MicrosoftGraphMail

Microsoft Graph lets your app get authorized access to a user's Outlook mail data in a personal or organization account.

Email · Microsoft Graph Mail

Details

IDMicrosoftGraphMail
ProviderMicrosoft
CategoryEmail
From Version5.0.0
Docker Imagedemisto/crypto:1.0.0.10120494
Supported ModulesAgentix Cloud Runtime Security XSIAM EDR Cortex Cloud

README

Microsoft Graph lets your app get authorized access to a user’s Outlook mail data in a personal or organization account.
This integration was integrated and tested with version v1 of Microsoft Graph.

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure O365 Outlook Mail (Using Graph API) in Cortex

Parameter Description Required
Server URL   True
Application ID or Client ID See the Help tab. False
Token or Tenant ID See the Help tab. False
Key or Client Secret See the Help tab. False
Certificate Thumbprint Used for certificate authentication. As appears in the “Certificates & secrets” page of the app. False
Private Key Used for certificate authentication. The private key of the registered certificate. False
Use Azure Managed Identities Relevant only if the integration is running on Azure VM. If selected, authenticates based on the value provided for the Azure Managed Identities Client ID field. If no value is provided for the Azure Managed Identities Client ID field, authenticates based on the System Assigned Managed Identity. For additional information, see the Help tab. False
Azure Managed Identities Client ID The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM. False
Fetch incidents Whether to fetch incidents. False
Email address from which to fetch incidents For example, “example@demisto.com” False
Name of the folder or sub-folder from which to fetch incidents Supports folder ID and sub-folders, for example Inbox/Phishing. False
First fetch timestamp <number> /<time unit>, for example 12 hours, 7 days. False
HTTP Timeout The timeout of the HTTP requests sent to Microsoft Graph API (in seconds). False
Maximum number of emails to pull per fetch   False
Trust any certificate (not secure)   False
Use system proxy settings   False
Use a self deployed Azure application   False
Incident type   False
ID or Client ID - see Detailed Instructions (?)   False
Token or Tenant ID - see Detailed Instructions (?)   False
Key or Client Secret (Deprecated)   False
ID or Client ID - see Detailed Instructions (?) (Deprecated)   False
Token or Tenant ID - see Detailed Instructions (?) (Deprecated)   False
Display full email body If not active, only a preview of the email will be fetched.  
Mark fetched emails as read Relevant only if fetch incidents is active.  
Advanced: Time in minutes to look back when fetching emails Use this parameter to determine how far backward to look in the search for incidents that were created before the last run time and did not match the query when they were created. False

Required Permissions

The following permissions are required for all commands:

  • Mail.ReadWrite - Application
  • Mail.Send - Application
  • MailboxSettings.ReadWrite - Application

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

msgraph-mail-list-emails

Gets the properties of returned emails. Typically shows partial results, use the “page_size” and “pages_to_pull” arguments to get all results.

Base Command

msgraph-mail-list-emails

Input

Argument Name Description Required
user_id User ID from which to pull mails (can be principal ID (email address)). Required
folder_id A comma-separated list of folder IDs, in the format: (mail_box,child_mail_box,child_mail_box). . Optional
odata An OData query. See REDAME for OData usage examples. Optional
search The term for which to search. This argument cannot contain reserved characters such as !, $, #, @, etc. For further information, see https://tools.ietf.org/html/rfc3986#section-2.2. Optional
page_size Limit emails to fetch in one request. Default is 20. Optional
pages_to_pull The number of pages of emails to return (maximum is 10 emails per page). Default is 1. Optional
ran_once_flag flag for rate limit retry. Optional

Context Output

Path Type Description
MSGraphMail.ID String The ID of the email.
MSGraphMail.Created Date The time the email was created.
MSGraphMail.LastModifiedTime Date The time the email was last modified.
MSGraphMail.ReceivedTime Date The time the email was received.
MSGraphMail.SendTime Date The time the email was sent.
MSGraphMail.Categories String Categories of the email.
MSGraphMail.HasAttachments Boolean Whether the email has attachments.
MSGraphMail.Subject String The subject of email.
MSGraphMail.IsDraft Boolean Whether the email is a draft.
MSGraphMail.Body String The content (body) of the email.
MSGraphMail.Sender.Name String The name of sender.
MSGraphMail.Sender.Address String The email address of the sender.
MSGraphMail.From.Name String The name of the user in the ‘from’ field of the email.
MSGraphMail.From.Address String The email address of the user in the ‘from’ field of the email.
MSGraphMail.CCRecipients.Name String The names of the CC recipients.
MSGraphMail.CCRecipients.Address String The email address of the user in the ‘cc’ field of the email.
MSGraphMail.BCCRecipients.Name String The names of the users in the ‘bcc’ field of the email.
MSGraphMail.BCCRecipients.Address String The email address of the user in the ‘bcc’ field of the email.
MSGraphMail.ReplyTo.Name String The name in the ‘replyTo’ field of the email.
MSGraphMail.ReplyTo.Address String The email address in the ‘replyTo’ field of the email.
MSGraphMail.UserID String The ID of the user.
MSGraphMail.ConversationID String The ID of the conversation.
MSGraphMail.InternetMessageID String Internet Message ID of the message.
MSGraphMail.Recipients.Name String The name of the user in the ‘toRecipients’ field of the email.
MSGraphMail.Recipients.Address String The email address of the user in the ‘toRecipients’ field of the email.
MSGraphMail.NextPage String A token to pass to the next list command to retrieve additional results.

msgraph-mail-get-email

Returns the properties of an email.

