.Subject | string | The subject of the specific email. |
| Gmail.Body | string | The content of the email. |
| Gmail.Attachments | unknown | The attachments of the email. IDs are separated by commas. |
| Gmail.Headers | unknown | All headers of specific the email (list). |
| Gmail.Mailbox | string | The Gmail mailbox. |
| Email.To | String | The recipient of the email. |
| Email.From | String | The sender of the email. |
| Email.CC | String | The additional recipient email address (CC). |
| Email.BCC | String | The additional recipient email address (BCC). |
| Email.Format | String | The format of the email. |
| Email.Body/HTML | String | The HTML version of the email. |
| Email.Body/Text | String | The plain-text version of the email. |
| Email.Subject | String | The subject of the email. |
| Email.Headers | String | The headers of the email. |
| Email.Attachments.entryID | Unknown | Emails attachments. IDs are separated by commas. |
| Email.Date | String | The date the email was received. |
Command Example
!gmail-move-mail-to-mailbox src-user-id="test.user@domain.com" message-id="1756acd6df2a9793" dst-user-id="user1@domain.io"
Context Example
"Gmail": [
{
"To": "test.user@domain.com",
"Body": "Body",
"From": "user1 <user1@domain.io>",
"Attachments": "",
"Format": "text/plain",
"Cc": [],
"Labels": "",
"Mailbox": "user1@nimbledata.io",
"Headers": [
{
"Name": "X-Google-Smtp-Source",
"Value": "ABdhPJwPkMfR0oKwg+r4tGV8KBwYLK1XLNJU0b11TTJYsFjyJePPxNr4VdwJXZc0jdgC9V3uDmzLwxAAizp3dSY+fA=="
},
{
"Name": "X-Received",
"Value": "by 2002:a17:907:b19:: with SMTP id h25mr5192094ejl.368.1603990680643; Thu, 29 Oct 2020 09:58:00 -0700 (PDT)"
}
],
"Html": null,
"RawData": null,
"ThreadId": "1756acd3dcc64223",
"Date": "Tue, 27 Oct 2020 09:02:37 -0700",
"Bcc": [],
"Type": "Gmail",
"ID": "1756acc058c19cdb",
"Subject": "Re:"
}
],
"Email(val.ID && val.ID == obj.ID)": [
{
"From": "user1 <user1@domain.io>",
"CC": [],
"BCC": [],
"To": "test.user@domain.com",
"ID": "1756acc058c19cdb",
"Attachments": {
"entryID": ""
},
"Headers": [
{
"Name": "X-Google-Smtp-Source",
"Value": "ABdhPJwPkMfR0oKwg+r4tGV8KBwYLK1XLNJU0b11TTJYsFjyJePPxNr4VdwJXZc0jdgC9V3uDmzLwxAAizp3dSY+fA=="
},
{
"Name": "X-Received",
"Value": "by 2002:a17:907:b19:: with SMTP id h25mr5192094ejl.368.1603990680643; Thu, 29 Oct 2020 09:58:00 -0700 (PDT)"
}
],
"Format": "text/plain",
"Body/HTML": null,
"RawData": null,
"Body/Text": "Body",
"Date": "Tue, 27 Oct 2020 09:02:37 -0700",
"Subject": "Re:"
}
]
}
Human Readable Output
Mailbox ID Subject From To Format Body user1@domain.io 1756acc058c19cdb Re: user1 user1@domain.io test.user@domain.com text/plain Body
gmail-add-delete-filter
Adds a rule for email deletion by address.
Base Command
gmail-add-delete-filter
Input
| Argument Name | Description | Required |
|---|---|---|
| user-id | The user’s email address. The “me” special value can be used to indicate the authenticated user. | Required |
| email-address | The email address to block messages. | Required |
Command Example
!gmail-add-delete-filter user-id="user@domain.io" email-address="user1@domain.io"
Context Example
{
"Gmail": {
"Filter": {
"Action": {
"addLabelIds": [
"TRASH"
]
},
"Criteria": {
"from": "user1@domain.io"
},
"ID": "ANe1BmjeWtVj1i4t6dCiDJ8F54cAlqebm2k3rQ",
"Mailbox": "user@domain.io"
}
},
"GmailFilter": {
"Action": {
"addLabelIds": [
"TRASH"
]
},
"Criteria": {
"from": "user1@domain.io"
},
"ID": "ANe1BmjeWtVj1i4t6dCiDJ8F54cAlqebm2k3rQ",
"Mailbox": "user@domain.io"
}
}
Human Readable Output
New filter
ID Criteria Action ANe1BmjeWtVj1i4t6dCiDJ8F54cAlqebm2k3rQ from: user1@domain.io addLabelIds: TRASH
gmail-add-filter
Adds a new filter.
Base Command
gmail-add-filter
Input
| Argument Name | Description | Required |
|---|---|---|
| user-id | The user’s email address. The “me” special value can be used to indicate the authenticated user. | Required |
| from | The sender’s display name or email address. | Optional |
| to | The recipient’s display name or email address. Includes recipients in the “to”, “cc”, and “bcc” header fields. You can use the local part of the email address. For example, “example” and “example@” both match “example@gmail.com”. This field is case-insensitive. | Optional |
| subject | The email subject. | Optional |
| query | Returns messages matching the specified query. Supports the same query format as the Gmail search box. For example, “from:someuser@example.com is:unread”. | Optional |
| has-attachments | Whether the message has any attachments. | Optional |
| size | The size of the entire RFC822 message in bytes, including all headers and attachments. | Optional |
| add-labels | A comma-separated list of labels to add to the message. | Optional |
| remove-labels | A comma-separated list of labels to remove from the message. | Optional |
| forward | The email address that the message is to be forwarded to. The email needs to be configured as a forwarding address, see https://support.google.com/mail/answer/10957?hl=en#null. | Optional |
| size-comparison | The message size in bytes compared to the size field. Possible values are: larger, smaller. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Gmail.Filter.ID | String | The filter ID. |
| Gmail.Filter.Mailbox | String | The mailbox containing the filter. |
| Gmail.Filter.Criteria | Unknown | The filter criteria. |
| Gmail.Filter.Action | Unknown | The filter action. |
Command Example
!gmail-add-filter user-id=admin@demistodev.com has-attachments=true forward=test@demistodev.com subject=phishing
Context Example
{
"Gmail": {
"Filter": {
"Action": {
"forward": "test@demistodev.com"
},
"Criteria": {
"hasAttachment": true,
"subject": "Scam"
},
"ID": "ANe1BmjTS0eUGRX96ncj1FZmbPKrXrJvVG05Pg",
"Mailbox": "admin@demistodev.com"
}
},
"GmailFilter": {
"Action": {
"forward": "test@demistodev.com"
},
"Criteria": {
"hasAttachment": true,
"subject": "Scam"
},
"ID": "ANe1BmjTS0eUGRX96ncj1FZmbPKrXrJvVG05Pg",
"Mailbox": "admin@demistodev.com"
}
}
Human Readable Output
New filter
ID Criteria Action ANe1BmjTS0eUGRX96ncj1FZmbPKrXrJvVG05Pg hasAttachment: true
subject: Scamforward: test@demistodev.com
gmail-list-filters
Lists all filters in a user’s mailbox.
Base Command
gmail-list-filters
Input
| Argument Name | Description | Required |
|---|---|---|
| user-id | The user’s email address. The “me” special value can be used to indicate the authenticated user. | Required |
| limit | The limit of the results list. Default is 100. | Optional |
| address | The list filters associated with the email address. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Gmail.Filter.ID | String | The filter ID. |
| Gmail.Filter.Mailbox | String | The mailbox containing the filter. |
| Gmail.Filter.Criteria | Unknown | The filter criteria. |
| Gmail.Filter.Action | Unknown | The filter action. |
Command Example
!gmail-list-filters user-id=user@domain.io
Context Example
{
"Gmail": {
"Filter": {
"Action": {
"addLabelIds": [
"TRASH"
]
},
"Criteria": {
"from": "user@domain.io"
},
"ID": "ANe1BmiEVq9vNXrutJQzaEKFaK2odmTyfG29RA",
"Mailbox": "user@domain.io"
}
},
"GmailFilter": {
"Action": {
"addLabelIds": [
"TRASH"
]
},
"Criteria": {
"from": "user@domain.io"
},
"ID": "ANe1BmiEVq9vNXrutJQzaEKFaK2odmTyfG29RA",
"Mailbox": "user@domain.io"
}
}
Human Readable Output
filters
ID Criteria Action ANe1BmiEVq9vNXrutJQzaEKFaK2odmTyfG29RA from: user@domain.io addLabelIds: TRASH
gmail-remove-filter
Removes a Filter.
Base Command
gmail-remove-filter
Input
| Argument Name | Description | Required |
|---|---|---|
| user-id | The user’s email address. The “me” special value can be used to indicate the authenticated user. | Required |
| filter_ids | A comma-separated list of filter IDs (can be retrieve using gmail-list-filters command). |
Required |
Context Output
There is no context output for this command.
Command Example
!gmail-remove-filter user-id=admin@demistodev.com filter_ids=id1
Human Readable Output
filters were removed successfully.
gmail-hide-user-in-directory
Hides a user’s contact information in the Global Directory, for example email address and profile information.
Base Command
gmail-hide-user-in-directory
Input
| Argument Name | Description | Required |
|---|---|---|
| user-id | The user’s email address. The “me” special value can be used to indicate the authenticated user. | Required |
| visible-globally | Whether to hide the user’s visibility in the Global Directory. Can be true to show the user in the directory (default) or false to hide the user. Possible values are: true, false. Default is true. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Account.Type | String | The account type. For example, “AD”, “LocalOS”, “Google”, “AppleID”, and so on. |
| Account.ID | String | The unique ID for the account (integration specific). For AD accounts this is the Distinguished Name (DN). |
| Account.DisplayName | String | The display name. |
| Account.Email.Address | String | The email address of the account. |
| Account.Gmail.Address | Unknown | The email assigned with current account. |
| Account.Domain | String | The domain of the account. |
| Account.Username | String | The username of the account. |
| Account.OrganizationUnit | String | The Organization Unit (OU) of the account. |
| Account.VisibleInDirectory | Boolean | Whether the account is visible in the Global Directory. |
| Account.Groups | String | Groups in which the account belongs (integration specific). For example, for AD these are groups of which the account is memberOf. |
Command Example
!gmail-hide-user-in-directory user-id=user@domain.io visible-globally=false
Context Example
{
"Account": {
"CustomerId": "C03puekhd",
"DisplayName": "user1 test1",
"Domain": "domain.io",
"Email": {
"Address": "user@domain.io"
},
"Gmail": {
"Address": "user@domain.io"
},
"Group": "admin#directory#user",
"Groups": "admin#directory#user",
"ID": "118105533760233960163",
"Type": "Google",
"UserName": "user1",
"Username": "user1",
"VisibleInDirectory": false
}
}
Human Readable Output
User user@domain.io
Type ID Username DisplayName Groups CustomerId Domain VisibleInDirectory 118105533760233960163 user1 user1 test1 admin#directory#user C03puekhd domain.io Address: user@domain.io false
gmail-set-password
Sets the password for the user.
Base Command
gmail-set-password
Input
| Argument Name | Description | Required |
|---|---|---|
| user-id | The user’s email address. The “me” special value can be used to indicate the authenticated user. | Required |
| password | A string formatted password for the user. Depends on the password policy of the organization. | Required |
Context Output
There is no context output for this command.
Command Example
!gmail-set-password user-id=user@domain.io password=user@1234
Human Readable Output
User user@domain.io password has been set.
gmail-get-autoreply
Returns the auto-reply message set for the user-account.
Base Command
gmail-get-autoreply
Input
| Argument Name | Description | Required |
|---|---|---|
| user-id | The user’s email address. The “me” special value can be used to indicate the authenticated user. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Account.Gmail.AutoReply.EnableAutoReply | Boolean | A flag that controls whether Gmail automatically replies to messages. |
| Account.Gmail.AutoReply.ResponseBody | String | Response body in plain text format. |
| Account.Gmail.AutoReply.ResponseSubject | String | Optional text to add to the subject line in vacation responses. To enable auto-replies, the response subject or the response body must not be empty. |
| Account.Gmail.AutoReply.RestrictToContact | String | A flag that determines whether responses are sent to recipients who are not in the user’s list of contacts. |
| Account.Gmail.AutoReply.RestrictToDomain | String | A flag that determines whether responses are sent to recipients who are outside of the user’s domain. This feature is only available for G Suite users. |
| Account.Gmail.Address | String | Email assigned with the current account. |
Command Example
!gmail-get-autoreply user-id=user@domain.io
Context Example
{
"Account": {
"Gmail": {
"Address": "user@domain.io",
"AutoReply": [
{
"EnableAutoReply": false,
"EndTime": null,
"ResponseBody": "body_test",
"ResponseBodyHtml": null,
"ResponseSubject": "subject_test",
"RestrictToContact": false,
"RestrictToDomain": false,
"StartTime": null
}
]
}
}
}
Human Readable Output
User user@domain.io
EnableAutoReply ResponseBody ResponseSubject RestrictToContact RestrictToDomain EnableAutoReply false body_test subject_test false false false
gmail-set-autoreply
Sets the auto-reply for the user. Note: If the body is not set, the current body will be deleted.
Base Command
gmail-set-autoreply
Input
| Argument Name | Description | Required |
|---|---|---|
| user-id | The user’s email address. The “me” special value me can be used to indicate the authenticated user. | Required |
| enable-autoReply | Whether Gmail automatically replies to messages. Set to true to automatically reply (default). Possible values are: true, false. Default is true. | Optional |
| response-subject | Optional text to add to the subject line in vacation responses. To enable auto-replies, either the response subject or the response body must not be empty. | Optional |
| response-body | Response body in plain text format. | Optional |
| response-body-entry-id | Sets the away/vacation message by passing a War Room entryID of the file for the given user. | Optional |
| start-time | Sets a start date for the vacation message to be enabled for the given user. The valid format is YYYY-MM-DD or Epoch time in milliseconds. | Optional |
| end-time | Sets an end date for the vacation message to be enabled for the given user. The valid format is YYYY-MM-DD or Epoch time in milliseconds. | Optional |
| contacts-only | Whether to send away/vacation messages to users in the contact list when set to true. Possible values are: true, false. Default is false. | Optional |
| domain-only | Whether to prevent sending away/vacation messages to recipients who are outside of the user’s domain when set to true. Possible values are: true, false. Default is false. | Optional |
| response-body-type | Whether message response body type is text or HTML. Possible values are: HTML, Text. Default is Text. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Account.Gmail.AutoReply.EnableAutoReply | Boolean | A flag that controls whether Gmail automatically replies to messages. |
| Account.Gmail.AutoReply.ResponseBody | String | Response body in plain text format. |
| Account.Gmail.AutoReply.ResponseSubject | String | Optional text to add to the subject line in vacation responses. To enable auto-replies, either the response subject or the response body must not be empty. |
| Account.Gmail.AutoReply.RestrictToContact | String | Determines whether responses are sent to recipients who are not in the user’s list of contacts. |
| Account.Gmail.AutoReply.RestrictToDomain | String | Determines whether responses are sent to recipients who are outside of the user’s domain. This feature is only available for G Suite users. |
| Account.Gmail.Address | String | Email assigned with the current account. |
| Account.Gmail.AutoReply.ResponseBodyHtml | String | Response body in HTML format. |
| Account.Gmail.AutoReply.StartTime | Number | Start time for sending auto-replies. |
| Account.Gmail.AutoReply.EndTime | Number | End time for sending auto-replies. |
Command Example
!gmail-set-autoreply user-id=user@domain.io enable-autoReply=false response-body=body_test response-subject=subject_test
Context Example
{
"Account": {
"Gmail": {
"Address": "user@domain.io",
"AutoReply": [
{
"EnableAutoReply": false,
"EndTime": null,
"ResponseBody": "body_test",
"ResponseBodyHtml": null,
"ResponseSubject": "subject_test",
"RestrictToContact": false,
"RestrictToDomain": false,
"StartTime": null
}
]
}
}
}
Human Readable Output
User user@domain.io
EnableAutoReply ResponseBody ResponseSubject RestrictToContact RestrictToDomain EnableAutoReply false body_test subject_test false false false
gmail-delegate-user-mailbox
Adds a delegate to the mailbox, without sending any verification email. The delegate user must be a member of the same G Suite organization as the delegator user and must be added using their primary email address, and not an email alias.
Base Command
gmail-delegate-user-mailbox
Input
| Argument Name | Description | Required |
|---|---|---|
| user-id | The user’s email address. The “me” special value can be used to indicate the authenticated user. | Required |
| delegate-email | The email address of the delegate. | Required |
Context Output
There is no context output for this command.