Base Command

msgraph-mail-get-email

Input

Argument Name Description Required
user_id User ID or principal ID (usually an email address in the format someuser@example.com). Required
message_id The unique Exchange ID of the mail. This is not the same as the ‘MessageID’ key in the form ‘<message-id>’. Required
folder_id The folder ID. Optional
odata An OData query. See the README for OData usage examples. Optional
get_body Whether to return the message body. Possible values are: true, false. Optional
ran_once_flag Flag for rate limit retry. Optional

Context Output

Path Type Description
MSGraphMail.ID String The ID of the email.
MSGraphMail.Created Date The time the email was created.
MSGraphMail.LastModifiedTime Date The time the email was last modified.
MSGraphMail.ReceivedTime Date The time the email was received.
MSGraphMail.SendTime Date The time the email was sent.
MSGraphMail.Categories String Categories of the email.
MSGraphMail.HasAttachments Boolean Whether the email has attachments.
MSGraphMail.Subject String The subject of email.
MSGraphMail.IsDraft Boolean Whether the email is a draft.
MSGraphMail.Body String The content (body) of the email.
MSGraphMail.Sender.Name String The name of sender.
MSGraphMail.Sender.Address String The email address of the sender.
MSGraphMail.From.Name String The name of the user in the ‘from’ field of the email.
MSGraphMail.From.Address String The email address of the user in the ‘from’ field of the email.
MSGraphMail.CCRecipients.Name String The names of the users in the ‘cc’ field of the email.
MSGraphMail.CCRecipients.Address String The email address of the user in the ‘cc’ field of the email.
MSGraphMail.BCCRecipients.Name String The names of the users in the ‘bcc’ field of the email.
MSGraphMail.BCCRecipients.Address String The email address of the user in the ‘bcc’ field of the email.
MSGraphMail.ReplyTo.Name String The name in the ‘replyTo’ field of the email.
MSGraphMail.ReplyTo.Address String The email address in the ‘replyTo’ field of the email.
MSGraphMail.UserID String The ID of the user.
MSGraphMail.ConversationID String The ID of the conversation.
MSGraphMail.InternetMessageID String Internet Message ID of the message.
MSGraphMail.Recipients.Name String The name of the user in the ‘toRecipients’ field of the email.
MSGraphMail.Recipients.Address String The email address of the user in the ‘toRecipients’ field of the email.

msgraph-mail-delete-email

Deletes an email.

Base Command

msgraph-mail-delete-email

Input

Argument Name Description Required
user_id User ID or principal ID (usually an email address in the format someuser@example.com). Required
message_id The unique Exchange ID of the mail. This could be extracted from - msgraph-mail-list-emails command results. This is not the same as the ‘MessageID’ key in the form ‘<message-id>’. Required
folder_id A comma-separated list of folder IDs. For example, mailFolders,childFolders,childFolders. Optional
ran_once_flag Flag for rate limit retry. Optional

Context Output

There is no context output for this command.

msgraph-mail-list-attachments

Lists all of the attachments of given email

Base Command

msgraph-mail-list-attachments

Input

Argument Name Description Required
user_id User ID or principal ID (usually an email address in the format someuser@example.com). Required
message_id The unique Exchange ID of the mail. This is not the same as the ‘MessageID’ key in the form ‘<message-id>’. Required
folder_id A comma-separated list of folder IDs, in the format: (mail_box,child_mail_box,child_mail_box). Optional
ran_once_flag Flag for rate limit retry. Optional

Context Output

Path Type Description
MSGraphMailAttachment.ID String The email ID.
MSGraphMailAttachment.Attachment.ID String The ID of the attachment.
MSGraphMailAttachment.Attachment.Name String The name of the attachment.
MSGraphMailAttachment.Attachment.Type String The attachment type.
MSGraphMailAttachment.UserID String The ID of the user.

msgraph-mail-get-attachment

Gets an attachment from the email.

Base Command

msgraph-mail-get-attachment

Input

Argument Name Description Required
user_id User ID or principal ID (usually an email address in the format someuser@example.com). Required
message_id The unique Exchange ID of the mail. This is not the same as the ‘MessageID’ key in the form ‘<message-id>’. Required
folder_id A comma-separated list of folder IDs, in the format: (mail_box,child_mail_box,child_mail_box). Optional
attachment_id The ID of the attachment. In case it is not supplied, the command will return all the attachments. Optional
ran_once_flag flag for rate limit retry. Optional

Context Output

Path Type Description
File.Size Number The size of the file.
File.SHA1 String The SHA1 hash of the file.
File.SHA256 String The SHA256 hash of the file.
File.Name String The name of the file.
File.SSDeep String The SSDeep hash of the file.
File.EntryID String The entry ID of the file.
File.Info String File information.
File.Type String The file type.
File.MD5 String The MD5 hash of the file.
File.Extension String The file extension.

msgraph-mail-list-folders

Returns the mail folder list directly under the root folder.

Base Command

msgraph-mail-list-folders

Input

Argument Name Description Required
user_id User ID or principal ID (usually an email address in the format someuser@example.com). Required
limit The maximum number of mail folder lists to return. Default is 20. Optional
ran_once_flag flag for rate limit retry. Optional

Context Output

Path Type Description
MSGraphMail.Folders.ChildFolderCount Number The number of child folders.
MSGraphMail.Folders.DisplayName String The folder display name.
MSGraphMail.Folders.ID String The target folder ID.
MSGraphMail.Folders.ParentFolderID String The parent folder ID.
MSGraphMail.Folders.TotalItemCount Number The total number of email messages in the folder.
MSGraphMail.Folders.UnreadItemCount Number The number of unread emails in the folder.

msgraph-mail-list-child-folders

Returns the folder list under the specified folder.

Base Command

msgraph-mail-list-child-folders

Input

Argument Name Description Required
user_id User ID or principal ID (usually an email address in the format someuser@example.com). Required
parent_folder_id The ID of the parent folder. Required
limit The maximum number of mail folder lists to return. Default is 20. Optional
ran_once_flag flag for rate limit retry. Optional

Context Output

Path Type Description
MSGraphMail.Folders.ChildFolderCount Number The number of child folders.
MSGraphMail.Folders.DisplayName String The folder display name.
MSGraphMail.Folders.ID String The folder ID.
MSGraphMail.Folders.ParentFolderID String The parent folder ID.
MSGraphMail.Folders.TotalItemCount Number The total number of email messages in the folder.
MSGraphMail.Folders.UnreadItemCount Number The number of unread email messages in the folder.

msgraph-mail-create-folder

Creates a new folder under the specified folder (parent).

Base Command

msgraph-mail-create-folder

Input

Argument Name Description Required
user_id User ID or principal ID (usually an email address in the format someuser@example.com). Required
new_folder_name The display name of the new folder. Required
parent_folder_id The ID of the parent folder under which to create a new folder. Optional
ran_once_flag flag for rate limit retry. Optional

Context Output

Path Type Description
MSGraphMail.Folders.ChildFolderCount Number The number of child folders.
MSGraphMail.Folders.DisplayName String The folder display name.
MSGraphMail.Folders.ID String The folder ID.
MSGraphMail.Folders.ParentFolderID String The parent folder ID.
MSGraphMail.Folders.TotalItemCount Number The total number of email messages in the folder.
MSGraphMail.Folders.UnreadItemCount Number The number of unread email messages in the folder.

msgraph-mail-update-folder

Updates the properties of the specified folder.

Base Command

msgraph-mail-update-folder

Input

Argument Name Description Required
user_id User ID or principal ID (usually an email address in the format someuser@example.com). Required
folder_id The ID of the folder to update. Required
new_display_name The mail folder display name. Required
ran_once_flag Flag for rate limit retry. Optional

Context Output

Path Type Description
MSGraphMail.Folders.ChildFolderCount String The number of child folders.
MSGraphMail.Folders.DisplayName String The folder display name.
MSGraphMail.Folders.ID String The folder ID.
MSGraphMail.Folders.ParentFolderID String The parent folder ID.
MSGraphMail.Folders.TotalItemCount Number The total number of email messages in the folder.
MSGraphMail.Folders.UnreadItemCount Number The unread emails count inside the folder.

msgraph-mail-delete-folder

Deletes the specified mail folder.

Base Command

msgraph-mail-delete-folder

Input

Argument Name Description Required
user_id User ID or principal ID (usually an email address in the format someuser@example.com). Required
folder_id The ID of the folder to delete. Required
ran_once_flag Flag for rate limit retry. Optional

Context Output

There is no context output for this command.

msgraph-mail-move-email

Moves a message to a different folder.

Base Command

msgraph-mail-move-email

Input

Argument Name Description Required
message_id The unique Exchange ID of the mail. This is not the same as the ‘MessageID’ key in the form ‘<message-id>’. Required
destination_folder_id The ID of the destination folder. Required
user_id User ID or principal ID (usually an email address in the format someuser@example.com). Required
ran_once_flag Flag for rate limit retry. Optional

Context Output

Path Type Description
MSGraphMail.MovedEmails.DestinationFolderID String The folder where the email message was moved.
MSGraphMail.MovedEmails.ID String The new ID of the moved email message.
MSGraphMail.MovedEmails.UserID String The user ID.

msgraph-mail-get-email-as-eml

Retrieves an email message by message ID and uploads the content as an EML file.

Base Command

msgraph-mail-get-email-as-eml

Input

Argument Name Description Required
user_id User ID or principal ID (usually an email address in the format someuser@example.com). Required
message_id The unique Exchange ID of the mail. This is not the same as the ‘MessageID’ key in the form ‘<message-id>’. Required
ran_once_flag Flag for rate limit retry. Optional

Context Output

Path Type Description
File.Size String The size of the file.
File.SHA1 String The SHA1 hash of the file.
File.SHA256 String The SHA256 hash of the file.
File.SHA512 String The SHA512 hash of the file.
File.Name String The name of the file.
File.SSDeep String The SSDeep hash of the file.
File.EntryID String The EntryID of the file.
File.Info String Information about the file.
File.Type String The file type.
File.MD5 String The MD5 hash of the file.
File.Extension String The extension of the file.

msgraph-mail-create-draft

Creates a draft message in the specified user’s mailbox.

Base Command

msgraph-mail-create-draft

Input

Argument Name Description Required
to A comma-separated list of email addresses for the ‘to’ field. Optional
cc A comma-separated list of email addresses for the ‘cc’ field. Optional
bcc A comma-separated list of email addresses for the ‘bcc’ field. Optional
subject The subject for the draft. Required
body The contents (body) of the draft. Optional
bodyType The body type of the email. Can be: “text”, or “HTML”. Possible values are: text, HTML. Default is text. Optional
flag The flag value that indicates the status of the draft. Can be: “notFlagged”, “complete”, or “flagged”. Possible values are: notFlagged, complete, flagged. Default is notFlagged. Optional
importance The importance of the draft. Can be: “Low”, “Normal”, or “High”. Possible values are: Low, Normal, High. Default is Low. Optional
headers A comma-separated list of additional headers in the format, headerName:headerValue. For example, “headerName1:headerValue1,headerName2:headerValue2”. Optional
attachIDs A comma-separated list of War Room entry IDs that contain files, which are used to attach files to the draft. For example, attachIDs=15@8,19@8. Optional
attachNames A comma-separated list of names of attachments to be displayed in the draft. Must be the same number of elements as attachIDs. Optional
attachCIDs A comma-separated list of CIDs to embed attachments within the actual email. Optional
from The email address from which the draft is created. Required
ran_once_flag flag for rate limit retry. Optional