Command Example
!gmail-delegate-user-mailbox delegate-email=shai@demistodev.com user-id=admin@demistodev.com
Human Readable Output
Email shai@demistodev.com has been delegated
send-mail
Sends mail using Gmail.
Base Command
send-mail
Input
| Argument Name | Description | Required |
|---|---|---|
| to | The email addresses of the receiver. | Required |
| from | The email address of the sender. | Optional |
| senderDisplayName | The sender Name that appears on the receiver side. | Optional |
| body | The content (body) of the email to be sent in plain text. | Optional |
| subject | The subject for the email to be sent. | Required |
| attachIDs | A comma-separated list of IDs of War Room entries that contain the files that need be attached to the email. | Optional |
| cc | The additional recipient email address (CC). | Optional |
| bcc | The additional recipient email address (BCC). | Optional |
| htmlBody | The content (body) of the email to be sent in HTML format. | Optional |
| force_handle_htmlBody | Choose true if you wish to handle html body as MimeMultipart. Possible values are: False, True. Default is False. | Optional |
| replyTo | The address that needs to be used to reply to the message. | Optional |
| attachNames | A comma-separated list of new names to rename attachments corresponding to the order that they were attached to the email. Examples - To rename first and third file attachNames=new_fileName1,,new_fileName3 To rename second and fifth files attachNames=,new_fileName2,,,new_fileName5. |
Optional |
| attachCIDs | A comma-separated list of CID images to embed attachments inside the email. | Optional |
| transientFile | Textual name for an attached file. Multiple files are supported as a comma-separated list. For example, transientFile=”t1.txt,temp.txt,t3.txt” transientFileContent=”test 2,temporary file content,third file content” transientFileCID=”t1.txt@xxx.yyy,t2.txt@xxx.zzz”). |
Optional |
| transientFileContent | Content for the attached file. Multiple files are supported as a comma-separated list. For example, transientFile=”t1.txt,temp.txt,t3.txt” transientFileContent=”test 2,temporary file content,third file content” transientFileCID=”t1.txt@xxx.yyy,t2.txt@xxx.zzz”). |
Optional |
| transientFileCID | CID image for an attached file to include within the email body. Multiple files are supported as a comma-separated list. (e.g. transientFile=”t1.txt,temp.txt,t3.txt” transientFileContent=”test 2,temporary file content,third file content” transientFileCID=”t1.txt@xxx.yyy,t2.txt@xxx.zzz”). |
Optional |
| additionalHeader | A CSV list of additional headers in the format: headerName=headerValue. For example: “headerName1=headerValue1,headerName2=headerValue2”. | Optional |
| templateParams | ‘Replaces {varname} variables with values from this parameter. Expected values are in the form of a JSON document. For example, {“varname” :{“value” “some value”, “key”: “context key”}}. Each var name can either be provided with the value or a context key to retrieve the value. Note that only context data is accessible for this argument, while incident fields are not.’. |
Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Gmail.SentMail.ID | String | The immutable ID of the message. |
| Gmail.SentMail.Labels | String | The list of IDs of labels applied to this message. |
| Gmail.SentMail.ThreadId | String | The ID of the thread in which the message belongs. |
| Gmail.SentMail.To | String | The recipient of the email. |
| Gmail.SentMail.From | Unknown | The sender of the email. |
| Gmail.SentMail.Cc | String | The additional recipient email address (CC). |
| Gmail.SentMail.Bcc | String | The additional recipient email address (BCC). |
| Gmail.SentMail.Subject | String | The subject of the email. |
| Gmail.SentMail.Body | Unknown | The plain-text version of the email. |
| Gmail.SentMail.MailBox | String | The mailbox from which the mail was sent. |
Command Example
!send-mail subject="this is the subject" to=test@demistodev.com body="this is the body"
Context Example
{
"Gmail.SentMail": [
{
"Bcc": null,
"Body": "this is the body",
"Cc": null,
"From": "admin@demistodev.com",
"ID": "16d43287fc29b71a",
"Labels": [
"SENT"
],
"Mailbox": "test@demistodev.com",
"Subject": "this is the subject",
"ThreadId": "16d43287fc29b71a",
"To": "test@demistodev.com",
"Type": "Gmail"
}
]
}
Human Readable Output
Email sent
Type ID To From Subject Body Labels ThreadId Gmail 16d43287fc29b71a test@demistodev.com admin@demistodev.com this is the subject this is the body SENT 16d43287fc29b71a
reply-mail
Replies to a mail using Gmail.
Base Command
reply-mail
Input
| Argument Name | Description | Required |
|---|---|---|
| to | The email addresses of the recipients. | Required |
| from | The email address of the sender. | Optional |
| body | The contents (body) of the email to be sent in plain text. | Optional |
| subject | The subject of the email to be sent. Should be the same as the subject of the email you are replying to in order for the reply to be a part of the same conversation. | Required |
| inReplyTo | A comma-separated list of message IDs to reply to. | Required |
| references | A comma-separated list of message IDs to refer to. | Optional |
| attachIDs | A comma-separated list of IDs of War Room entries that contain the files that need to be attached to the email. | Optional |
| cc | The additional recipient email addresses (CC). | Optional |
| bcc | The additional recipient email addresses (BCC). | Optional |
| htmlBody | The content (body) of the email to be sent in HTML format. | Optional |
| replyTo | The address that needs to be used to reply to the message. | Optional |
| attachNames | A comma-separated list of new names used to rename attachments corresponding to the order in which they were attached to the email. Examples - To rename the first and third file: attachNames=new_fileName1,,new_fileName3 To rename the second and fifth files: attachNames=,new_fileName2,,,new_fileName5. |
Optional |
| attachCIDs | A comma-separated list of CID images to embed as attachments inside the email. | Optional |
| transientFile | Textual name for an attached file. Multiple files are supported as a comma-separated list. For example, transientFile=”t1.txt,temp.txt,t3.txt” transientFileContent=”test2,temporary file content,third file content” transientFileCID=”t1.txt@xxx.yyy,t2.txt@xxx.zzz”). | Optional |
| transientFileContent | Content for the attached file. Multiple files are supported as a comma-separated list. For example, transientFile=”t1.txt,temp.txt,t3.txt” transientFileContent=”test2,temporary file content,third file content” transientFileCID=”t1.txt@xxx.yyy,t2.txt@xxx.zzz”). | Optional |
| transientFileCID | CID image for an attached file to include within the email body. Multiple files are supported as a comma-separated list. (e.g. transientFile=”t1.txt,temp.txt,t3.txt” transientFileContent=”test 2,temporary file content,third file content” transientFileCID=”t1.txt@xxx.yyy,t2.txt@xxx.zzz”). | Optional |
| additionalHeader | A comma-separated list of additional headers in the format: headerName=headerValue. For example: “headerName1=headerValue1,headerName2=headerValue2”. | Optional |
| templateParams | ‘Replaces {varname} variables with values from this parameter. Expected values are in the form of a JSON document. For example, {“varname” :{“value” “some value”, “key”: “context key”}}. Each var name can either be provided with the value or a context key to retrieve the value. Note that only context data is accessible for this argument, while incident fields are not.’. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Gmail.SentMail.ID | String | The immutable ID of the message. |
| Gmail.SentMail.Labels | String | The list of IDs of the labels applied to this message. |
| Gmail.SentMail.ThreadId | String | The ID of the thread in which the message belongs. |
| Gmail.SentMail.To | String | The recipients of the email. |
| Gmail.SentMail.From | Unknown | The sender of the email. |
| Gmail.SentMail.Cc | String | The additional recipient email addresses (CC). |
| Gmail.SentMail.Bcc | String | The additional recipient email addresses (BCC). |
| Gmail.SentMail.Subject | String | The subject of the email. |
| Gmail.SentMail.Body | Unknown | The plain-text version of the email. |
| Gmail.SentMail.MailBox | String | The mailbox from which the mail was sent. |
Command Example
!reply-mail subject="this is the subject" to=test@demistodev.com replyTo=test@demistodev.com body="this is the body" inReplyTo=<CAEvnzx+zEeFJ1U5g4FOfHKeWe-H3hU7kGiKaK7q0F0A@mail.gmail.com> references=<CAEvnzx+zEeFJ1U5g4FOfHKeWe-H3hU7kGiKaK7q0F0A@mail.gmail.com>
Context Example
{
"Gmail.SentMail": [
{
"Bcc": null,
"Body": "this is the body",
"Cc": null,
"From": "admin@demistodev.com",
"ID": "16d43287fc29b71a",
"Labels": [
"SENT"
],
"Mailbox": "test@demistodev.com",
"Subject": "this is the subject",
"ThreadId": "16d43287fc29b71a",
"To": "test@demistodev.com",
"Type": "Gmail"
}
]
}
Human Readable Output
Email sent
Type ID To From Subject Body Labels ThreadId Gmail 16d43287fc29b71a test@demistodev.com admin@demistodev.com this is the subject this is the body SENT 16d43287fc29b71a
gmail-remove-delegated-mailbox
Removes a delegate from the mailbox without sending any verification email. The delegate user must be a member of the same G Suite organization as the delegator user using their primary email address, and not an email alias.
Base Command
gmail-remove-delegated-mailbox
Input
| Argument Name | Description | Required |
|---|---|---|
| user-id | The user’s email address. The “me” special value can be used to indicate the authenticated user. | Required |
| removed-mail | The email address to remove from delegation. | Required |
Context Output
There is no context output for this command.
Command Example
!gmail-remove-delegated-mailbox removed-mail=shai@demistodev.com user-id=admin@demistodev.com
Human Readable Output
Email shai@demistodev.com has been removed from delegation
gmail-get-role
Gets details of a specific role.
Base Command
gmail-get-role
Input
| Argument Name | Description | Required |
|---|---|---|
| role-id | The ID of the role. Can be retrieved using the get-user-roles command. | Required |
| customer-id | The immutable Google Apps ID. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Gmail.Role.ETag | String | The ETag of the resource. |
| Gmail.Role.IsSuperAdminRole | Boolean | Indicates whether the role is a super admin role. |
| Gmail.Role.IsSystemRole | Boolean | Indicates whether the role is a pre-defined system role. |
| Gmail.Role.Kind | String | The kind of the role. |
| Gmail.Role.Description | String | The description of the role. |
| Gmail.Role.ID | String | The ID of the role. |
| Gmail.Role.Name | String | The name of the role. |
| Gmail.Role.Privilege.ServiceID | String | The ID of the service this privilege is for. |
| Gmail.Role.Privilege.Name | String | The name of the privilege. |
Command Example
!gmail-get-role role-id=13801188331880449 customer-id=C03puekhd
Context Example
{
"Gmail": {
"Role": {
"Description": "Google Apps Administrator Seed Role",
"ETag": "HKDSgTnCxrWl3RtRnlZSCPY3NjdWJxz53nrhwSz7ob4/Y2lKFcwh-5YCBqMXBNWR3Ezo8ik",
"ID": "13801188331880449",
"IsSuperAdminRole": true,
"IsSystemRole": true,
"Kind": "admin#directory#role",
"Name": "_SEED_ADMIN_ROLE",
"Privilege": [
{
"Name": "SUPER_ADMIN",
"ServiceID": "01ci93xb3tmzyin"
},
{
"Name": "ROOT_APP_ADMIN",
"ServiceID": "01664s550kmxmin"
},
{
"Name": "ROOT_APP_ADMIN",
"ServiceID": "03j2qqm31d4j55e"
},
{
"Name": "ROOT_APP_ADMIN",
"ServiceID": "0319y80a15kueje"
},
{
"Name": "ROOT_APP_ADMIN",
"ServiceID": "03znysh70xi7xn7"
},
{
"Name": "ROOT_APP_ADMIN",
"ServiceID": "03fwokq01e2ht7x"
},
{
"Name": "ROOT_APP_ADMIN",
"ServiceID": "00haapch16h1ysv"
},
{
"Name": "ROOT_APP_ADMIN",
"ServiceID": "037m2jsg3ckz96v"
},
{
"Name": "ROOT_APP_ADMIN",
"ServiceID": "03cqmetx3hnlpuf"
},
{
"Name": "ROOT_APP_ADMIN",
"ServiceID": "03hv69ve4bjwe54"
},
{
"Name": "ROOT_APP_ADMIN",
"ServiceID": "01tuee744837sjz"
},
{
"Name": "ROOT_APP_ADMIN",
"ServiceID": "02afmg282jiquyg"
},
{
"Name": "ROOT_APP_ADMIN",
"ServiceID": "02w5ecyt3pkeyqi"
},
{
"Name": "ROOT_APP_ADMIN",
"ServiceID": "00vx122734tbite"
},
{
"Name": "ROOT_APP_ADMIN",
"ServiceID": "03dy6vkm2sk0pzo"
},
{
"Name": "ROOT_APP_ADMIN",
"ServiceID": "02pta16n3efhw69"
},
{
"Name": "ROOT_APP_ADMIN",
"ServiceID": "01ksv4uv2d2noaq"
},
{
"Name": "ROOT_APP_ADMIN",
"ServiceID": "0279ka651l5iy5q"
},
{
"Name": "ROOT_APP_ADMIN",
"ServiceID": "01yyy98l4k9lq4l"
},
{
"Name": "ROOT_APP_ADMIN",
"ServiceID": "02zbgiuw2wdxo5p"
},
{
"Name": "ROOT_APP_ADMIN",
"ServiceID": "03whwml44f3n4vd"
},
{
"Name": "ROOT_APP_ADMIN",
"ServiceID": "039kk8xu49mji9t"
},
{
"Name": "ROOT_APP_ADMIN",
"ServiceID": "02afmg283v5nmx6"
},
{
"Name": "ROOT_APP_ADMIN",
"ServiceID": "02bn6wsx379ol8g"
},
{
"Name": "ROOT_APP_ADMIN",
"ServiceID": "00tyjcwt49hs5nq"
},
{
"Name": "ROOT_APP_ADMIN",
"ServiceID": "00meukdy0whjvor"
}
]
}
}
}
Human Readable Output
Role 13801188331880449 details
ETag IsSuperAdminRole IsSystemRole Kind Description ID Name HKDSgTnCxrWl3RtRnlZSCPY3NjdWJxz53nrhwSz7ob4/Y2lKFcwh-5YCBqMXBNWR3Ezo8ik true true admin#directory#role Google Apps Administrator Seed Role 13801188331880449 _SEED_ADMIN_ROLE
Role 13801188331880449 privileges
ServiceID Name 01ci93xb3tmzyin SUPER_ADMIN 01664s550kmxmin ROOT_APP_ADMIN 03j2qqm31d4j55e ROOT_APP_ADMIN 0319y80a15kueje ROOT_APP_ADMIN 03znysh70xi7xn7 ROOT_APP_ADMIN 03fwokq01e2ht7x ROOT_APP_ADMIN 00haapch16h1ysv ROOT_APP_ADMIN 037m2jsg3ckz96v ROOT_APP_ADMIN 03cqmetx3hnlpuf ROOT_APP_ADMIN 03hv69ve4bjwe54 ROOT_APP_ADMIN 01tuee744837sjz ROOT_APP_ADMIN 02afmg282jiquyg ROOT_APP_ADMIN 02w5ecyt3pkeyqi ROOT_APP_ADMIN 00vx122734tbite ROOT_APP_ADMIN 03dy6vkm2sk0pzo ROOT_APP_ADMIN 02pta16n3efhw69 ROOT_APP_ADMIN 01ksv4uv2d2noaq ROOT_APP_ADMIN 0279ka651l5iy5q ROOT_APP_ADMIN 01yyy98l4k9lq4l ROOT_APP_ADMIN 02zbgiuw2wdxo5p ROOT_APP_ADMIN 03whwml44f3n4vd ROOT_APP_ADMIN 039kk8xu49mji9t ROOT_APP_ADMIN 02afmg283v5nmx6 ROOT_APP_ADMIN 02bn6wsx379ol8g ROOT_APP_ADMIN 00tyjcwt49hs5nq ROOT_APP_ADMIN 00meukdy0whjvor ROOT_APP_ADMIN
gmail-send-as-add
Creates a custom “from” send-as alias. If an SMTP MSA is specified, Gmail will attempt to connect to the SMTP service to validate the configuration before creating the alias. If ownership verification is required for the alias, a message will be sent to the email address and the resource’s verification status will be set to pending; otherwise, the resource will be created with verification status set to accepted. If a signature is provided, Gmail will sanitize the HTML before saving it with the alias.
This command is only available to service account clients who have been delegated domain-wide authority.