Context Output

Path Type Description
MicrosoftGraph.Draft.Cc String The CC recipients of the draft email.
MicrosoftGraph.Draft.IsRead String The “Is read” status of the draft email.
MicrosoftGraph.Draft.Bcc String The BCC recipients of the draft email.
MicrosoftGraph.Draft.Body String The body of the draft email.
MicrosoftGraph.Draft.MessageID String The message ID of the draft email.
MicrosoftGraph.Draft.SentTime Date The created time of the draft email.
MicrosoftGraph.Draft.Headers String The headers of the draft email.
MicrosoftGraph.Draft.From String The user that sent the draft email.
MicrosoftGraph.Draft.Subject String The subject of the draft email.
MicrosoftGraph.Draft.ReceivedTime String The received time of the draft email.
MicrosoftGraph.Draft.Importance String The importance status of the draft email.
MicrosoftGraph.Draft.CreatedTime String The created time of the draft email.
MicrosoftGraph.Draft.Sender String The sender of the draft email.
MicrosoftGraph.Draft.ModifiedTime Date The modified time of the draft email.
MicrosoftGraph.Draft.IsDraft Boolean Whether it is a draft email.
MicrosoftGraph.Draft.ID String The ID of the draft email.
MicrosoftGraph.Draft.To String The ‘to’ recipients of the draft email.
MicrosoftGraph.Draft.BodyType Unknown The body type of the draft email.
MicrosoftGraph.Draft.ConversationID String The conversation ID of the draft email.

send-mail

Sends an email using Microsoft Graph.
Note: The from argument needs to be specified when the Email address from which to fetch incidents parameter is missing.

Base Command

send-mail

Input

Argument Name Description Required
to A comma-separated list of email addresses for the ‘to’ field. Optional
cc A comma-separated list of email addresses for the ‘cc’ field. Optional
bcc A comma-separated list of email addresses for the ‘bcc’ field. Optional
subject The subject of the email. Required
body The contents (body) of the email. Optional
bodyType The body type of the email. Possible values are: text, HTML. Optional
flag The flag value that indicates the status for the email. Possible values are: notFlagged, complete, flagged. Default is notFlagged. Optional
importance The importance of the email. Possible values are: Low, Normal, High. Default is Low. Optional
headers A comma-separated list of additional headers in the format: headerName:headerValue. For example: “headerName1:headerValue1,headerName2:headerValue2”. Optional
attachIDs A comma-separated list of War Room entry IDs that contain files, which are used to attach files for the email to send. For example, attachIDs=15@8,19@8. Optional
attachNames A comma-separated list of names of attachments to display in the email to send. Must be the same number of elements as attachIDs. Optional
attachCIDs A comma-separated list of CIDs to embed attachments within the actual email. Optional
from The email address from which to send the email. Optional
htmlBody The content (body) of the email (in HTML format). Optional
replyTo Email addresses that need to be used to reply to the message. Supports comma-separated values. Optional
ran_once_flag Flag for rate limit retry. Optional

Context Output

Path Type Description
MicrosoftGraph.Email.internetMessageHeaders String The email headers.
MicrosoftGraph.Email.body String The body of the email.
MicrosoftGraph.Email.bodyPreview String The body preview of the email.
MicrosoftGraph.Email.subject String The subject of the email.
MicrosoftGraph.Email.flag String The flag status of the email.
MicrosoftGraph.Email.importance String The importance status of the email.
MicrosoftGraph.Email.toRecipients String The ‘to’ recipients of the email.
MicrosoftGraph.Email.ccRecipients String The CC recipients of the email.
MicrosoftGraph.Email.bccRecipients String The BCC recipients of the email.
MicrosoftGraph.Email.replyTo String The replyTo recipients of the email.

msgraph-mail-reply-to

The replies to the recipients of a message.

Base Command

msgraph-mail-reply-to

Input

Argument Name Description Required
ID The ID of the message. Required
body The comment of the replied message. Required
to A comma-separated list of email addresses for the ‘to’ field. Required
from The email address from which to reply. Required
attachIDs A comma-separated list of War Room entry IDs that contain files, which are used to attach files for the email to send. For example, attachIDs=15@8,19@8. Optional
attachNames A comma-separated list of names of attachments to display in the email to send. Must be the same number of elements as attachIDs. Optional
attachCIDs A CSV list of CIDs to embed attachments within the email itself. Optional
ran_once_flag Flag for rate limit retry. Optional

Context Output

There is no context output for this command.

msgraph-mail-send-draft

Sends a draft email using Microsoft Graph.

Base Command

msgraph-mail-send-draft

Input

Argument Name Description Required
draft_id The ID of the draft email. Required
from The email address from which to send the draft. Required
ran_once_flag Flag for rate limit retry. Optional

Context Output

There is no context output for this command.

reply-mail

Replies to an email using Graph Mail.

Base Command

reply-mail

Input

Argument Name Description Required
to A CSV list of email addresses for the ‘to’ field. Required
body The contents (body) of the email to be sent. Optional
subject Subject for the email to be sent. Required
inReplyTo ID of the item to reply to. Required
attachIDs A CSV list of War Room entry IDs that contain files, and are used to attach files to the outgoing email. For example: attachIDs=15@8,19@8. Optional
cc A CSV list of email addresses for the ‘cc’ field. Optional
bcc A CSV list of email addresses for the ‘bcc’ field. Optional
htmlBody HTML formatted content (body) of the email to be sent. This argument overrides the “body” argument. Optional
attachNames A CSV list of names of attachments to send. Should be the same number of elements as attachIDs. Optional
attachCIDs A CSV list of CIDs to embed attachments within the email itself. Optional
from Email address of the sender. Optional
replyTo Email addresses that need to be used to reply to the message. Supports comma-separated values. Optional
ran_once_flag Flag for rate limit retry. Optional

Context Output

Path Type Description
MicrosoftGraph.SentMail.body String The body of the email.
MicrosoftGraph.SentMail.bodyPreview String The body preview of the email.
MicrosoftGraph.SentMail.subject String The subject of the email.
MicrosoftGraph.SentMail.toRecipients String The ‘To’ recipients of the email.
MicrosoftGraph.SentMail.ccRecipients String The CC recipients of the email.
MicrosoftGraph.SentMail.bccRecipients String The BCC recipients of the email.
MicrosoftGraph.SentMail.ID String The immutable ID of the message.
MicrosoftGraph.SentMail.replyTo String The replyTo recipients of the email.

msgraph-mail-update-email-status

Update the status of an email to read / unread.