Base Command
gmail-send-as-add
Input
| Argument Name | Description | Required |
|---|---|---|
| user_id | The user’s email address. | Required |
| send_as_email | The email address that appears in the “From:” header for email sent using this alias. | Required |
| display_name | The name that appears in the “From:” header for mail sent using this alias. For custom “from” addresses, when this is empty, Gmail will populate the “From:” header with the name that is used for the primary address associated with the account. If the admin disabled the ability for users to update their name format, requests to update this field for the primary login will silently fail. | Optional |
| signature | An optional HTML signature that is included in messages composed with this alias in the Gmail web UI. | Optional |
| reply_to_address | An optional email address that is included in a “Reply-To:” header for email sent using this alias. If this is empty, Gmail will not generate a “Reply-To:” header. | Optional |
| is_default | Whether this address is selected as the default “From:” address in situations such as composing a new message or sending a vacation auto-reply. Every Gmail account has exactly one default send-as address, so the only legal value that clients may write to this field is true. Changing this from false to true for an address will result in this field becoming false for the other previous default address. Default is “false”. Possible values are: true, false. Default is false. | Optional |
| treat_as_alias | Whether Gmail should treat this address as an alias for the user’s primary email address. This setting only applies to custom “from” aliases. Default is “false”. Possible values are: true, false. Default is false. | Optional |
| smtp_host | The hostname of the SMTP service. Required for SMTP configuration. | Optional |
| smtp_port | The port of the SMTP service. Required for SMTP configuration. | Optional |
| smtp_username | The username that will be used for authentication with the SMTP service. This is a write-only field that can be specified in requests to create or update SendAs settings. | Optional |
| smtp_password | The password that will be used for authentication with the SMTP service. This is a write-only field that can be specified in requests to create or update SendAs settings. | Optional |
| smtp_securitymode | The protocol that will be used to secure communication with the SMTP service. Required for SMTP configuration. Available Options: SECURITY_MODE_UNSPECIFIED - Unspecified security mode. NONE - Communication with the remote SMTP service is unsecured. Requires port 25. SSL - Communication with the remote SMTP service is secured using SSL. STARTTLS - Communication with the remote SMTP service is secured using STARTTLS. Possible values are: SECURITY_MODE_UNSPECIFIED, NONE, SSL, STARTTLS. |
Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Gmail.SendAs.userId | String | The user’s email address. |
| Gmail.SendAs.sendAsEmail | String | The updated send-as alias. |
| Gmail.SendAs.signature | String | An optional HTML signature that is included in messages composed with this alias in the Gmail web UI. |
| Gmail.SendAs.isPrimary | Boolean | Whether this address is the primary address used to login to the account. |
| Gmail.SendAs.isDefault | Boolean | Whether this address is selected as the default “From:” address in situations. |
| Gmail.SendAs.treatAsAlias | Boolean | Whether Gmail should treat this address as an alias for the user’s primary email address. |
| Gmail.SendAs.smtpMsaHost | String | The hostname of the SMTP service. |
| Gmail.SendAs.smtpMsaPort | String | The port of the SMTP service. |
| Gmail.SendAs.smtpMsaSecurityMode | String | The protocol that will be used to secure communication with the SMTP service. |
| Gmail.SendAs.verificationStatus | String | Indicates whether this address has been verified for use as a send-as alias. |
| Gmail.SendAs.replyToAddress | String | A name that appears in the “From:” header for email sent using this alias. |
Command Example
!gmail-send-as-add send_as_email=user2@domain.io user_id=user1@domain.io
context Example
{
"Gmail.SendAs": {
"displayName": "",
"isDefault": false,
"replyToAddress": "",
"sendAsEmail": "user2@domain.io",
"signature": "",
"treatAsAlias": false,
"userId": "user1@domain.io",
"verificationStatus": "accepted"
}
}
Human Readable Output
A custom “user2@domain.io” send-as alias created for “user1@domain.io”
Send As Email Treat As Alias user2@domain.io false
gmail-forwarding-address-add
Creates a forwarding address. If ownership verification is required, a message will be sent to the recipient and the resource’s verification status will be set to pending; otherwise, the resource will be created with verification status set to accepted. This method is only available to service account clients that have been delegated domain-wide authority. The special value “me” can be used to indicate the authenticated user.
Base Command
gmail-forwarding-address-add
Input
| Argument Name | Description | Required |
|---|---|---|
| forwarding_email | A comma-separated list of email addresses to which messages can be forwarded. | Required |
| user_id | The user email address or the user ID, use the !gmail-list-users command, in order to get the user ID. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Gmail.ForwardingAddress.forwardingEmail | String | An email address to which messages can be forwarded. |
| Gmail.ForwardingAddress.userId | String | The user’s email address. |
| Gmail.ForwardingAddress.verificationStatus | String | Indicates whether this address has been verified and is usable for forwarding. |
Command example
!gmail-forwarding-address-add forwarding_email="test@gmail.com" user_id="me"
Context Example
{
"Gmail": {
"ForwardingAddress": {
"forwardingEmail": "test@gmail.com",
"userId": "me",
"verificationStatus": "accepted"
}
}
}
Human Readable Output
Forwarding addresses results for “me”
forwardingEmail userId verificationStatus test@gmail.com me accepted
gmail-forwarding-address-update
Updates the auto-forwarding setting for the specified account. A verified forwarding address must be specified when auto-forwarding is enabled.
Base Command
gmail-forwarding-address-update
Input
| Argument Name | Description | Required |
|---|---|---|
| disposition | The state that a message should be left in after it has been forwarded. Possible values are: archive, leaveInInbox, markRead, trash. | Optional |
| forwarding_email | A comma-separated list of emails addresses to which messages can be forwarded. | Required |
| user_id | The user email address or the user ID, use the !gmail-list-users command, in order to get the user ID. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Gmail.ForwardingAddress.forwardingEmail | String | An email address to which messages can be forwarded. |
| Gmail.ForwardingAddress.userId | String | The user’s email address. |
| Gmail.ForwardingAddress.Disposition | String | The state that a message should be left in after it has been forwarded. |
| Gmail.ForwardingAddress.Enabled | Boolean | Indicates whether all incoming mail is automatically forwarded to another address. |
Command example
!gmail-forwarding-address-update forwarding_email="test@gmail.com" user_id="me" disposition="archive"
Context Example
{
"Gmail": {
"ForwardingAddress": {
"disposition": "archive",
"enabled": true,
"forwardingEmail": "test@gmail.com",
"userId": "me"
}
}
}
Human Readable Output
Forwarding addresses update results for “me”
forwardingEmail userId disposition enabled test@gmail.com me archive true
gmail-forwarding-address-get
Gets the specified forwarding address or a list of the forwarding addresses for the specified account.
Base Command
gmail-forwarding-address-get
Input
| Argument Name | Description | Required |
|---|---|---|
| user_id | The user email address or the user ID, use the !gmail-list-users command, in order to get the user ID. | Required |
| forwarding_email | The forwarding address to be retrieved. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Gmail.ForwardingAddress.userId | String | The user email address or the user ID, use the !gmail-list-users command, in order to get the user ID. |
| Gmail.ForwardingAddress.forwardingEmail | String | An email address to which messages can be forwarded. |
Command example
!gmail-forwarding-address-get forwarding_email="test@gmail.com" user_id="me"
Context Example
{
"Gmail": {
"ForwardingAddress": {
"forwardingEmail": "test@gmail.com",
"userId": "me",
"verificationStatus": "accepted"
}
}
}
Human Readable Output
Get forwarding address for: “me”
forwardingEmail verificationStatus test@gmail.com accepted
gmail-forwarding-address-remove
Deletes the specified forwarding address and revokes any verification that may have been required. This method is only available to service account clients that have been delegated domain-wide authority.
Base Command
gmail-forwarding-address-remove
Input
| Argument Name | Description | Required |
|---|---|---|
| user_id | The user email address or the user ID, use the !gmail-list-users command, in order to get the user ID. | Required |
| forwarding_email | The forwarding address to be retrieved. | Required |
Context Output
There is no context output for this command.
Command example
!gmail-forwarding-address-remove forwarding_email="test@gmail.com" user_id="me"
Human Readable Output
Forwarding address “test@gmail.com” for “me” was deleted successfully .
gmail-forwarding-address-list
Lists the forwarding addresses for the specified account.
Base Command
gmail-forwarding-address-list
Input
| Argument Name | Description | Required |
|---|---|---|
| user_id | The user email address or the user ID, use the !gmail-list-users command, in order to get the user ID. The special value “me” can be used to indicate the authenticated user. | Required |
| limit | The maximum number of addresses to return. The default value is 50. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Gmail.ForwardingAddress.forwardingEmail | String | An email address to which messages can be forwarded. |
| Gmail.ForwardingAddress.verificationStatus | String | Indicates whether this address has been verified and is usable for forwarding. |
Command example
!gmail-forwarding-address-list user_id="me"
Context Example
{
"Gmail": {
"ForwardingAddress": [
{
"forwardingEmail": "test@gmail.com",
"userId": "me",
"verificationStatus": "accepted"
},
{
"forwardingEmail": "test1@gmail.com",
"userId": "me",
"verificationStatus": "accepted"
},
{
"forwardingEmail": "test2@gmail.com",
"userId": "me",
"verificationStatus": "accepted"
},
{
"forwardingEmail": "test3@gmail.com",
"userId": "me",
"verificationStatus": "accepted"
},
]
}
}
Human Readable Output
Forwarding addresses list for: “me”
forwardingEmail verificationStatus test@gmail.com accepted test1@gmail.com accepted test2@gmail.com accepted test3@gmail.com accepted
Configuration parameters
adminEmail— Email of user with admin privileges (required)query— Events search queryqueryUserKey— Events user keygappsID— Immutable Google Apps IDisFetch— Fetch incidentsinsecure— Trust any certificate (not secure)proxy— Use system proxy settingsincidentType— Incident typeincidentFetchInterval— Incidents Fetch Intervalfetch_time— First fetch timestamp, in days.fetch_limit— Maximum number of emails to pull per fetchlegacy_name— Use legacy attachment name
Commands (35)
-
gmail-add-delete-filterAdds a rule for email deletion by address.
-
gmail-add-filterAdds a new filter.
-
gmail-create-userCreates a new Gmail user.
-
gmail-delegate-user-mailboxAdds a delegate to the mailbox, without sending any verification email. The delegate user must be a member of the same G Suite organization as the delegator user and must be added using their primary email address, and not an email alias.
-
gmail-delete-mailDeletes an email in the user's mailbox.
-
gmail-delete-userDeletes a Gmail user.
-
gmail-forwarding-address-addCreates a forwarding address. If ownership verification is required, a message will be sent to the recipient and the resource's verification status will be set to pending; otherwise, the resource will be created with verification status set to accepted. This method is only available to service account clients that have been delegated domain-wide authority. The special value "me" can be used to indicate the authenticated user.
-
gmail-forwarding-address-getGets the specified forwarding address or a list of the forwarding addresses for the specified account.
-
gmail-forwarding-address-listLists the forwarding addresses for the specified account.
-
gmail-forwarding-address-removeDeletes the specified forwarding address and revokes any verification that may have been required. This method is only available to service account clients that have been delegated domain-wide authority.
-
gmail-forwarding-address-updateUpdates the auto-forwarding setting for the specified account. A verified forwarding address must be specified when auto-forwarding is enabled.
-
gmail-get-attachmentsRetrieves attachments from a sent Gmail message.
-
gmail-get-autoreplyReturns the auto-reply message set for the user-account.
-
gmail-get-mailRetrieves the Gmail message sent to a specified user.
-
gmail-get-roleGets details of a specific role.
-
gmail-get-threadReturns all messages in a thread.
-
gmail-get-tokens-for-userLists all tokens associated with a specified user.
-
gmail-get-userGets information for a specified user.
-
gmail-get-user-rolesRetrieves a list of all Google roles for a specified user.
-
gmail-hide-user-in-directoryHides a user's contact information in the Global Directory, for example email address and profile information.
-
gmail-list-filtersLists all filters in a user's mailbox.
-
gmail-list-labelsLists all labels in the user's mailbox.
-
gmail-list-usersLists all Google users in a domain.
-
gmail-move-mailMoves an email to a different folder.
-
gmail-move-mail-to-mailboxMoves an email to a different mailbox.
-
gmail-remove-delegated-mailboxRemoves a delegate from the mailbox without sending any verification email. The delegate user must be a member of the same G Suite organization as the delegator user using their primary email address, and not an email alias.
-
gmail-remove-filterRemoves a Filter.
-
gmail-revoke-user-roleRevokes a role for a specified Google user.
-
gmail-searchSearches for Gmail records for a specific Google user.
-
gmail-search-all-mailboxesSearches the Gmail records for all Google users. (For more than 2500 accounts, use with the `Search all mailboxes - Gmail with polling` playbook).
-
gmail-send-as-addCreates a custom "from" send-as alias. If an SMTP MSA is specified, Gmail will attempt to connect to the SMTP service to validate the configuration before creating the alias. If ownership verification is required for the alias, a message will be sent to the email address and the resource's verification status will be set to pending; otherwise, the resource will be created with verification status set to accepted. If a signature is provided, Gmail will sanitize the HTML before saving it with the alias. This command is only available to service account clients who have been delegated domain-wide authority.
-
gmail-set-autoreplySets the auto-reply for the user. Note: If the body is not set, the current body will be deleted.
-
gmail-set-passwordSets the password for the user.
-
reply-mailReplies to a mail using Gmail.
-
send-mailSends mail using Gmail.