Base Command

msgraph-mail-update-email-status

Input

Argument Name Description Required
user_id User ID or principal ID (usually an email address. E.g., user@example.com). Required
message_ids The unique Exchange IDs of the mails to update. This is not the same as the ‘MessageID’ key in the form ‘<message-id>’. Can be a list of comma-separated values. Required
folder_id The folder ID. Optional
status Status to set the email to. Possible values are: Read, Unread. Required

Context Output

There is no context output for this command.

msgraph-mail-auth-reset

Run this command if for some reason you need to rerun the authentication process.

Base Command

msgraph-mail-auth-reset

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

msgraph-mail-list-rules

List email rules for a user’s mailbox using Microsoft Graph API.

Base Command

msgraph-mail-list-rules

Input

Argument Name Description Required
user_id User ID or principal ID (usually an email address in the format someuser@example.com). Required
limit Maximum number of results to return. Default is 50. Required

Context Output

Path Type Description
MSGraphMail.Rule.conditions Unknown Conditions that when fulfilled, will trigger the corresponding actions for that rule.
MSGraphMail.Rule.actions Unknown Actions to be taken on a message when the corresponding conditions are fulfilled.
MSGraphMail.Rule.displayName String The display name of the rule.
MSGraphMail.Rule.exceptions Unknown Exception conditions for the rule.
MSGraphMail.Rule.hasError Boolean Indicates whether the rule is in an error condition.
MSGraphMail.Rule.id String The ID of the rule.
MSGraphMail.Rule.isEnabled Boolean Indicates whether the rule is enabled to be applied to messages.
MSGraphMail.Rule.isReadOnly Boolean Indicates if the rule is read-only and cannot be modified or deleted by the rules REST API.
MSGraphMail.Rule.sequence Number Indicates the order in which the rule is executed, among other rules.

msgraph-mail-get-rule

Get details of a specific email rule by ID for a user’s mailbox using Microsoft Graph API.

Base Command

msgraph-mail-get-rule

Input

Argument Name Description Required
user_id User ID or principal ID (usually an email address in the format someuser@example.com). Required
rule_id The ID of the rule to retrieve. Required

Context Output

Path Type Description
MSGraphMail.Rule.conditions Unknown Conditions that when fulfilled, will trigger the corresponding actions for that rule.
MSGraphMail.Rule.actions Unknown Actions to be taken on a message when the corresponding conditions are fulfilled.
MSGraphMail.Rule.displayName String The display name of the rule.
MSGraphMail.Rule.exceptions Unknown Exception conditions for the rule.
MSGraphMail.Rule.hasError Boolean Indicates whether the rule is in an error condition.
MSGraphMail.Rule.id String The ID of the rule.
MSGraphMail.Rule.isEnabled Boolean Indicates whether the rule is enabled to be applied to messages.
MSGraphMail.Rule.isReadOnly Boolean Indicates if the rule is read-only and cannot be modified or deleted by the rules REST API.
MSGraphMail.Rule.sequence Number Indicates the order in which the rule is executed, among other rules.

msgraph-mail-delete-rule

Deletes a specific email rule by ID from a user’s mailbox using the Microsoft Graph API.

Base Command

msgraph-mail-delete-rule

Input

Argument Name Description Required
user_id User ID or principal ID (usually an email address in the format someuser@example.com). Required
rule_id The ID of the rule to delete. Required

Context Output

There is no context output for this command.

msgraph-mail-get-settings

Retrieves the user’s mailbox settings, including automatic replies, time zone, locale, working hours, date/time formats, archive folder, and user purpose.

Base Command

msgraph-mail-get-settings

Input

Argument Name Description Required
user_id The ID or User Principal Name (UPN) of the user that owns the mailbox. Required

Context Output

Path Type Description
MSGraphMail.MailboxSettings.userId String The ID of the user whose mailbox settings were retrieved (mirrors the user_id input).
MSGraphMail.MailboxSettings.archiveFolder String The folder ID of an archive folder for the user.
MSGraphMail.MailboxSettings.dateFormat String The date format for the user’s mailbox.
MSGraphMail.MailboxSettings.delegateMeetingMessageDeliveryOptions String The delivery method for meeting requests, updates, and responses are delivered when the user is a delegate. Possible values: sendToDelegateAndInformationToPrincipal, sendToDelegateAndPrincipal, sendToDelegateOnly.
MSGraphMail.MailboxSettings.timeFormat String The time format for the user’s mailbox.
MSGraphMail.MailboxSettings.timeZone String The default time zone for the user’s mailbox.
MSGraphMail.MailboxSettings.userPurpose String The purpose of the mailbox. Possible values: unknown, user, linked, shared, room, equipment, others.
MSGraphMail.MailboxSettings.automaticRepliesSetting.status String The status of the automatic reply (out-of-office) feature. Possible values: disabled, alwaysEnabled, scheduled.
MSGraphMail.MailboxSettings.automaticRepliesSetting.externalAudience String The audience that receives the external replies. Possible values: none, contactsOnly, all.
MSGraphMail.MailboxSettings.automaticRepliesSetting.internalReplyMessage String The automatic reply sent to senders within the user’s organization.
MSGraphMail.MailboxSettings.automaticRepliesSetting.externalReplyMessage String The automatic reply sent to senders outside the user’s organization. Sent only if externalAudience is contactsOnly or all.
MSGraphMail.MailboxSettings.automaticRepliesSetting.scheduledStartDateTime.dateTime Date The start date and time automatic replies are sent (ISO 8601 format, for example 2020-01-01T00:11:22Z)).
MSGraphMail.MailboxSettings.automaticRepliesSetting.scheduledStartDateTime.timeZone String The time zone of the scheduledStartDateTime.
MSGraphMail.MailboxSettings.automaticRepliesSetting.scheduledEndDateTime.dateTime Date The end date and time automatic replies are sent (ISO 8601 format, for example 2020-01-01T00:11:22Z)).
MSGraphMail.MailboxSettings.automaticRepliesSetting.scheduledEndDateTime.timeZone String The time zone of the scheduledEndDateTime.
MSGraphMail.MailboxSettings.language.locale String The language locale (BCP 47 culture name). For example, en-US.
MSGraphMail.MailboxSettings.language.displayName String The display name of the language. For example, “English (United States)”.
MSGraphMail.MailboxSettings.workingHours.daysOfWeek Unknown The days of the week the user works. Possible values: sunday, monday, tuesday, wednesday, thursday, friday, saturday.
MSGraphMail.MailboxSettings.workingHours.startTime String The time of day the user starts work.
MSGraphMail.MailboxSettings.workingHours.endTime String The time of day the user stops work.
MSGraphMail.MailboxSettings.workingHours.timeZone.name String The time zone name to which the working hours apply.

msgraph-mail-create-rule

Creates a new mailbox rule in the user’s Inbox folder. By default, rules are created as disabled and if no sequence is defined, assigned to the first position in the sequence.

Base Command

msgraph-mail-create-rule

Input

Argument Name Description Required
user_id The ID or User Principal Name (UPN) of the user that owns the mailbox. Required
display_name The display name of the rule. Required
sequence The execution order of the rule among other rules. Must be a positive integer greater than or equal to 1. Lower numbers run first. If the specified sequence is already used by an existing rule, the new rule takes that sequence and the existing rule, along with any following rules, is shifted up by 1. Default is 1. Optional
actions The actions to perform when the rule conditions are met, in JSON format. For a list of the available fields,
see: https://learn.microsoft.com/en-us/graph/api/resources/messageruleactions.
Example: {"forwardTo":[{"emailAddress":{"address":"alex@contoso.com"}}],"stopProcessingRules":true}.		 Required
conditions The conditions that trigger the rule’s actions, in JSON format. For a list of the available fields,
see: https://learn.microsoft.com/en-us/graph/api/resources/messagerulepredicates.
Example: {"senderContains":["adele"],"subjectContains":["urgent"]}.		 Optional
exceptions The exception conditions for the rule, in JSON format. Replaces existing rule exceptions.
For a list of the available fields, see: https://learn.microsoft.com/en-us/graph/api/resources/messagerulepredicates.
Example: {"fromAddresses":[{"emailAddress":{"address":"trusted@contoso.com"}}]}.		 Optional
is_enabled Whether the rule is enabled to be applied to messages. Default is false (disabled). Possible values are: true, false. Optional

Context Output

Path Type Description
MSGraphMail.Rule.id String The unique identifier of the rule.
MSGraphMail.Rule.displayName String The display name of the rule.
MSGraphMail.Rule.sequence Number The order in which the rule is executed relative to other rules.
MSGraphMail.Rule.isEnabled Boolean Whether the rule is enabled to be applied to messages.
MSGraphMail.Rule.isReadOnly Boolean Whether the rule is read-only and cannot be modified or deleted by the rule’s REST API.
MSGraphMail.Rule.hasError Boolean Whether the rule is in an error condition.
MSGraphMail.Rule.conditions Unknown The conditions that trigger the rule’s actions.
MSGraphMail.Rule.actions Unknown The actions to perform on a message when the rule conditions are met.
MSGraphMail.Rule.exceptions Unknown The exception conditions for the rule.

msgraph-mail-update-rule

Updates an existing mailbox rule in the user’s Inbox folder by ID. Only the supplied fields are sent in the PATCH body; other fields remain unchanged.

Base Command

msgraph-mail-update-rule

Input

Argument Name Description Required
user_id The ID or User Principal Name (UPN) of the user that owns the mailbox. Required
rule_id The ID of the rule to update. Required
display_name The new display name of the rule. Optional
sequence The execution order of the rule among other rules. Must be a positive integer greater than or equal to 1. Lower numbers run first. If the specified sequence is already used by an existing rule, the new rule takes that sequence and the existing rule, along with any following rules, is shifted up by 1. Optional
is_enabled Whether the rule is enabled to be applied to messages. Possible values are: true, false. Optional
actions The actions to perform when the rule conditions are met, in JSON format. For a list of the available fields,
see: https://learn.microsoft.com/en-us/graph/api/resources/messageruleactions.
Example: {"forwardTo":[{"emailAddress":{"address":"alex@contoso.com"}}],"stopProcessingRules":true}.		 Optional
conditions The conditions that trigger the rule’s actions, in JSON format. For a list of the available fields,
see: https://learn.microsoft.com/en-us/graph/api/resources/messagerulepredicates.
Example: {"senderContains":["adele"],"subjectContains":["urgent"]}.		 Optional
exceptions The exception conditions for the rule, in JSON format. Replaces existing rule exceptions.
For a list of the available fields, see: https://learn.microsoft.com/en-us/graph/api/resources/messagerulepredicates.
Example: {"fromAddresses":[{"emailAddress":{"address":"trusted@contoso.com"}}]}.		 Optional

Context Output

Path Type Description
MSGraphMail.Rule.id String The unique identifier of the rule.
MSGraphMail.Rule.displayName String The display name of the rule.
MSGraphMail.Rule.sequence Number The order in which the rule is executed relative to other rules.
MSGraphMail.Rule.isEnabled Boolean Whether the rule is enabled to be applied to messages.
MSGraphMail.Rule.isReadOnly Boolean Whether the rule is read-only and cannot be modified or deleted by the rule’s REST API.
MSGraphMail.Rule.hasError Boolean Whether the rule is in an error condition.
MSGraphMail.Rule.conditions Unknown The conditions that trigger the rule’s actions.
MSGraphMail.Rule.actions Unknown The actions to perform on a message when the rule conditions are met.
MSGraphMail.Rule.exceptions Unknown The exception conditions for the rule.

msgraph-mail-get-mailtips

Retrieves Mail Tips for the specified email address, including out-of-office status, mailbox-full status, max message size, delivery restrictions, recipient scope, custom mail tip, and group membership counts.