import uuid import demistomock as demisto from CommonServerPython import * from CommonServerUserPython import * """ IMPORTS """ import base64 import concurrent.futures import copy import itertools as it import json import mimetypes import random import re import string import sys from datetime import datetime, timedelta from email.header import Header from email.mime.application import MIMEApplication from email.mime.audio import MIMEAudio from email.mime.base import MIMEBase from email.mime.image import MIMEImage from email.mime.multipart import MIMEMultipart from email.mime.text import MIMEText from email.utils import format_datetime, parsedate_to_datetime from html.entities import name2codepoint from html.parser import HTMLParser from typing import * from urllib.parse import urlparse import google_auth_httplib2 import httplib2 from apiclient import discovery from google.oauth2 import service_account from googleapiclient.errors import HttpError """ HELPER FUNCTIONS """ def validate_gmail_message_id(message_id: str | None) -> str: """Validate that the message-id is a valid Gmail internal ID. Gmail internal message IDs are alphanumeric strings (e.g., '18a1b2c3d4e5f6g7'). They should NOT be RFC 822 Message-ID headers (e.g., '<local-part@domain>'), which contain angle brackets, '@', or spaces. Args: message_id: The message ID to validate. Returns: The validated message ID (stripped of whitespace). Raises: ValueError: If the message ID is missing or appears to be an RFC 822 Message-ID. """ message_id = (message_id or "").strip() if not message_id: raise ValueError("'message-id' argument is required.") if re.search(r"[<>@\s]", message_id): # pylint: disable=E1101 raise ValueError( f"Invalid Gmail message ID: '{message_id}'. " "Gmail internal message IDs are alphanumeric strings (e.g., '18a1b2c3d4e5f6g7'). " "If you have an RFC 822 Message-ID (e.g., '<...@domain>'), " "use 'gmail-search' with the 'Rfc822msgid:' query operator to find the internal ID first." ) return message_id """ GLOBAL VARS """ ADMIN_EMAIL = "" # set from params later on PRIVATE_KEY_CONTENT = None GAPPS_ID = None SCOPES = ["https://www.googleapis.com/auth/admin.directory.user.readonly"] PROXY = demisto.params().get("proxy") DISABLE_SSL = demisto.params().get("insecure", False) FETCH_TIME = demisto.params().get("fetch_time", "1 days") LEGACY_NAME = argToBoolean(demisto.params().get("legacy_name", False)) SEND_AS_SMTP_FIELDS = ["host", "port", "username", "password", "securitymode"] DATE_FORMAT = "%Y-%m-%d" # sample - 2020-08-23 BATCH_DIVIDER = 5 MAX_USERS = 2500 MAX_WITHOUT_POLLING = 500 """ HELPER FUNCTIONS """ class TextExtractHtmlParser(HTMLParser): def __init__(self): HTMLParser.__init__(self) self._texts = [] # type: list self._ignore = False def handle_starttag(self, tag, attrs): # noqa: F841 if tag in ("p", "br") and not self._ignore: # ignore self._texts.append("\n") elif tag in ("script", "style"): self._ignore = True def handle_startendtag(self, tag, attrs): # noqa: F841 if tag in ("br", "tr") and not self._ignore: self._texts.append("\n") def handle_endtag(self, tag): if tag in ("p", "tr"): self._texts.append("\n") elif tag in ("script", "style"): self._ignore = False def handle_data(self, data): if data and not self._ignore: stripped = data.strip() if stripped: self._texts.append(re.sub(r"\s+", " ", stripped)) # pylint: disable=E1101 def handle_entityref(self, name): if not self._ignore and name in name2codepoint: self._texts.append(chr(name2codepoint[name])) def handle_charref(self, name): if not self._ignore: if name.startswith("x"): c = chr(int(name[1:], 16)) else: c = chr(int(name)) self._texts.append(c) def get_text(self): return "".join(self._texts) def html_to_text(html): parser = TextExtractHtmlParser() try: parser.feed(html) parser.close() except Exception as e: demisto.error(f"The following error occurred while parsing the HTML: {e}") return parser.get_text() # disable-secrets-detection-start def get_http_client_with_proxy(proxies): proxy_info = None if PROXY: if not proxies or not proxies["https"]: raise Exception("https proxy value is empty. Check Demisto server configuration") https_proxy = proxies["https"] if not https_proxy.startswith("https") and not https_proxy.startswith("http"): https_proxy = "https://" + https_proxy parsed_proxy = urlparse(https_proxy) proxy_info = httplib2.ProxyInfo( proxy_type=httplib2.socks.PROXY_TYPE_HTTP, # disable-secrets-detection proxy_host=parsed_proxy.hostname, proxy_port=parsed_proxy.port, proxy_user=parsed_proxy.username, proxy_pass=parsed_proxy.password, ) return httplib2.Http(proxy_info=proxy_info, disable_ssl_certificate_validation=DISABLE_SSL) # disable-secrets-detection-end def get_credentials(additional_scopes=None, delegated_user=None): """Gets valid user credentials from storage. If nothing has been stored, or if the stored credentials are invalid, the OAuth2 flow is completed to obtain the new credentials. Returns: Credentials, the obtained credential. """ if not delegated_user or delegated_user == "me": delegated_user = ADMIN_EMAIL scopes = SCOPES if additional_scopes is not None: scopes += additional_scopes json_acct_info = json.loads(PRIVATE_KEY_CONTENT) # type: ignore credentials = service_account.Credentials.from_service_account_info(json_acct_info) scoped_credentials = credentials.with_scopes(scopes) delegated_credentials = scoped_credentials.with_subject(delegated_user) return delegated_credentials def get_service(serviceName, version, additional_scopes=None, delegated_user=None): credentials = get_credentials(additional_scopes=additional_scopes, delegated_user=delegated_user) proxies = handle_proxy() if PROXY or DISABLE_SSL: http_client = google_auth_httplib2.AuthorizedHttp(credentials, http=get_http_client_with_proxy(proxies)) return discovery.build(serviceName, version, cache_discovery=False, http=http_client) return discovery.build(serviceName, version, cache_discovery=False, credentials=credentials) def parse_mail_parts(parts): body = "" html = "" attachments = [] # type: list for part in parts: if "multipart" in part["mimeType"] and part.get("parts"): part_body, part_html, part_attachments = parse_mail_parts(part["parts"]) body += part_body html += part_html attachments.extend(part_attachments) elif len(part["filename"]) == 0: text = str(base64.urlsafe_b64decode(part["body"].get("data", "").encode("ascii")), "utf-8") if "text/html" in part["mimeType"]: html += text else: body += text else: if part["body"].get("attachmentId") is not None: attachmentName = part["filename"] content_id = "" is_inline = False for header in part.get("headers", []): if header.get("name") == "Content-ID": content_id = header.get("value").strip("<>") if header.get("name") == "Content-Disposition": is_inline = "inline" in header.get("value").strip("<>") if is_inline and content_id and content_id != "None" and not LEGACY_NAME: attachmentName = f"{content_id}-attachmentName-{attachmentName}" attachments.append( { "ID": part["body"]["attachmentId"], "Name": attachmentName, } ) return body, html, attachments def format_fields_argument(fields: list[str]) -> list[str] | None: """ Checks if the filter fields are valid, if so returns the valid fields, otherwise returns `None`, when given an empty list returns `None`. """ all_valid_fields = ( "Type", "Mailbox", "ThreadId", "Labels", "Headers", "Attachments", "RawData", "Format", "Subject", "From", "To", "Body", "Cc", "Bcc", "Date", "Html", "Attachment Names", ) lower_filter_fields = {field.lower() for field in fields} if valid_fields := [field for field in all_valid_fields if field.lower() in lower_filter_fields]: valid_fields.append("ID") return valid_fields return None def filter_by_fields(full_mail: dict[str, Any], filter_fields: list[str]) -> dict: return {field: full_mail.get(field) for field in filter_fields} def parse_privileges(raw_privileges): privileges = [] for p in raw_privileges: privilege = assign_params(ServiceID=p.get("serviceId"), Name=p.get("privilegeName")) if privilege: privileges.append(privilege) return privileges def localization_extract(time_from_mail): if time_from_mail is None or len(time_from_mail) < 5: return "-0000", 0 utc = time_from_mail[-5:] if utc[0] != "-" and utc[0] != "+": return "-0000", 0 for ch in utc[1:]: if not ch.isdigit(): return "-0000", 0 delta_in_seconds = int(utc[0] + utc[1:3]) * 3600 + int(utc[0] + utc[3:]) * 60 return utc, delta_in_seconds def create_base_time(internal_date_timestamp, header_date): """ Args: internal_date_timestamp: The timestamp from the Gmail API response. header_date: The date string from the email payload. Returns: A date string in the senders local time in the format of "Mon, 26 Aug 2019 14:40:04 +0300" """ # intenalDate timestamp has 13 digits, but epoch-timestamp counts the seconds since Jan 1st 1970 # (which is currently less than 13 digits) thus a need to cut the timestamp down to size. timestamp_len = len(str(int(time.time()))) if len(str(internal_date_timestamp)) > timestamp_len: internal_date_timestamp = int(str(internal_date_timestamp)[:timestamp_len]) utc, delta_in_seconds = localization_extract(header_date) base_time = datetime.utcfromtimestamp(internal_date_timestamp) + timedelta(seconds=delta_in_seconds) base_time = str(base_time.strftime("%a, %d %b %Y %H:%M:%S")) + " " + utc return base_time def get_occurred_date(email_data: dict) -> Tuple[datetime, bool]: """Get the occurred date of an email. The date gmail uses is actually the X-Received or the top Received dates in the header. If fails finding these dates will fall back to internal date. Args: email_data (dict): email to extract from Returns: Tuple[datetime, bool]: occurred datetime, can be used for incrementing search date """ headers = demisto.get(email_data, "payload.headers") output = None if not headers or not isinstance(headers, list): demisto.error(f"couldn't get headers for msg (shouldn't happen): {email_data}") else: # use x-received or recvived. We want to use x-received first and fallback to received. for name in [ "x-received", "received", ]: header = next(filter(lambda ht: ht.get("name", "").lower() == name, headers), None) if header: val = header.get("value") if val: res = get_date_from_email_header(val) if res: output = datetime.fromtimestamp(res.timestamp(), tz=timezone.utc) demisto.debug(f"The timing from header: {name} value: {val} the result: {res}, the UTC time is {output}") break internalDate = email_data.get("internalDate") demisto.info(f"trying internalDate: {internalDate}") if internalDate and internalDate != "0": # intenalDate timestamp has 13 digits, but epoch-timestamp counts the seconds since Jan 1st 1970 # (which is currently less than 13 digits) thus a need to cut the timestamp down to size. timestamp_len = len(str(int(time.time()))) if len(str(internalDate)) >= timestamp_len: internalDate = str(internalDate)[:timestamp_len] internalDate_dt = datetime.fromtimestamp(int(internalDate), tz=timezone.utc) demisto.debug(f"{internalDate=} {internalDate_dt=}") if output and internalDate_dt: # check which time is earlier, return it output = min(output, internalDate_dt) elif internalDate_dt and not output: output = internalDate_dt if output: demisto.debug(f"The final occurred time is {output}") return output, True # we didn't get a date from anywhere demisto.info("Failed finding date from internal or headers. Using 'datetime.now()'") return datetime.now(tz=timezone.utc), False def get_date_from_email_header(header: str) -> Optional[datetime]: """Parse an email header such as Date or Received. The format is either just the date or name value pairs followed by ; and the date specification. For example: by 2002:a17:90a:77cb:0:0:0:0 with SMTP id e11csp4670216pjs; Mon, 21 Dec 2020 12:11:57 -0800 (PST) Args: header (str): header value to parse Returns: Optional[datetime]: parsed datetime """ if not header: return None try: date_part = header.split(";")[-1].strip() res = parsedate_to_datetime(date_part) if res.tzinfo is None: # some headers may contain a non TZ date so we assume utc res = res.replace(tzinfo=timezone.utc) return res except Exception as ex: demisto.debug(f"Failed parsing date from header value: [{header}]. Err: {ex}. Will ignore and continue.") return None def get_email_context(email_data, mailbox): occurred, occurred_is_valid = get_occurred_date(email_data) context_headers = email_data.get("payload", {}).get("headers", []) context_headers = [{"Name": v["name"], "Value": v["value"]} for v in context_headers] headers = {h["Name"].lower(): h["Value"] for h in context_headers} body = demisto.get(email_data, "payload.body.data") body = body.encode("ascii") if body is not None else "" parsed_body = base64.urlsafe_b64decode(body) demisto.debug(f"get_email_context {body=} {parsed_body=}") context_gmail = { "Type": "Gmail", "Mailbox": ADMIN_EMAIL if mailbox == "me" else mailbox, "ID": email_data.get("id"), "ThreadId": email_data.get("threadId"), "Labels": ", ".join(email_data.get("labelIds", [])), "Headers": context_headers, "Attachments": email_data.get("payload", {}).get("filename", ""), # only for format 'raw' "RawData": email_data.get("raw"), # only for format 'full' and 'metadata' "Format": headers.get("content-type", "").split(";")[0], "Subject": headers.get("subject"), "From": headers.get("from"), "To": headers.get("to"), # only for format 'full' "Body": str(parsed_body, "utf-8"), # only for incident "Cc": headers.get("cc", []), "Bcc": headers.get("bcc", []), "Date": format_datetime(occurred), "Html": None, } context_email = { "ID": email_data.get("id"), "Headers": context_headers, "Attachments": {"entryID": email_data.get("payload", {}).get("filename", "")}, # only for format 'raw' "RawData": email_data.get("raw"), # only for format 'full' and 'metadata' "Format": headers.get("content-type", "").split(";")[0], "Subject": headers.get("subject"), "From": headers.get("from"), "To": headers.get("to"), # only for format 'full' "Body/Text": str(parsed_body, "utf-8"), "CC": headers.get("cc", []), "BCC": headers.get("bcc", []), "Date": format_datetime(occurred), "Body/HTML": None, } if "text/html" in context_gmail["Format"]: # type: ignore context_gmail["Html"] = context_gmail["Body"] context_gmail["Body"] = html_to_text(context_gmail["Body"]) context_email["Body/HTML"] = context_gmail["Html"] context_email["Body/Text"] = context_gmail["Body"] demisto.debug(f"In text/html {context_gmail['Body']=}") if "multipart" in context_gmail["Format"]: # type: ignore context_gmail["Body"], context_gmail["Html"], context_gmail["Attachments"] = parse_mail_parts( email_data.get("payload", {}).get("parts", []) ) demisto.debug(f"In multipart {context_gmail['Body']=}") context_gmail["Attachment Names"] = ", ".join([attachment["Name"] for attachment in context_gmail["Attachments"]]) # type: ignore context_email["Body/Text"], context_email["Body/HTML"], context_email["Attachments"] = parse_mail_parts( email_data.get("payload", {}).get("parts", []) ) context_email["Attachment Names"] = ", ".join([attachment["Name"] for attachment in context_email["Attachments"]]) # type: ignore return context_gmail, headers, context_email, occurred, occurred_is_valid TIME_REGEX = re.compile(r"^([\w,\d: ]*) (([+-]{1})(\d{2}):?(\d{2}))?