Base Command

msgraph-mail-get-mailtips

Input

Argument Name Description Required
email_address The email address (User Principal Name / UPN) of the mailbox to retrieve Mail Tips for. Required

Context Output

Path Type Description
MSGraphMail.MailTips.emailAddress.name String The display name of the recipient.
MSGraphMail.MailTips.emailAddress.address String The SMTP address of the recipient.
MSGraphMail.MailTips.emailAddressValue String The email address of the recipient (flattened key used for context merging).
MSGraphMail.MailTips.automaticReplies.message String The automatic reply message.
MSGraphMail.MailTips.automaticReplies.messageLanguage.locale String The language locale (BCP 47) of the automatic reply message.
MSGraphMail.MailTips.automaticReplies.messageLanguage.displayName String The display name of the language for the automatic reply message.
MSGraphMail.MailTips.mailboxFull Boolean Whether the recipient mailbox is full.
MSGraphMail.MailTips.customMailTip String A custom Mail Tip that has been configured for the recipient.
MSGraphMail.MailTips.externalMemberCount Number The number of external members in a group.
MSGraphMail.MailTips.totalMemberCount Number The number of members in a group.
MSGraphMail.MailTips.deliveryRestricted Boolean Whether delivery restrictions will prevent the sender’s message from reaching the recipient.
MSGraphMail.MailTips.isModerated Boolean Whether sending messages to the recipient requires approval. For example, if the recipient is a large distribution list and a moderator has been set up to approve messages sent to that list.
MSGraphMail.MailTips.recipientScope String The scope of the recipient. Possible values: none, internal, external, externalPartner, externalNonPartner.
MSGraphMail.MailTips.recipientSuggestions Unknown The recipients identified from previous contexts who appeared in the same message.
MSGraphMail.MailTips.maxMessageSize Number The maximum message size configured for the recipient’s organization or mailbox.
MSGraphMail.MailTips.error.code String The error code returned if the Mail Tips lookup for the recipient fails.
MSGraphMail.MailTips.error.message String The human-readable error message returned if the Mail Tips lookup for the recipient fails.

Configuration parameters

  • url — Server URL (required)
  • creds_auth_id —
  • creds_tenant_id —
  • credentials —
  • creds_certificate — Certificate Thumbprint
  • certificate_thumbprint — Certificate Thumbprint
  • private_key — Private Key
  • self_deployed — Use a self deployed Azure application
  • use_managed_identities — Use Azure Managed Identities
  • managed_identities_client_id —
  • isFetch — Fetch incidents
  • mailbox_to_fetch — Email address from which to fetch incidents
  • folder_to_fetch — Name of the folder or sub-folder from which to fetch incidents
  • first_fetch — First fetch timestamp
  • timeout — HTTP Timeout
  • fetch_limit — Maximum number of emails to pull per fetch
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • _auth_id — ID or Client ID
  • _tenant_id — Token or Tenant ID
  • enc_key — Key or Client Secret (Deprecated)
  • auth_id — ID or Client ID - see Detailed Instructions (?) (Deprecated)
  • tenant_id — Token or Tenant ID - see Detailed Instructions (?) (Deprecated)
  • display_full_email_body — Display full email body
  • mark_fetched_read — Mark fetched emails as read
  • look_back — Advanced: Time in minutes to look back when fetching emails
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • legacy_name — Use legacy attachment name

Commands (26)

  • msgraph-mail-auth-reset

    Run this command if for some reason you need to rerun the authentication process.

  • msgraph-mail-create-draft

    Creates a draft message in the specified user's mailbox.

  • msgraph-mail-create-folder

    Creates a new folder under the specified folder (parent).

  • msgraph-mail-create-rule

    Creates a new mailbox rule in the user's Inbox folder. By default, rules are created as disabled and if no sequence is defined, assigned to the first position in the sequence.

  • msgraph-mail-delete-email

    Deletes an email.

  • msgraph-mail-delete-folder

    Deletes the specified mail folder.

  • msgraph-mail-delete-rule

    Deletes a specific email rule by ID from a user's mailbox using the Microsoft Graph API.

  • msgraph-mail-get-attachment

    Gets an attachment from the email.

  • msgraph-mail-get-email

    Returns the properties of an email.

  • msgraph-mail-get-email-as-eml

    Retrieves an email message by message ID and uploads the content as an EML file.

  • msgraph-mail-get-mailtips

    Retrieves Mail Tips for the specified email address, including out-of-office status, mailbox-full status, max message size, delivery restrictions, recipient scope, custom mail tip, and group membership counts.

  • msgraph-mail-get-rule

    Get details of a specific email rule by ID for a user's mailbox using Microsoft Graph API.

  • msgraph-mail-get-settings

    Retrieves the user's mailbox settings, including automatic replies, time zone, locale, working hours, date/time formats, archive folder, and user purpose.

  • msgraph-mail-list-attachments

    Lists all of the attachments of given email.

  • msgraph-mail-list-child-folders

    Returns the folder list under the specified folder.

  • msgraph-mail-list-emails

    Gets the properties of returned emails. Typically shows partial results, use the "page_size" and "pages_to_pull" arguments to get all results.

  • msgraph-mail-list-folders

    Returns the mail folder list directly under the root folder.

  • msgraph-mail-list-rules

    List email rules for a user's mailbox using Microsoft Graph API.

  • msgraph-mail-move-email

    Moves a message to a different folder.

  • msgraph-mail-reply-to

    The replies to the recipients of a message.

  • msgraph-mail-send-draft

    Sends a draft email using Microsoft Graph.

  • msgraph-mail-update-email-status

    Update the status of an email to read / unread.

  • msgraph-mail-update-folder

    Updates the properties of the specified folder.

  • msgraph-mail-update-rule

    Updates an existing mailbox rule in the user's Inbox folder by ID. Only the supplied fields are sent in the PATCH body; other fields remain unchanged.