[\s\w\(\)]*$") # pylint: disable=E1101 def move_to_gmt(t): # there is only one time refernce is the string base_time, _, sign, hours, minutes = TIME_REGEX.findall(t)[0] if all([sign, hours, minutes]): seconds = -1 * (int(sign + hours) * 3600 + int(sign + minutes) * 60) parsed_time = datetime.strptime(base_time, "%a, %d %b %Y %H:%M:%S") + timedelta(seconds=seconds) return parsed_time.isoformat() + "Z" else: return datetime.strptime(base_time, "%a, %d %b %Y %H:%M:%S").isoformat() + "Z" def create_incident_labels(parsed_msg, headers): labels = [ {"type": "Email/ID", "value": parsed_msg["ID"]}, {"type": "Email/subject", "value": parsed_msg["Subject"]}, {"type": "Email/text", "value": parsed_msg["Body"]}, {"type": "Email/from", "value": parsed_msg["From"]}, {"type": "Email/html", "value": parsed_msg["Html"]}, ] labels.extend([{"type": "Email/to", "value": to} for to in headers.get("To", "").split(",")]) labels.extend([{"type": "Email/cc", "value": cc} for cc in headers.get("Cc", "").split(",")]) labels.extend([{"type": "Email/bcc", "value": bcc} for bcc in headers.get("Bcc", "").split(",")]) for key, val in list(headers.items()): labels.append({"type": "Email/Header/" + key, "value": val}) return labels def mailboxes_to_entry(mailboxes: list[dict]) -> list[CommandResults]: query = f"Query: {mailboxes[0].get('q') if mailboxes else ''}" found_accounts = [] errored_accounts = [] # accounts not searched, due to an error accessing them for user in mailboxes: mailbox = user.get("Mailbox") if error := user.get("Error"): errored_accounts.append({"Mailbox": mailbox, "Error": error}) elif mailbox: found_accounts.append(mailbox) else: demisto.debug(f"unexpected value: neither user['Mailbox'] nor user['Error']: {user=}") command_results = [ CommandResults( outputs_prefix="Gmail.Mailboxes", readable_output=tableToMarkdown( query, [{"Mailbox": mailbox} for mailbox in found_accounts], headers=["Mailbox"], removeNull=True ), outputs=found_accounts, ) ] if errored_accounts: command_results.append( CommandResults( outputs_prefix="Gmail.UnsearchedAcounts", outputs=errored_accounts, ) ) return command_results def emails_to_entry(title, raw_emails, format_data, mailbox, fields: list[str] | None = None): gmail_emails = [] emails = [] for email_data in raw_emails: context_gmail, _, context_email, occurred, occurred_is_valid = get_email_context(email_data, mailbox) if fields: context_gmail = filter_by_fields(context_gmail, fields) gmail_emails.append(context_gmail) emails.append(context_email) headers = { "minimal": [ "Mailbox", "ID", "Labels", "Attachment Names", ], "raw": ["MailBox", "ID", "Labels", "Attachment Names", "RawData"], "metadata": ["MailBox", "ID", "Subject", "From", "To", "Labels", "Attachment Names", "Format"], "full": ["Mailbox", "ID", "Subject", "From", "To", "Labels", "Attachment Names", "Format", "Body"], } return { "ContentsFormat": formats["json"], "Type": entryTypes["note"], "Contents": raw_emails, "ReadableContentsFormat": formats["markdown"], "HumanReadable": tableToMarkdown(title, gmail_emails, headers[format_data], removeNull=True), "EntryContext": {"Gmail(val.ID && val.ID == obj.ID)": gmail_emails, "Email(val.ID && val.ID == obj.ID)": emails}, } def get_date_isoformat_server(dt: datetime) -> str: """Get the datetime str in the format a server can parse. UTC based with Z at the end Args: dt (datetime): datetime Returns: str: string representation """ return datetime.fromtimestamp(dt.timestamp()).isoformat(timespec="seconds") + "Z" def mail_to_incident(msg, service, user_key): parsed_msg, headers, _, occurred, occurred_is_valid = get_email_context(msg, user_key) occurred_str = get_date_isoformat_server(occurred) file_names = [] command_args = { "messageId": parsed_msg["ID"], "userId": user_key, } for attachment in parsed_msg["Attachments"]: command_args["id"] = attachment["ID"] result = service.users().messages().attachments().get(**command_args).execute() file_data = base64.urlsafe_b64decode(result["data"].encode("ascii")) # save the attachment file_result = fileResult(attachment["Name"], file_data) # check for error if file_result["Type"] == entryTypes["error"]: demisto.error(file_result["Contents"]) raise Exception(file_result["Contents"]) file_names.append( { "path": file_result["FileID"], "name": attachment["Name"], } ) # date in the incident itself is set to GMT time, the correction to local time is done in Demisto incident = { "type": "Gmail", "name": parsed_msg["Subject"], "details": parsed_msg["Body"], "labels": create_incident_labels(parsed_msg, headers), "occurred": occurred_str, "attachment": file_names, "rawJSON": json.dumps(parsed_msg), } return incident, occurred, occurred_is_valid def users_to_entry(title, response, next_page_token=None): context = [] for user_data in response: username = dict_safe_get(user_data, ["name", "givenName"]) display = dict_safe_get(user_data, ["name", "fullName"]) context.append( { "Type": "Google", "ID": user_data.get("id"), "UserName": username, "Username": username, # adding to fit the new context standard "DisplayName": display, "Email": {"Address": user_data.get("primaryEmail")}, "Gmail": {"Address": user_data.get("primaryEmail")}, "Group": user_data.get("kind"), "Groups": user_data.get("kind"), # adding to fit the new context standard "CustomerId": user_data.get("customerId"), "Domain": user_data.get("primaryEmail").split("@")[1], "VisibleInDirectory": user_data.get("includeInGlobalAddressList"), } ) headers = [ "Type", "ID", "Username", "DisplayName", "Groups", "CustomerId", "Domain", "OrganizationUnit", "Email", "VisibleInDirectory", ] human_readable = tableToMarkdown(title, context, headers, removeNull=True) if next_page_token: human_readable += "\nTo get further results, rerun the command with this page-token:\n" + next_page_token return CommandResults( outputs=context, raw_response=response, readable_output=human_readable, outputs_prefix="Account", outputs_key_field=["ID", "Type"], ) def labels_to_entry(title, response, user_key): context = [] for label in response: context.append( { "UserID": user_key, "Name": label.get("name"), "ID": label.get("id"), "Type": label.get("type"), "MessageListVisibility": label.get("messageListVisibility"), "LabelListVisibility": label.get("labelListVisibility"), } ) headers = ["Name", "ID", "Type", "MessageListVisibility", "LabelListVisibility"] human_readable = tableToMarkdown(title, context, headers, removeNull=True) return CommandResults( outputs=context, raw_response=response, readable_output=human_readable, outputs_prefix="GmailLabel", outputs_key_field=["ID", "Name", "UserID"], ) def autoreply_to_entry(title, response, user_id): autoreply_context = [] for autoreply_data in response: autoreply_context.append( { "EnableAutoReply": autoreply_data.get("enableAutoReply"), "ResponseBody": autoreply_data.get("responseBodyPlainText"), "ResponseSubject": autoreply_data.get("responseSubject"), "RestrictToContact": autoreply_data.get("restrictToContacts"), "RestrictToDomain": autoreply_data.get("restrictToDomain"), "StartTime": autoreply_data.get("startTime"), "EndTime": autoreply_data.get("endTime"), "ResponseBodyHtml": autoreply_data.get("responseBodyHtml"), } ) headers = [ "EnableAutoReply", "ResponseBody", "ResponseBodyHtml", "ResponseSubject", "RestrictToContact", "RestrictToDomain", "EnableAutoReply", "StartTime", "EndTime", ] account_context = {"Address": user_id, "AutoReply": autoreply_context} return CommandResults( raw_response=autoreply_context, outputs=account_context, readable_output=tableToMarkdown(title, autoreply_context, headers, removeNull=True), outputs_prefix="Account.Gmail", outputs_key_field="Address", ) def sent_mail_to_entry(title, response, to, emailfrom, cc, bcc, body, subject): gmail_context = [] for mail_results_data in response: gmail_context.append( { "Type": "Gmail", "ID": mail_results_data.get("id"), "Labels": mail_results_data.get("labelIds", []), "ThreadId": mail_results_data.get("threadId"), "To": ",".join(to), "From": emailfrom, "Cc": ",".join(cc) if len(cc) > 0 else None, "Bcc": ",".join(bcc) if len(bcc) > 0 else None, "Subject": subject, "Body": body, "Mailbox": ",".join(to), } ) headers = ["Type", "ID", "To", "From", "Cc", "Bcc", "Subject", "Body", "Labels", "ThreadId"] return CommandResults( raw_response=response, outputs=gmail_context, readable_output=tableToMarkdown(title, gmail_context, headers, removeNull=True), outputs_prefix="Gmail.SentMail", outputs_key_field=["ID", "Type"], ) def user_roles_to_entry(title, response): context = [] for role_data in response: context.append( { "ID": role_data["roleId"], "AssignedTo": role_data["assignedTo"], "RoleAssignmentId": role_data["roleAssignmentId"], "ScopeType": role_data["scopeType"], "Kind": role_data["kind"], "OrgUnitId": role_data.get("orgUnitId", ""), } ) headers = ["ID", "RoleAssignmentId", "ScopeType", "Kind", "OrgUnitId"] human_readable = tableToMarkdown(title, context, headers, removeNull=True) return CommandResults( raw_response=context, outputs=context, readable_output=human_readable, outputs_prefix="Gmail.Role", outputs_key_field="ID" ) def tokens_to_entry(title, response): context = [] for token_data in response: context.append( { "DisplayText": token_data.get("displayText"), "ClientId": token_data.get("clientId"), "Kind": token_data.get("kind"), "Scopes": token_data.get("scopes", []), "UserKey": token_data.get("userKey"), } ) headers = ["DisplayText", "ClientId", "Kind", "Scopes", "UserKey"] return CommandResults( raw_response=context, outputs=context, readable_output=tableToMarkdown(title, context, headers, removeNull=True), outputs_prefix="Tokens", outputs_key_field="ClientId", ) def filters_to_entry(title, mailbox, response): context = [] for filter_data in response: context.append( { "ID": filter_data.get("id"), "Mailbox": mailbox, "Criteria": filter_data.get("criteria"), "Action": filter_data.get("action"), } ) headers = [ "ID", "Criteria", "Action", ] return { "ContentsFormat": formats["json"], "Type": entryTypes["note"], "Contents": context, "ReadableContentsFormat": formats["markdown"], "HumanReadable": tableToMarkdown(title, context, headers, removeNull=True), "EntryContext": {"GmailFilter(val.ID && val.ID == obj.ID)": context, "Gmail.Filter(val.ID && val.ID == obj.ID)": context}, } def role_to_entry(title, role): context = { "ETag": role.get("etag").strip('"'), "IsSuperAdminRole": bool(role.get("isSuperAdminRole")) if role.get("isSuperAdminRole") else False, "IsSystemRole": bool(role.get("isSystemRole")) if role.get("isSystemRole") else False, "Kind": role.get("kind"), "Description": role.get("roleDescription"), "ID": role.get("roleId"), "Name": role.get("roleName"), "Privilege": parse_privileges(role.get("rolePrivileges", [])), } headers = ["ETag", "IsSuperAdminRole", "IsSystemRole", "Kind", "Description", "ID", "Name"] details_hr = tableToMarkdown(title, context, headers, removeNull=True) privileges = context.get("Privilege", []) privileges_headers = ["ServiceID", "Name"] privileges_title = f"Role {context.get('ID')} privileges:" privileges_hr = tableToMarkdown(privileges_title, privileges, privileges_headers, removeNull=True) return CommandResults( raw_response=context, outputs=context, readable_output=details_hr + privileges_hr, outputs_prefix="Gmail.Role", outputs_key_field="ID", ) def dict_keys_snake_to_camelcase(dictionary): """ Converts all dictionary keys from snake case (dict_key) to lower camel case(dictKey). :param dictionary: Dictionary which may contain keys in snake_case :return: Dictionary with snake_case keys converted to lowerCamelCase """ underscore_pattern = re.compile(r"_([a-z])") # pylint: disable=E1101 return {underscore_pattern.sub(lambda i: i.group(1).upper(), key.lower()): value for (key, value) in list(dictionary.items())} def get_millis_from_date(date, arg_name): """ Convert a date string into epoch milliseconds or return epoch milliseconds as int. :param date: Date string in expected format. :param arg_name: field_name for setting proper error message. :return: Epoch milliseconds. """ try: return date_to_timestamp(date, DATE_FORMAT) except ValueError: try: return int(date) except ValueError: raise ValueError(f"{arg_name} argument is not in expected format.") def cutting_for_batches(list_accounts: list) -> List[list]: accounts: list = [] rest_accounts: list = [] batch_size = int(len(list_accounts) / BATCH_DIVIDER) if rest := len(list_accounts) % BATCH_DIVIDER: rest_accounts = list_accounts[-rest:] list_accounts = list_accounts[:-rest] accounts.extend(batch(list_accounts, batch_size)) # When the number of accounts is not exactly divisible by BATCH_DIVIDER, # We add the remaining accounts to the first batch to avoid running another polling command. if rest_accounts: accounts[0].extend(rest_accounts) return accounts def scheduled_commands_for_more_users(accounts: list, next_page_token: str) -> List[CommandResults]: accounts_batches = cutting_for_batches(accounts) command_results: list[CommandResults] = [] args = copy.deepcopy(demisto.args()) for batch in accounts_batches: args.update({"list_accounts": batch}) command_results.append( CommandResults( readable_output="Searching mailboxes, please wait...", scheduled_command=ScheduledCommand( command="gmail-search-all-mailboxes", next_run_in_seconds=10, args=copy.deepcopy(args), timeout_in_seconds=600 ), ) ) args.pop("list_accounts", None) if next_page_token: command_results.append( CommandResults(outputs_key_field="PageToken", outputs={"PageToken": {"NextPageToken": next_page_token}}) ) return command_results def get_mailboxes(max_results: int, users_next_page_token: str = None): """ Used to fetch the list of accounts for the search-all-mailboxes command """ accounts: list[str] = [] accounts_counter = 0 users_next_page_token = users_next_page_token service = get_service("admin", "directory_v1") while True: command_args = { "maxResults": min(max_results, 100), "domain": ADMIN_EMAIL.split("@")[1], "pageToken": users_next_page_token, } result = service.users().list(**command_args).execute() accounts_counter += len(result["users"]) accounts.extend([account["primaryEmail"] for account in result["users"]]) users_next_page_token = result.get("nextPageToken") if accounts_counter >= max_results: accounts = accounts[:max_results] break if users_next_page_token is None: break return accounts, users_next_page_token def information_search_process(length_accounts: int, search_from: int | None, search_to: int | None) -> CommandResults: if search_from is None or search_to is None: readable_output = f"Searching the first {length_accounts} accounts" search_from = 0 search_to = length_accounts else: search_from = search_to + 1 search_to = search_to + length_accounts readable_output = f"Searching accounts {search_from} to {search_to}" return CommandResults( readable_output=readable_output, outputs={"SearchFromAccountIndex": search_from, "SearchToAccountIndex": search_to}, ) """ FUNCTIONS """ def list_users_command() -> CommandResults: args = demisto.args() domain = args.get("domain", ADMIN_EMAIL.split("@")[1]) customer = args.get("customer") view_type = args.get("view-type-public-domain", "admin_view") query = args.get("query") sort_order = args.get("sort-order") max_results = args.get("max-results", 100) show_deleted = argToBoolean(args.get("show-deleted", "false")) projection = args.get("projection", "basic") custom_field_mask = args.get("custom_field_mask") if projection == "custom" else None page_token = args.get("page-token") users, next_page_token = list_users( domain, customer, query, sort_order, view_type, show_deleted, max_results, projection, custom_field_mask, page_token ) return users_to_entry("Users:", users, next_page_token) def list_labels_command(): args = demisto.args() user_key = args.get("user-id") labels = list_labels(user_key) return labels_to_entry(f"Labels for UserID {user_key}:", labels, user_key) def list_users( domain, customer=None, query=None, sort_order=None, view_type="admin_view", show_deleted=False, max_results=100, projection="basic", custom_field_mask=None, page_token=None, ): command_args = { "domain": domain, "customer": customer, "viewType": view_type, "query": query, "sortOrder": sort_order, "projection": projection, "showDeleted": show_deleted, "maxResults": max_results, "pageToken": page_token, } if projection == "custom": command_args["customFieldMask"] = custom_field_mask service = get_service("admin", "directory_v1") result = service.users().list(**command_args).execute() return result["users"], result.get("nextPageToken") def get_user_command() -> CommandResults: args = demisto.args() user_key = args.get("user-id") view_type = args.get("view-type-public-domain") projection = args.get("projection") customer_field_mask = args.get("customer-field-mask") result = get_user(user_key, view_type, projection, customer_field_mask) return users_to_entry(f"User {user_key}:", [result]) def get_user(user_key, view_type, projection, customer_field_mask=None): command_args = { "userKey": user_key if user_key != "me" else ADMIN_EMAIL, "projection": projection, "viewType": view_type, } if projection == "custom": command_args["customFieldMask"] = customer_field_mask service = get_service("admin", "directory_v1") result = service.users().get(**command_args).execute() return result def hide_user_command() -> CommandResults: args = demisto.args() user_key = args.get("user-id") hide_value = args.get("visible-globally") result = hide_user(user_key, hide_value) return users_to_entry(f"User {user_key}:", [result]) def hide_user(user_key, hide_value): command_args = { "userKey": user_key if user_key != "me" else ADMIN_EMAIL, "body": { "includeInGlobalAddressList": hide_value, }, } service = get_service("admin", "directory_v1", additional_scopes=["https://www.googleapis.com/auth/admin.directory.user"]) result = service.users().update(**command_args).execute() return result def set_user_password_command(): args = demisto.args() user_key = args.get("user-id") password = args.get("password") result = set_user_password(user_key, password) return result def set_user_password(user_key, password): command_args = { "userKey": user_key if user_key != "me" else ADMIN_EMAIL, "body": { "password": password, }, } service = get_service("admin", "directory_v1", additional_scopes=["https://www.googleapis.com/auth/admin.directory.user"]) service.users().update(**command_args).execute() return f'User {command_args["userKey"]} password has been set.' def get_autoreply_command(): args = demisto.args() user_id = args.get("user-id", ADMIN_EMAIL) autoreply_message = get_autoreply(user_id) return autoreply_to_entry(f"User {user_id}:", [autoreply_message], user_id) def get_autoreply(user_id): command_args = {"userId": user_id} service = get_service( "gmail", "v1", additional_scopes=[ "https://mail.google.com", "https://www.googleapis.com/auth/gmail.modify", "https://www.googleapis.com/auth/gmail.readonly", "https://www.googleapis.com/auth/gmail.settings.basic", ], delegated_user=user_id, ) result = service.users().settings().getVacation(**command_args).execute() return result def set_autoreply_command(): args = demisto.args() user_id = args.get("user-id") enable_autoreply = args.get("enable-autoReply") response_subject = args.get("response-subject") response_body_entry_id = args.get("response-body-entry-id") file_content = "" if response_body_entry_id and not args.get("response-body"): file_entry = demisto.getFilePath(response_body_entry_id) with open(file_entry["path"]) as f: file_content = str(f.read()) response_body_plain_text = file_content if file_content else args.get("response-body") response_body_type = args.get("response-body-type") domain_only = args.get("domain-only") contacts_only = args.get("contacts-only") start_time = get_millis_from_date(args.get("start-time"), "start-time") if args.get("start-time") else None end_time = get_millis_from_date(args.get("end-time"), "end-time") if args.get("end-time") else None autoreply_message = set_autoreply( user_id, enable_autoreply, response_subject, response_body_plain_text, domain_only, contacts_only, start_time, end_time, response_body_type, ) return autoreply_to_entry(f"User {user_id}:", [autoreply_message], user_id) def set_autoreply( user_id, enable_autoreply, response_subject, response_body_plain_text, domain_only, contacts_only, start_time, end_time, response_body_type="text", ): command_args = remove_empty_elements( { "userId": user_id if user_id != "me" else ADMIN_EMAIL, "body": { "enableAutoReply": enable_autoreply, "responseSubject": response_subject, "responseBodyPlainText": response_body_plain_text, "restrictToContacts": contacts_only, "restrictToDomain": domain_only, "startTime": start_time, "endTime": end_time, }, } ) if response_body_type.lower() == "html": command_args["body"]["responseBodyHtml"] = response_body_plain_text service = get_service( "gmail", "v1", additional_scopes=["https://www.googleapis.com/auth/gmail.settings.basic"], delegated_user=user_id ) result = service.users().settings().updateVacation(**command_args).execute() return result def remove_delegate_user_mailbox_command(): args = demisto.args() user_id = args.get("user-id") delegate_email = args.get("removed-mail") return delegate_user_mailbox(user_id, delegate_email, False) def delegate_user_mailbox_command(): args = demisto.args() user_id = args.get("user-id") delegate_email = args.get("delegate-email") return delegate_user_mailbox(user_id, delegate_email, True) def delegate_user_mailbox(user_id, delegate_email, delegate_token): service = get_service( "gmail", "v1", additional_scopes=["https://www.googleapis.com/auth/gmail.settings.sharing"], delegated_user=user_id ) if delegate_token: # guardrails-disable-line command_args = { "userId": user_id if user_id != "me" else ADMIN_EMAIL, "body": { "delegateEmail": delegate_email, }, } service.users().settings().delegates().create(**command_args).execute() return f"Email {delegate_email} has been delegated" else: command_args = {"userId": user_id if user_id != "me" else ADMIN_EMAIL, "delegateEmail": delegate_email} service.users().settings().delegates().delete(**command_args).execute() return f"Email {delegate_email} has been removed from delegation" def create_user_command(): args = demisto.args() primary_email = args["email"] first_name = args["first-name"] family_name = args["family-name"] password = args.get("password", "") if len(password) > 100 or len(password) < 8: raise ValueError("password must be over between 8 and 100 characters") result = create_user(primary_email, first_name, family_name, password) return users_to_entry("New User:", [result]) def create_user(primary_email, first_name, family_name, password): command_args = { "primaryEmail": primary_email, "name": { "givenName": first_name, "familyName": family_name, "fullName": f"{first_name} {family_name}", }, "password": password, } service = get_service("admin", "directory_v1", ["https://www.googleapis.com/auth/admin.directory.user"]) result = service.users().insert(body=command_args).execute() return result def delete_user_command(): args = demisto.args() user_key = args.get("user-id") return delete_user(user_key) def delete_user(user_key): command_args = { "userKey": user_key, } service = get_service("admin", "directory_v1", ["https://www.googleapis.com/auth/admin.directory.user"]) service.users().delete(**command_args).execute() return f'User {command_args["userKey"]} have been deleted.' def list_labels(user_key): service = get_service("gmail", "v1", ["https://www.googleapis.com/auth/gmail.readonly"], delegated_user=user_key) results = service.users().labels().list(userId=user_key).execute() labels = results.get("labels", []) return labels def get_user_role_command(): args = demisto.args() user_key = args["user-id"] user_key = ADMIN_EMAIL if user_key == "me" else user_key if GAPPS_ID is None: raise ValueError("Must provide Immutable GoogleApps Id") roles = get_user_role(user_key, GAPPS_ID) return user_roles_to_entry(f"User Roles of {user_key}:", roles) def get_user_role(user_key, customer): command_args = { "customer": customer, "maxResults": 100, } service = get_service( "admin", "directory_v1", [ "https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly", "https://www.googleapis.com/auth/admin.directory.rolemanagement", ], ) result = service.roleAssignments().list(**command_args).execute() user_data = service.users().get(userKey=user_key).execute() return [role for role in result["items"] if role["assignedTo"] == user_data["id"]] def get_role(role_identity, customer): command_args = {"customer": customer, "roleId": role_identity} service = get_service( "admin", "directory_v1", [ "https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly", "https://www.googleapis.com/auth/admin.directory.rolemanagement", ], ) return service.roles().get(**command_args).execute() def get_role_command(): args = demisto.args() role_id = args["role-id"] customer = args["customer-id"] if args.get("customer-id") else GAPPS_ID if not customer: raise ValueError("Must provide Immutable GoogleApps Id") role = get_role(role_id, customer) return role_to_entry(f"Role {role_id} details:", role) def revoke_user_roles_command(): args = demisto.args() user_key = args.get("user-id") role_assignment_id = args["role-assignment-id"] revoke_user_roles(user_key, role_assignment_id) return "Role has been deleted." def revoke_user_roles(user_id, role_assignment_id): command_args = { "customer": GAPPS_ID, "roleAssignmentId": role_assignment_id, } if GAPPS_ID is None: raise ValueError("Must provide Immutable GoogleApps Id") service = get_service("admin", "directory_v1", ["https://www.googleapis.com/auth/admin.directory.rolemanagement"]) return service.roleAssignments().delete(**command_args).execute() def get_user_tokens_command(): args = demisto.args() user_id = args.get("user-id") user_id = ADMIN_EMAIL if user_id == "me" else user_id tokens = get_user_tokens(user_id) return tokens_to_entry("Tokens:", tokens) def get_user_tokens(user_id): command_args = { "userKey": user_id, } service = get_service("admin", "directory_v1", ["https://www.googleapis.com/auth/admin.directory.user.security"]) result = service.tokens().list(**command_args).execute() return result.get("items", []) def search_in_mailboxes(accounts: list[str], only_return_account_names: bool) -> None: """ Searching for email messages within accounts based on a query, Results are returned only if messages matching the query are found. Returns only the names of the accounts where the messages were found if the only_return_account_names argument is true, Otherwise, returns all the information about the message, including its content. """ futures: list = [] entries: list = [] with concurrent.futures.ThreadPoolExecutor() as executor: for user in accounts: futures.append(executor.submit(search_command, mailbox=user, only_return_account_names=only_return_account_names)) for account in concurrent.futures.as_completed(futures): if found := account.result(): entries.append(found) if entries: if only_return_account_names: entries = [mailboxes_to_entry(entries)] return_results(entries) def search_all_mailboxes(): args = demisto.args() only_return_account_names = argToBoolean(args.get("show-only-mailboxes", "true")) list_accounts = argToList(args.get("list_accounts", "")) next_page_token = args.get("page-token", "") if list_accounts: support_multithreading() search_in_mailboxes(list_accounts, only_return_account_names) else: # check if there is next_page_token and remove it from the args (To avoid using this argument in search command) if next_page_token: demisto.args().pop("page-token", None) # Get the accounts that will be searched, maximum accounts is set by MAX_USERS. all_accounts, next_page_token = get_mailboxes(MAX_USERS, next_page_token) # When the number of accounts is more than MAX_WITHOUT_POLLING the searching will make with polling commands. if len(all_accounts) > MAX_WITHOUT_POLLING: command_results: List[CommandResults] = scheduled_commands_for_more_users(all_accounts, next_page_token) if next_page_token: command_results.append( information_search_process( len(all_accounts), arg_to_number(args.get("search_from")), arg_to_number(args.get("search_to")) ) ) return_results(command_results) # In case that the number of accounts less than MAX_WITHOUT_POLLING the searching run as usual. elif all_accounts: if args.get("search_from"): return_results( information_search_process( len(all_accounts), arg_to_number(args.get("search_from")), arg_to_number(args.get("search_to")) ) ) args["list_accounts"] = all_accounts search_all_mailboxes() def search_command(mailbox: str = None, only_return_account_names: bool = False) -> dict[str, Any] | None: """ Searches for Gmail records of a specified Google user. """ args = demisto.args() user_id = args.get("user-id") if mailbox is None else mailbox mailbox = ADMIN_EMAIL if user_id == "me" else user_id subject = args.get("subject", "") _from = args.get("from", "") to = args.get("to", "") before = args.get("before", "") after = args.get("after", "") filename = args.get("filename", "") _in = args.get("in", "") query = args.get("query", "") fields = format_fields_argument(argToList(args.get("fields"))) label_ids = [lbl for lbl in args.get("labels-ids", "").split(",") if lbl != ""] max_results = int(args.get("max-results", 100)) page_token = args.get("page-token") include_spam_trash = args.get("include-spam-trash", False) has_attachments = args.get("has-attachments") has_attachments = None if has_attachments is None else argToBoolean(has_attachments) if max_results > 500: raise ValueError(f"maxResults must be lower than 500, got {max_results}") try: mails, q, nextPageToken = search( user_id, subject, _from, to, before, after, filename, _in, query, fields, label_ids, max_results, page_token, include_spam_trash, has_attachments, only_return_account_names, ) except HttpError as err: if only_return_account_names and err.status_code == 429: return {"Mailbox": mailbox, "Error": {"message": str(err.error_details), "status_code": err.status_code}} raise # In case the user wants only account list without content. if only_return_account_names: if mails: return {"Mailbox": mailbox, "q": q} return None if mails: res = emails_to_entry(f'Search in {mailbox}:\nquery: "{q}"', mails, "full", mailbox, fields) # Add nextPageToken to the context if it exists if nextPageToken: res.setdefault("EntryContext", {}).setdefault("GmailEmails", {})["NextPageToken"] = nextPageToken return res return None def search( user_id, subject="", _from="", to="", before="", after="", filename="", _in="", query="", fields=None, label_ids=None, max_results=100, page_token=None, include_spam_trash=False, has_attachments=None, only_return_account_names=None, ) -> tuple[list[dict[str, Any]] | bool, str, str | None]: """ Search for Gmail messages in a user's mailbox using various filter criteria. This function queries the Gmail API to find messages matching the specified criteria. It can return either full message details or just a boolean indicating if messages were found. Args: user_id: The user's email address or user ID to search in their mailbox. subject: Filter by email subject (partial match). _from: Filter by sender email address. to: Filter by recipient email address. before: Filter messages before this date (format: YYYY/MM/DD). after: Filter messages after this date (format: YYYY/MM/DD). filename: Filter by attachment filename. _in: Filter by location (e.g., 'inbox', 'trash', 'spam'). query: Additional Gmail search query string (uses Gmail search syntax). fields: List of fields to include in the response (filters output fields). label_ids: List of label IDs to filter by. max_results: Maximum number of results to return (default: 100). page_token: Token for pagination to get the next page of results. include_spam_trash: Whether to include messages from spam and trash (default: False). has_attachments: Filter by attachment presence (True/False/None). only_return_account_names: If True, returns only a boolean indicating if messages exist, rather than full message details. Returns: A tuple containing three elements: - First element: Either a list of email message dictionaries (when only_return_account_names is False) or a boolean True (when only_return_account_names is True and messages exist). - Second element: The constructed query string that was used for the search. - Third element: The next page token for pagination (None if no more pages exist). Raises: Exception: If the Gmail API call fails (unless "Mail service not enabled" error). Note: - When only_return_account_names is True and no messages are found, returns (False, query, None). - The function constructs a Gmail search query from the individual filter parameters. - Security: The ``query`` parameter is passed directly to the Gmail API search. Callers must validate or sanitize any external/untrusted input before including it in the query string to avoid unintended search results. """ query_values = { "subject": subject, "from": _from, "to": to, "before": before, "after": after, "filename": filename, "in": _in, "has": "attachment" if has_attachments else "", } q = " ".join(f"{name}:{value} " for name, value in list(query_values.items()) if value != "") q = (f"{q} {query}").strip() command_args = { "userId": user_id, "q": q, "maxResults": max_results, "labelIds": label_ids, "pageToken": page_token, "includeSpamTrash": include_spam_trash, } service = get_service("gmail", "v1", ["https://www.googleapis.com/auth/gmail.readonly"], command_args["userId"]) nextPageToken = None try: result = service.users().messages().list(**command_args).execute() nextPageToken = result.get("nextPageToken") demisto.debug(f"gmail search result {result}") except Exception as e: if "Mail service not enabled" in str(e): result = {} else: raise # In case the user wants only account list without content. if only_return_account_names and result.get("sizeEstimate", 0) > 0: return True, q, None entries = [get_mail(user_id=user_id, _id=mail["id"], _format="full", service=service) for mail in result.get("messages", [])] return entries, q, nextPageToken def get_mail_command(): args = demisto.args() user_id = args.get("user-id", ADMIN_EMAIL) _id = validate_gmail_message_id(args.get("message-id")) _format = args.get("format") should_run_get_attachments = argToBoolean(args.get("include-attachments", "false")) mail = get_mail(user_id, _id, _format) email_entry = emails_to_entry("Email:", [mail], _format, user_id) results = [email_entry] if should_run_get_attachments: get_attachments_command_results = get_attachments_command() results.append(get_attachments_command_results) # type: ignore return results def get_mail(user_id, _id, _format, service=None): command_args = { "userId": user_id, "id": _id, "format": _format, } if not service: service = get_service( "gmail", "v1", ["https://www.googleapis.com/auth/gmail.readonly"], delegated_user=command_args["userId"] ) result = service.users().messages().get(**command_args).execute() return result def get_attachments_command(): args = demisto.args() user_id = args.get("user-id") _id = validate_gmail_message_id(args.get("message-id")) attachments = get_attachments(user_id, _id) return [fileResult(name, data) for name, data in attachments] def get_attachments(user_id, _id): mail_args = { "userId": user_id, "id": _id, "format": "full", } service = get_service("gmail", "v1", ["https://www.googleapis.com/auth/gmail.readonly"], delegated_user=mail_args["userId"]) result = service.users().messages().get(**mail_args).execute() result = get_email_context(result, user_id)[0] command_args = { "userId": user_id, "messageId": _id, } files = [] for attachment in result.get("Attachments", []): command_args["id"] = attachment["ID"] result = service.users().messages().attachments().get(**command_args).execute() file_data = base64.urlsafe_b64decode(result["data"].encode("ascii")) files.append((attachment["Name"], file_data)) return files def move_mail_command(): args = demisto.args() user_id = args.get("user-id") _id = validate_gmail_message_id(args.get("message-id")) add_labels = [lbl for lbl in args.get("add-labels", "").split(",") if lbl != ""] remove_labels = [lbl for lbl in args.get("remove-labels", "").split(",") if lbl != ""] mail = move_mail(user_id, _id, add_labels, remove_labels) return emails_to_entry("Email:", [mail], "full", user_id) def move_mail(user_id, _id, add_labels, remove_labels): command_args = { "userId": user_id, "id": _id, "body": { "addLabelIds": add_labels, "removeLabelIds": remove_labels, }, } service = get_service("gmail", "v1", ["https://www.googleapis.com/auth/gmail.modify"], delegated_user=user_id) result = service.users().messages().modify(**command_args).execute() return result def move_mail_to_mailbox_command(): args = demisto.args() src_user_id = args.get("src-user-id") message_id = validate_gmail_message_id(args.get("message-id")) dst_user_id = args.get("dst-user-id") new_mail_id = move_mail_to_mailbox(src_user_id, message_id, dst_user_id) mail = get_mail(dst_user_id, new_mail_id, "full") return emails_to_entry("Email:", [mail], "full", dst_user_id) def move_mail_to_mailbox(src_mailbox, message_id, dst_mailbox): # get the original mail mail = get_mail(src_mailbox, message_id, "raw") # import the mail to the destination mailbox command_args = { "userId": dst_mailbox, "body": { "raw": mail["raw"], }, } service = get_service("gmail", "v1", ["https://www.googleapis.com/auth/gmail.modify"], delegated_user=dst_mailbox) result = service.users().messages().import_(**command_args).execute() # delete the original mail delete_mail(src_mailbox, message_id, True) return result["id"] def delete_mail_command(): args = demisto.args() user_id = args["user-id"] _id = validate_gmail_message_id(args.get("message-id")) permanent = argToBoolean(args.get("permanent", "false")) return delete_mail(user_id, _id, permanent) def delete_mail(user_id, _id, permanent): command_args = { "userId": user_id, "id": _id, } service = get_service( "gmail", "v1", ["https://mail.google.com", "https://www.googleapis.com/auth/gmail.modify"], delegated_user=command_args["userId"], ) if permanent: service.users().messages().delete(**command_args).execute() return "Email has been successfully deleted." else: service.users().messages().trash(**command_args).execute() return "Email has been successfully moved to trash." def get_thread_command(): args = demisto.args() user_id = args.get("user-id", ADMIN_EMAIL) _id = args.get("thread-id") _format = args.get("format") messages = get_thread(user_id, _id, _format) return emails_to_entry("Emails of Thread:", messages, _format, user_id) def get_thread(user_id, _id, _format): command_args = {"userId": user_id, "id": _id, "format": _format} service = get_service("gmail", "v1", ["https://www.googleapis.com/auth/gmail.readonly"], delegated_user=user_id) result = service.users().threads().get(**command_args).execute() return result["messages"] def add_delete_filter_command(): args = demisto.args() user_id = args.get("user-id", ADMIN_EMAIL) user_id = user_id if user_id.lower() != "me" else ADMIN_EMAIL _from = args.get("email-address") _filter = add_filter( user_id, _from=_from, add_labels=[ "TRASH", ], ) return filters_to_entry("New filter:", user_id, [_filter]) def add_filter_command(): args = demisto.args() user_id = args.get("user-id", ADMIN_EMAIL) user_id = user_id if user_id.lower() != "me" else ADMIN_EMAIL _from = args.get("from") to = args.get("to") subject = args.get("subject") query = args.get("query") has_attachments = args.get("has-attachments") size = args.get("size") size_comparison = args.get("size-comparison") forward = args.get("forward") add_labels = args.get("add-labels", "").split(",") add_labels = add_labels if any(add_labels) else None remove_labels = args.get("remove-labels", "").split(",") remove_labels = remove_labels if any(remove_labels) else None _filter = add_filter( user_id, _from=_from, to=to, subject=subject, query=query, has_attachments=has_attachments, size=size, size_comparison=size_comparison, forward=forward, add_labels=add_labels, remove_labels=remove_labels, ) return filters_to_entry("New filter:", user_id, [_filter]) def add_filter( user_id, _from=None, to=None, subject=None, query=None, has_attachments=None, size=None, size_comparison=None, forward=None, add_labels=None, remove_labels=None, ): command_args = { "userId": user_id, "body": { "criteria": {}, "action": {}, }, } if _from is not None: command_args["body"]["criteria"]["from"] = _from if to is not None: command_args["body"]["criteria"]["to"] = to if subject is not None: command_args["body"]["criteria"]["subject"] = subject if query is not None: command_args["body"]["criteria"]["query"] = query if has_attachments is not None: command_args["body"]["criteria"]["hasAttachment"] = has_attachments if size is not None: command_args["body"]["criteria"]["size"] = size if size_comparison is not None: command_args["body"]["criteria"]["size_comparison"] = size_comparison if add_labels is not None: command_args["body"]["action"]["addLabelIds"] = add_labels if remove_labels is not None: command_args["body"]["action"]["removeLabelIds"] = remove_labels if forward is not None: command_args["body"]["action"]["forward"] = forward service = get_service("gmail", "v1", ["https://www.googleapis.com/auth/gmail.settings.basic"], delegated_user=user_id) result = service.users().settings().filters().create(**command_args).execute() return result def list_filters_command(): args = demisto.args() user_id = args.get("user-id", ADMIN_EMAIL) user_id = user_id if user_id.lower() != "me" else ADMIN_EMAIL address = args.get("address") limit = int(args.get("limit", 100)) filters = list_filters(user_id, address=address, limit=limit) return filters_to_entry("filters:", user_id, filters) def list_filters(user_id, address=None, limit=100): command_args = { "userId": user_id, } service = get_service("gmail", "v1", ["https://www.googleapis.com/auth/gmail.settings.basic"], delegated_user=user_id) result = service.users().settings().filters().list(**command_args).execute() filters = result.get("filter", []) if address is not None: filters = [f for f in filters if address in {f["criteria"].get("from"), f["criteria"].get("to")}] return filters[:limit] def remove_filter_command(): args = demisto.args() user_id = args.get("user-id", ADMIN_EMAIL) ids = args.get("filter_ids", "") if isinstance(ids, STRING_OBJ_TYPES): # alternativly it could be an array ids = ids.split(",") for _id in ids: remove_filter(user_id, _id) return "filters were removed successfully." def remove_filter(user_id, _id): command_args = {"userId": user_id, "id": _id} service = get_service("gmail", "v1", ["https://www.googleapis.com/auth/gmail.settings.basic"], delegated_user=user_id) result = service.users().settings().filters().delete(**command_args).execute() return result """MAIL SENDER FUNCTIONS""" def randomword(length): """ Generate a random string of given length """ letters = string.ascii_lowercase return "".join(random.choice(letters) for i in range(length)) # NOSONAR def header(s): if not s: return None s_no_newlines = " ".join(s.splitlines()) return Header(s_no_newlines) def template_params(paramsStr): """ Translate the template params if they exist from the context """ actualParams = {} if paramsStr: try: params = json.loads(paramsStr) except ValueError as e: return_error(f"Unable to parse templateParams: {e!s}") # Build a simple key/value for p in params: if params[p].get("value"): actualParams[p] = params[p]["value"] elif params[p].get("key"): actualParams[p] = demisto.dt(demisto.context(), params[p]["key"]) return actualParams else: return None def transient_attachments(transientFile, transientFileContent, transientFileCID): if transientFile is None or len(transientFile) == 0: return [] if transientFileContent is None: transientFileContent = [] if transientFileCID is None: transientFileCID = [] attachments = [] for file_name, file_data, file_cid in it.zip_longest(transientFile, transientFileContent, transientFileCID): if file_name is None: break content_type, encoding = mimetypes.guess_type(file_name) if content_type is None or encoding is not None: content_type = "application/octet-stream" main_type, sub_type = content_type.split("/", 1) attachments.append({"name": file_name, "maintype": main_type, "subtype": sub_type, "data": file_data, "cid": file_cid}) return attachments def handle_html(htmlBody): """ Extract all data-url content from within the html and return as separate attachments. Due to security implications, we support only images here We might not have Beautiful Soup so just do regex search """ attachments = [] cleanBody = "" lastIndex = 0 for i, m in enumerate( re.finditer( # pylint: disable=E1101 r"<img.+?src=\"(data:(image\/.+?);base64,([a-zA-Z0-9+/=\r\n]+?))\"", htmlBody, re.IGNORECASE | re.DOTALL, # pylint: disable=E1101 ) ): maintype, subtype = m.group(2).split("/", 1) name = f"image{i}.{subtype}" cid = f"{name}@{str(uuid.uuid4())[:8]}_{str(uuid.uuid4())[:8]}" attachment = { "maintype": maintype, "subtype": subtype, "data": b64_decode(m.group(3)), "name": name, "cid": cid, "ID": cid, } attachments.append(attachment) cleanBody += htmlBody[lastIndex : m.start(1)] + "cid:" + attachment["cid"] lastIndex = m.end() - 1 cleanBody += htmlBody[lastIndex:] return cleanBody, attachments def collect_inline_attachments(attach_cids): """ collects all attachments which are inline - only used in html bodied emails """ inline_attachment = [] if attach_cids is not None and len(attach_cids) > 0: for cid in attach_cids: file = demisto.getFilePath(cid) file_path = file["path"] content_type, encoding = mimetypes.guess_type(file_path) if content_type is None or encoding is not None: content_type = "application/octet-stream" main_type, sub_type = content_type.split("/", 1) fp = open(file_path, "rb") data = fp.read() fp.close() inline_attachment.append( {"ID": cid, "name": file["name"], "maintype": main_type, "subtype": sub_type, "data": data, "cid": cid} ) return inline_attachment return None def collect_manual_attachments(): attachments = [] for attachment in demisto.getArg("manualAttachObj") or []: res = demisto.getFilePath(os.path.basename(attachment["RealFileName"])) path = res["path"] content_type, encoding = mimetypes.guess_type(path) if content_type is None or encoding is not None: content_type = "application/octet-stream" maintype, subtype = content_type.split("/", 1) if maintype == "text": with open(path) as fp: data = fp.read() else: with open(path, "rb") as fp: data = fp.read() # type: ignore [assignment] attachments.append({"name": attachment["FileName"], "maintype": maintype, "subtype": subtype, "data": data, "cid": None}) return attachments def collect_attachments(entry_ids, file_names): """ Creates a dictionary containing all the info about all attachments """ attachments = [] entry_number = 0 if entry_ids is not None and len(entry_ids) > 0: for entry_id in entry_ids: file = demisto.getFilePath(entry_id) file_path = file["path"] if file_names is not None and len(file_names) > entry_number and file_names[entry_number] is not None: file_name = file_names[entry_number] else: file_name = file["name"] content_type, encoding = mimetypes.guess_type(file_name) if content_type is None or encoding is not None: content_type = "application/octet-stream" main_type, sub_type = content_type.split("/", 1) fp = open(file_path, "rb") data = fp.read() fp.close() attachments.append( {"ID": entry_id, "name": file_name, "maintype": main_type, "subtype": sub_type, "data": data, "cid": None} ) entry_number += 1 return attachments def attachment_handler(message, attachments): """ Adds the attachments to the email message """ for att in attachments: if att["maintype"] == "text": msg_txt = MIMEText(att["data"], att["subtype"], "utf-8") if att["cid"] is not None: msg_txt.add_header("Content-Disposition", "inline", filename=att["name"]) msg_txt.add_header("Content-ID", "<" + att["cid"] + ">") else: msg_txt.add_header("Content-Disposition", "attachment", filename=att["name"]) message.attach(msg_txt) elif att["maintype"] == "image": msg_img = MIMEImage(att["data"], att["subtype"]) if att["cid"] is not None: msg_img.add_header("Content-Disposition", "inline", filename=att["name"]) msg_img.add_header("Content-ID", "<" + att["cid"] + ">") if att.get("ID"): msg_img.add_header("X-Attachment-Id", att["ID"]) else: msg_img.add_header("Content-Disposition", "attachment", filename=att["name"]) message.attach(msg_img) elif att["maintype"] == "audio": msg_aud = MIMEAudio(att["data"], att["subtype"]) if att["cid"] is not None: msg_aud.add_header("Content-Disposition", "inline", filename=att["name"]) msg_aud.add_header("Content-ID", "<" + att["cid"] + ">") else: msg_aud.add_header("Content-Disposition", "attachment", filename=att["name"]) message.attach(msg_aud) elif att["maintype"] == "application": msg_app = MIMEApplication(att["data"], att["subtype"]) if att["cid"] is not None: msg_app.add_header("Content-Disposition", "inline", filename=att["name"]) msg_app.add_header("Content-ID", "<" + att["cid"] + ">") else: msg_app.add_header("Content-Disposition", "attachment", filename=att["name"]) message.attach(msg_app) else: msg_base = MIMEBase(att["maintype"], att["subtype"]) msg_base.set_payload(att["data"]) if att["cid"] is not None: msg_base.add_header("Content-Disposition", "inline", filename=att["name"]) msg_base.add_header("Content-ID", "<" + att["cid"] + ">") else: msg_base.add_header("Content-Disposition", "attachment", filename=att["name"]) message.attach(msg_base) def send_mail( emailto, emailfrom, subject, body, entry_ids, cc, bcc, htmlBody, replyTo, file_names, attach_cid, transientFile, transientFileContent, transientFileCID, manualAttachObj, additional_headers, templateParams, sender_display_name, inReplyTo=None, references=None, force_handle_htmlBody=False, ): if templateParams: templateParams = template_params(templateParams) if body: body = body.format(**templateParams) if htmlBody: htmlBody = htmlBody.format(**templateParams) attach_body_to = None if htmlBody and not any([entry_ids, file_names, attach_cid, manualAttachObj, body, force_handle_htmlBody]): # if there is only htmlbody and no attachments to the mail , we would like to send it without attaching the body message = MIMEText(htmlBody, "html") # type: ignore elif body and not any([entry_ids, file_names, attach_cid, manualAttachObj, htmlBody]): # if there is only body and no attachments to the mail , we would like to send it without attaching every part message = MIMEText(body, "plain", "utf-8") # type: ignore elif htmlBody and body and any([entry_ids, file_names, attach_cid, manualAttachObj]): # if all these exist - htmlBody, body and one of the attachment's items, the message object will be: # a MimeMultipart object of type 'mixed' which contains # a MIMEMultipart object of type `alternative` which contains # the 2 MIMEText objects for each body part and the relevant Mime<type> object for the attachments. message = MIMEMultipart("mixed") # type: ignore alt = MIMEMultipart("alternative") message.attach(alt) attach_body_to = alt else: message = MIMEMultipart() # type: ignore if not attach_body_to: attach_body_to = message # type: ignore message["to"] = header(",".join(emailto)) message["cc"] = header(",".join(cc)) message["bcc"] = header(",".join(bcc)) message["subject"] = header(subject) message["reply-to"] = header(replyTo) if sender_display_name: message["from"] = header(sender_display_name + f" <{emailfrom}>") else: message["from"] = header(emailfrom) # The following headers are being used for the reply-mail command. if inReplyTo: message["In-Reply-To"] = header(" ".join(inReplyTo)) if references: message["References"] = header(" ".join(references)) # if there are any attachments to the mail or both body and htmlBody were given if entry_ids or file_names or attach_cid or manualAttachObj or (body and htmlBody) or force_handle_htmlBody: htmlAttachments = [] # type: list inlineAttachments = [] # type: list if htmlBody: htmlBody, htmlAttachments = handle_html(htmlBody) msg = MIMEText(htmlBody, "html", "utf-8") attach_body_to.attach(msg) # type: ignore if attach_cid: inlineAttachments = collect_inline_attachments(attach_cid) else: # if not html body, cannot attach cids in message transientFileCID = None msg = MIMEText(body, "plain", "utf-8") attach_body_to.attach(msg) # type: ignore attachments = collect_attachments(entry_ids, file_names) manual_attachments = collect_manual_attachments() transientAttachments = transient_attachments(transientFile, transientFileContent, transientFileCID) attachments = attachments + htmlAttachments + transientAttachments + inlineAttachments + manual_attachments attachment_handler(message, attachments) if additional_headers: for h in additional_headers: header_name, header_value = h.split("=") message[header_name] = header(header_value) encoded_message = base64.urlsafe_b64encode(message.as_bytes()).decode() command_args = { "userId": emailfrom, "body": { "raw": encoded_message, }, } service = get_service( "gmail", "v1", additional_scopes=["https://www.googleapis.com/auth/gmail.compose", "https://www.googleapis.com/auth/gmail.send"], delegated_user=emailfrom, ) result = service.users().messages().send(**command_args).execute() return result def send_mail_command(): args = demisto.args() return mail_command(args) def mail_command(args, subject_prefix="", in_reply_to=None, references=None): email_to = argToList(args.get("to")) email_from = args.get("from", ADMIN_EMAIL) body = args.get("body") subject = f"{subject_prefix}{args.get('subject')}" entry_ids = argToList(args.get("attachIDs")) cc = argToList(args.get("cc")) bcc = argToList(args.get("bcc")) html_body = args.get("htmlBody") force_handle_htmlBody = argToBoolean(args.get("force_handle_htmlBody", False)) reply_to = args.get("replyTo") attach_names = argToList(args.get("attachNames")) attach_cids = argToList(args.get("attachCIDs")) transient_file = argToList(args.get("transientFile")) transient_file_content = argToList(args.get("transientFileContent")) transient_file_cid = argToList(args.get("transientFileCID")) manual_attach_obj = argToList(args.get("manualAttachObj")) # when send-mail called from within XSOAR (like reports) additional_headers = argToList(args.get("additionalHeader")) template_param = args.get("templateParams") render_body = argToBoolean(args.get("renderBody", False)) body_type = args.get("bodyType", "Text").lower() sender_display_name = args.get("senderDisplayName") result = send_mail( email_to, email_from, subject, body, entry_ids, cc, bcc, html_body, reply_to, attach_names, attach_cids, transient_file, transient_file_content, transient_file_cid, manual_attach_obj, additional_headers, template_param, sender_display_name, in_reply_to, references, force_handle_htmlBody, ) rendering_body = html_body if body_type == "html" else body send_mail_result = sent_mail_to_entry("Email sent:", [result], email_to, email_from, cc, bcc, rendering_body, subject) if render_body: html_result = CommandResults( entry_type=EntryType.NOTE, content_format=EntryFormat.HTML, raw_response=html_body, ) return [send_mail_result, html_result] return send_mail_result def reply_mail_command(): args = demisto.args() in_reply_to = argToList(args.get("inReplyTo")) references = argToList(args.get("references")) return mail_command(args, "Re: ", in_reply_to, references) def forwarding_address_add(user_id: str, forwarding_email: str) -> tuple[dict, bool, Optional[dict]]: """Creates forwarding address. Args: user_id: str - The user's email address or the user id. forwarding_email: str - The forwarding address to be retrieved. Returns: result: dict - Response body from the API. exception: bool - Indicates whether there is an error. exception_details: dict - The details of the exception. """ result = {} exception_details = {} exception = False request_body = {"forwardingEmail": forwarding_email} service = get_service("gmail", "v1", ["https://www.googleapis.com/auth/gmail.settings.sharing"], delegated_user=user_id) try: result = service.users().settings().forwardingAddresses().create(userId=user_id, body=request_body).execute() result["userId"] = user_id except HttpError as e: exception = True exception_details = {"forwardingEmail": forwarding_email, "errorMessage": e.reason, "userId": user_id} return result, exception, exception_details def forwarding_address_add_command() -> list[CommandResults]: """Creates forwarding address. Args: user_id: str - The user's email address or the user id. forwarding_email: str - The forwarding address to be retrieved. Returns: A list of CommandResults. """ args = demisto.args() forwarding_email_list = argToList(args.get("forwarding_email")) user_id = args.get("user_id", "") headers = {"success": ["forwardingEmail", "userId", "verificationStatus"], "failure": ["forwardingEmail", "errorMessage"]} outputs_list_success = [] outputs_list_failure = [] results = [] for forwarding_email in forwarding_email_list: result_forwarding_add, is_exception, error_details = forwarding_address_add(user_id, forwarding_email) if is_exception: outputs_list_failure.append(error_details) demisto.debug(error_details) else: outputs_list_success.append(result_forwarding_add) if outputs_list_success: results.append( CommandResults( raw_response=outputs_list_success, outputs=outputs_list_success, readable_output=tableToMarkdown( f'Forwarding addresses results for "{user_id}":', outputs_list_success, headers["success"], removeNull=True ), outputs_prefix="Gmail.ForwardingAddress", outputs_key_field=["forwardingEmail", "userId"], ) ) if outputs_list_failure: results.append( CommandResults( raw_response=outputs_list_failure, readable_output=tableToMarkdown( f'Forwarding addresses errors for "{user_id}":', outputs_list_failure, headers["failure"], removeNull=True ), outputs_prefix="Gmail.ForwardingAddress", outputs_key_field=["forwardingEmail", "userId"], ) ) return results def forwarding_address_update(user_id: str, disposition: str, forwarding_email: str) -> tuple[dict, bool, Optional[dict]]: """Update forwarding address with disposition. Args: user_id: str - The user's email address or the user id. forwarding_email: str - The forwarding address to be retrieved. disposition: str - The state that a message should be left in after it has been forwarded. Returns: result: dict - Response body from the API. exception: bool - Indicates whether there is an error. exception_details: dict - The details of the exception. """ exception = False result = {} exception_details = {} service = get_service("gmail", "v1", ["https://www.googleapis.com/auth/gmail.settings.sharing"], delegated_user=user_id) request_body = {"emailAddress": forwarding_email, "enabled": True, "disposition": disposition} try: result = service.users().settings().updateAutoForwarding(userId=user_id, body=request_body).execute() result["userId"] = user_id except HttpError as e: exception = True exception_details = {"forwardingEmail": forwarding_email, "errorMessage": e.reason, "userId": user_id} return result, exception, exception_details def forwarding_address_update_command() -> list[CommandResults]: """Update forwarding address with disposition. Args: user_id: str - The user's email address or the user id. forwarding_email: list[str] - a forwarding addresses list to be retrieved. disposition: str - The state that a message should be left in after it has been forwarded. Returns: A list of CommandResults. """ args = demisto.args() forwarding_email_list = argToList(args.get("forwarding_email")) user_id = args.get("user_id") disposition = args.get("disposition") headers = {"success": ["forwardingEmail", "userId", "disposition", "enabled"], "failure": ["forwardingEmail", "errorMessage"]} outputs_list_success = [] outputs_list_failure = [] results = [] for forwarding_email in forwarding_email_list: result_forwarding_update, is_exception, error_details = forwarding_address_update(user_id, disposition, forwarding_email) if is_exception: outputs_list_failure.append(error_details) demisto.debug(error_details) else: result_forwarding_update["forwardingEmail"] = result_forwarding_update.pop("emailAddress") result_forwarding_update["userId"] = user_id outputs_list_success.append(result_forwarding_update) if outputs_list_success: results.append( CommandResults( raw_response=outputs_list_success, outputs=outputs_list_success, readable_output=tableToMarkdown( f'Forwarding addresses update results for "{user_id}":', outputs_list_success, headers["success"], removeNull=True, ), outputs_prefix="Gmail.ForwardingAddress", outputs_key_field=["forwardingEmail", "userId"], ) ) if outputs_list_failure: results.append( CommandResults( raw_response=outputs_list_failure, readable_output=tableToMarkdown( f'Forwarding addresses update errors for "{user_id}":', outputs_list_failure, headers["failure"], removeNull=True, ), outputs_prefix="Gmail.ForwardingAddress", outputs_key_field=["userId", "forwardingEmail"], ) ) return results def send_as_add_command(): """ Creates a custom "from" send-as alias. If an SMTP MSA is specified, Gmail will attempt to connect to the SMTP service to validate the configuration before creating the alias. If ownership verification is required for the alias, a message will be sent to the email address and the resource's verification status will be set to pending; otherwise, the resource will be created with verification status set to accepted. If a signature is provided, Gmail will sanitize the HTML before saving it with the alias. This method is only available to service account clients that have been delegated domain-wide authority. """ args = demisto.args() user_id = args.pop("user_id", "") smtp_msa_object = {key.replace("smtp_", ""): value for (key, value) in list(args.items()) if key.startswith("smtp_")} args = {key: value for (key, value) in list(args.items()) if not key.startswith("smtp_")} send_as_settings = dict_keys_snake_to_camelcase(args) if smtp_msa_object: if any(field not in list(smtp_msa_object.keys()) for field in SEND_AS_SMTP_FIELDS): raise ValueError("SMTP configuration missing. Please provide all the SMTP field values.") smtp_msa_object["securityMode"] = smtp_msa_object.pop("securitymode", "") send_as_settings["smtpMsa"] = smtp_msa_object service = get_service("gmail", "v1", ["https://www.googleapis.com/auth/gmail.settings.sharing"], delegated_user=user_id) result = service.users().settings().sendAs().create(userId="me", body=send_as_settings).execute() context = result.copy() context["userId"] = user_id for key, value in list(context.pop("smtpMsa", {}).items()): context["smtpMsa" + (key[0].upper() + key[1:])] = value hr_fields = ["sendAsEmail", "displayName", "replyToAddress", "isPrimary", "treatAsAlias"] readable_output = tableToMarkdown( f'A custom "{result.get("sendAsEmail", "")}" send-as alias created for "{user_id}".', context, headerTransform=pascalToSpace, removeNull=True, headers=hr_fields, ) return CommandResults( outputs=context, raw_response=result, readable_output=readable_output, outputs_prefix="Gmail.SendAs", outputs_key_field=["sendAsEmail", "userId"], ) def parse_date_isoformat_server(dt: str) -> datetime: """Get the datetime by parsing the format passed to the server. UTC basded with Z at the end Args: dt (str): datetime as string Returns: datetime: datetime representation """ return datetime.strptime(dt, "%Y-%m-%dT%H:%M:%SZ").replace(tzinfo=timezone.utc) def forwarding_address_get(user_id: str, forwarding_email: str) -> dict: """Gets an Existing forwarding address. Args: user_id: str - The user email address or the user id. forwarding_email: str - The forwarding address to be retrieved. Returns: A Dict object - Response body from the API. """ service = get_service( "gmail", "v1", [ "https://www.googleapis.com/auth/gmail.readonly", "https://www.googleapis.com/auth/gmail.modify", "https://mail.google.com/", "https://www.googleapis.com/auth/gmail.settings.basic", ], delegated_user=user_id, ) result = service.users().settings().forwardingAddresses().get(userId=user_id, forwardingEmail=forwarding_email).execute() return result def forwarding_address_get_command() -> CommandResults: """Gets an Existing forwarding address. Args: user_id: str - The user's email address or the user id. forwarding_email: str - The forwarding address to be retrieved. Returns: A CommandResults object. """ args = demisto.args() forwarding_email = args.get("forwarding_email") headers = ["forwardingEmail", "verificationStatus"] user_id = args.get("user_id") result = forwarding_address_get(user_id, forwarding_email) result["userId"] = user_id return CommandResults( raw_response=result, outputs=result, readable_output=tableToMarkdown(f'Get forwarding address for: "{user_id}"', result, headers, removeNull=True), outputs_prefix="Gmail.ForwardingAddress", outputs_key_field=["forwardingEmail", "userId"], ) def forwarding_address_remove(user_id: str, forwarding_email: str) -> dict: """Removes a forwarding address. Args: user_id: str - The user's email address or the user id. forwarding_email: str - The forwarding address to be retrieved. Returns: A Dict object - Response body from the API (empty when successful). """ service = get_service("gmail", "v1", ["https://www.googleapis.com/auth/gmail.settings.sharing"], delegated_user=user_id) result = service.users().settings().forwardingAddresses().delete(userId=user_id, forwardingEmail=forwarding_email).execute() return result def forwarding_address_remove_command() -> CommandResults: """Removes a forwarding address. Args: user_id: str - The user's email address or the user id. forwarding_email: str - The forwarding address to be retrieved. Returns: A CommandResults object. """ args = demisto.args() forwarding_email = args.get("forwarding_email") user_id = args.get("user_id") forwarding_address_remove(user_id, forwarding_email) return CommandResults(readable_output=f'Forwarding address "{forwarding_email}" for "{user_id}" was deleted successfully .') def forwarding_address_list(user_id: str) -> dict: """Gets a list of forwarding addresses. Args: user_id: str - The user's email address or the user id. Returns: A Dict object - Response body from the API. """ result = {} service = get_service( "gmail", "v1", [ "https://www.googleapis.com/auth/gmail.settings.basic", "https://mail.google.com/", "https://www.googleapis.com/auth/gmail.modify", "https://www.googleapis.com/auth/gmail.readonly", ], delegated_user=user_id, ) result = service.users().settings().forwardingAddresses().list(userId=user_id).execute() return result def forwarding_address_list_command() -> CommandResults: """Gets a list of forwarding addresses. Args: user_id: str - The user's email address or the user id. limit: str - The Limit of the results list. Default is 50. Returns: A CommandResults object. """ args = demisto.args() user_id = args.get("user_id") limit = int(args.get("limit", "50")) result = forwarding_address_list(user_id) context = result.get("forwardingAddresses") context = context[:limit] if context else [] for msg in context: msg["userId"] = user_id headers = ["forwardingEmail", "verificationStatus"] return CommandResults( raw_response=result, outputs=context, readable_output=tableToMarkdown(f'Forwarding addresses list for: "{user_id}"', context, headers, removeNull=True), outputs_prefix="Gmail.ForwardingAddress", outputs_key_field=["forwardingEmail", "userId"], ) """FETCH INCIDENTS""" def fetch_incidents(): params = demisto.params() user_key = params.get("queryUserKey") user_key = user_key if user_key else ADMIN_EMAIL max_fetch = int(params.get("fetch_limit") or 50) query = "" if params["query"] is None else params["query"] last_run = demisto.getLastRun() demisto.debug(f"last run: {last_run}") last_fetch = last_run.get("gmt_time") next_last_fetch = last_run.get("next_gmt_time") page_token = last_run.get("page_token") or None ignore_ids: List[str] = last_run.get("ignore_ids") or [] ignore_list_used = last_run.get("ignore_list_used") or False # can we reset the ignore list if we haven't used it # handle first time fetch - gets current GMT time -1 day if not last_fetch: last_fetch = dateparser.parse(date_string=FETCH_TIME, settings={"TIMEZONE": "UTC"}) last_fetch = str(last_fetch.isoformat(timespec="seconds")) + "Z" # use replace(tzinfo) to make the datetime aware of the timezone as all other dates we use are aware last_fetch = parse_date_isoformat_server(last_fetch) if next_last_fetch: next_last_fetch = parse_date_isoformat_server(next_last_fetch) else: next_last_fetch = last_fetch + timedelta(seconds=1) service = get_service("gmail", "v1", ["https://www.googleapis.com/auth/gmail.readonly"], user_key) # use seconds for the filter (note that it is inclusive) # see: https://developers.google.com/gmail/api/guides/filtering query += f" after:{int(last_fetch.timestamp())}" max_results = max_fetch if max_fetch > 200: max_results = 200 demisto.debug(f"GMAIL: fetch parameters: user: {user_key} query={query} fetch time: {last_fetch} \ page_token: {page_token} max results: {max_results}") result = service.users().messages().list(userId=user_key, maxResults=max_results, pageToken=page_token, q=query).execute() incidents = [] # so far, so good demisto.debug(f"GMAIL: possible new incidents are {result}") for msg in result.get("messages", []): msg_id = msg["id"] if msg_id in ignore_ids: demisto.info(f"Ignoring msg id: {msg_id} as it is in the ignore list") ignore_list_used = True continue msg_result = service.users().messages().get(id=msg_id, userId=user_key).execute() incident, occurred, is_valid_date = mail_to_incident(msg_result, service, user_key) if not is_valid_date: # if we can't trust the date store the msg id in the ignore list demisto.info(f'appending to ignore list msg id: {msg_id}. name: {incident.get("name")}') ignore_list_used = True ignore_ids.append(msg_id) # update last run only if we trust the occurred timestamp if is_valid_date and occurred >= next_last_fetch: next_last_fetch = occurred + timedelta(seconds=1) # avoid duplication due to weak time query if (not is_valid_date) or (occurred >= last_fetch): incidents.append(incident) else: demisto.info(f'skipped incident with lower date: {occurred} than fetch: {last_fetch} name: {incident.get("name")}') demisto.info(f"extract {len(incidents)} incidents") next_page_token = result.get("nextPageToken", "") if next_page_token: # we still have more results demisto.info( f"keeping current last fetch: {last_fetch} as result has additional pages to fetch." f" token: {next_page_token}. Ignoring incremented last_fatch: {next_last_fetch}" ) else: demisto.debug(f"will use new last fetch date (no next page token): {next_last_fetch}") # if we are not in a tokenized search and we didn't use the ignore ids we can reset it if (not page_token) and (not ignore_list_used) and (len(ignore_ids) > 0): demisto.info(f"reseting igonre list of len: {len(ignore_ids)}") ignore_ids = [] last_fetch = next_last_fetch demisto.setLastRun( { "gmt_time": get_date_isoformat_server(last_fetch), "next_gmt_time": get_date_isoformat_server(next_last_fetch), "page_token": next_page_token, "ignore_ids": ignore_ids, "ignore_list_used": ignore_list_used, } ) return incidents def main(): # pragma: no cover global ADMIN_EMAIL, PRIVATE_KEY_CONTENT, GAPPS_ID ADMIN_EMAIL = demisto.params()["adminEmail"].get("identifier", "") if "@" not in ADMIN_EMAIL: raise ValueError(f"Admin email {ADMIN_EMAIL} must be in an email format") PRIVATE_KEY_CONTENT = demisto.params()["adminEmail"].get("password", "{}") GAPPS_ID = demisto.params().get("gappsID") """ EXECUTION CODE """ COMMANDS = { "gmail-list-users": list_users_command, "gmail-list-labels": list_labels_command, "gmail-get-user": get_user_command, "gmail-create-user": create_user_command, "gmail-delete-user": delete_user_command, "gmail-get-user-roles": get_user_role_command, "gmail-revoke-user-role": revoke_user_roles_command, "gmail-get-tokens-for-user": get_user_tokens_command, "gmail-search-all-mailboxes": search_all_mailboxes, "gmail-search": search_command, "gmail-get-mail": get_mail_command, "gmail-get-attachments": get_attachments_command, "gmail-move-mail": move_mail_command, "gmail-move-mail-to-mailbox": move_mail_to_mailbox_command, "gmail-delete-mail": delete_mail_command, "gmail-get-thread": get_thread_command, "gmail-add-filter": add_filter_command, "gmail-add-delete-filter": add_delete_filter_command, "gmail-list-filters": list_filters_command, "gmail-remove-filter": remove_filter_command, "gmail-hide-user-in-directory": hide_user_command, "gmail-set-password": set_user_password_command, "gmail-get-autoreply": get_autoreply_command, "gmail-set-autoreply": set_autoreply_command, "gmail-delegate-user-mailbox": delegate_user_mailbox_command, "gmail-remove-delegated-mailbox": remove_delegate_user_mailbox_command, "send-mail": send_mail_command, "reply-mail": reply_mail_command, "gmail-get-role": get_role_command, "gmail-send-as-add": send_as_add_command, "gmail-forwarding-address-get": forwarding_address_get_command, "gmail-forwarding-address-remove": forwarding_address_remove_command, "gmail-forwarding-address-list": forwarding_address_list_command, "gmail-forwarding-address-update": forwarding_address_update_command, "gmail-forwarding-address-add": forwarding_address_add_command, } command = demisto.command() demisto.debug(f"GMAIL: command is {command}") try: if command == "test-module": list_users(ADMIN_EMAIL.split("@")[1]) return_results("ok") sys.exit(0) if command == "fetch-incidents": demisto.incidents(fetch_incidents()) sys.exit(0) cmd_func = COMMANDS.get(command) if cmd_func is None: raise NotImplementedError(f'Command "{command}" is not implemented.') else: if command == "gmail-search-all-mailboxes": cmd_func() # type: ignore[operator] else: return_results(cmd_func()) # type: ignore except Exception as e: import traceback if command == "fetch-incidents": demisto.error(traceback.format_exc()) demisto.error(f"GMAIL: {e!s}") raise else: return_error(f"GMAIL: {e!s}", traceback.format_exc()) # python2 uses __builtin__ python3 uses builtins if __name__ in ("__builtin__", "builtins", "__main__"): main()