  • reply-mail

    Replies to an email using Graph Mail.

  • send-mail

    Sends an email using Microsoft Graph.

Source

MicrosoftGraphMail.py MicrosoftGraphMail_test.py MicrosoftGraphMail.yml MicrosoftGraphMail_description.md command_examples.txt
Download History Raw 
msgraph-mail-create-folder user_id=dev@demistodev.onmicrosoft.com new_folder_name="Test_folder"
msgraph-mail-delete-email user_id=dev@demistodev.onmicrosoft.com message_id=AQMkADY0ZjMxZmMyLWU3MjgtNDNiOS04ZDZmLTYxZDVkYzk1MTg5MwBGAAADbTQIjNRTu0OcDJw7xPpreQcAdQ8OJfUvxEa-MxMBZHrT7QAAAgEMAAAAdQ8OJfUvxEa-MxMBZHrT7QAB3Wln6AAAAA==
msgraph-mail-delete-folder user_id=dev@demistodev.onmicrosoft.com folder_id=Test_folder
msgraph-mail-get-attachment attachment_id=AQMkADY0ZjMxZmMyLWU3MjgtNDNiOS04ZDZmLTYxZDVkYzk1MTg5MwBGAAADbTQIjNRTu0OcDJw7xPpreQcAdQ8OJfUvxEa-MxMBZHrT7QAAAgEMAAAAdQ8OJfUvxEa-MxMBZHrT7QAB3Wln6QAAAAESABAARmHS0ZRrfE2rGy1-02TDIQ== message_id=AQMkADY0ZjMxZmMyLWU3MjgtNDNiOS04ZDZmLTYxZDVkYzk1MTg5MwBGAAADbTQIjNRTu0OcDJw7xPpreQcAdQ8OJfUvxEa-MxMBZHrT7QAAAgEMAAAAdQ8OJfUvxEa-MxMBZHrT7QAB3Wln6QAAAA== user_id=dev@demistodev.onmicrosoft.com
msgraph-mail-get-email message_AAAA== user_id=dev@demistodev.onmicrosoft.com
msgraph-mail-get-email-as-eml message_AAAA== user_id=dev@demistodev.onmicrosoft.com
msgraph-mail-list-attachments message_id=AQMkADY0ZjMxZmMyLWU3MjgtNDNiOS04ZDZmLTYxZDVkYzk1MTg5MwBGAAADbTQIjNRTu0OcDJw7xPpreQcAdQ8OJfUvxEa-MxMBZHrT7QAAAgEMAAAAdQ8OJfUvxEa-MxMBZHrT7QAB3Wln6QAAAA== user_id=dev@demistodev.onmicrosoft.com
msgraph-mail-list-child-folders user_id=dev@demistodev.onmicrosoft.com parent_folder_id=inbox
msgraph-mail-list-emails user_id=dev@demistodev.onmicrosoft.com search="Demo" folder_id=inbox
msgraph-mail-list-folders user_id=dev@demistodev.onmicrosoft.com limit=2
msgraph-mail-move-email user_id=dev@demistodev.onmicrosoft.com message_id=AQMkADY0ZjMxZmMyLWU3MjgtNDNiOS04ZDZmLTYxZDVkYzk1MTg5MwBGAAADbTQIjNRTu0OcDJw7xPpreQcAdQ8OJfUvxEa-MxMBZHrT7QAAAgEMAAAAdQ8OJfUvxEa-MxMBZHrT7QAB3Wln6AAAAA== destination_folder_id=inbox
msgraph-mail-update-folder user_id=dev@demistodev.onmicrosoft.com folder_id=AAMkADY0ZjMxZmMyLWU3MjgtNDNiOS04ZDZmLTYxZDVkYzk1MTg5MwAuAAAAAABtNAiM1FO7Q5wMnDvE_mt5AQB1Dw4l9S-ERr8zEwFketPtAACf6EquAAA= new_display_name="new_test"
msgraph-mail-create-draft from=dev@demistodev.onmicrosoft.com subject="This is a draft" body="This is a body" to=dev@demistodev.onmicrosoft.com
msgraph-mail-reply-to AAAA== body="reply_body" from=dev@demistodev.onmicrosoft.com to=dev@demistodev.onmicrosoft.com
msgraph-mail-send-draft draft_id=AAA= from=dev@demistodev.onmicrosoft.com
send-mail subject="Demo test send mail" from=dev@demistodev.onmicrosoft.com attachIDs=7613@f6e9c46f-e2e9-446f-8cd9-909bd5f72dbf to=dev@demistodev.onmicrosoft.com attachNames="test_attachment"
reply-mail to=dev@demistodev.onmicrosoft.com body=This is the body subject=This is the subject inReplyTo=AAMkAGY3OTQyM cc=dev3@demistodev.onmicrosoft.com bcc=dev2@demistodev.onmicrosoft.com attachCIDs=3604@6e069bc4-2a1e-43ea-8ed3-ea558e377751
msgraph-mail-list-rules user_id="dev@demistodev.onmicrosoft.com"
msgraph-mail-get-rule rule_id="AQAABrnJmxg=" user_id="dev@demistodev.onmicrosoft.com"
msgraph-mail-delete-rule rule_id="AQAABrnJmxg=" user_id="dev@demistodev.onmicrosoft.com"
msgraph-mail-create-rule user_id="dev@demistodev.onmicrosoft.com" display_name="XSOAR test rule" sequence=10 is_enabled=false actions=`{"markAsRead":true,"stopProcessingRules":true}` conditions=`{"subjectContains":["xsoar-test"]}`
msgraph-mail-update-rule user_id="dev@demistodev.onmicrosoft.com" rule_id="AQAABrnJmxg=" display_name="XSOAR test rule renamed" is_enabled=true
msgraph-mail-get-settings user_id="dev@demistodev.onmicrosoft.com"
msgraph-mail-get-mailtips email_address="dev@demistodev.onmicrosoft.com"