Email Address Enrichment - Generic v2 Deprecated Hidden

Deprecated. Use "Email Address Enrichment - Generic v2.1" playbook instead. Enrich email addresses. Email address enrichment involves: - Getting information from Active Directory for internal addresses - Getting the domain-squatting reputation for external addresses

Deprecated Content (Deprecated) · 13 tasks · 3 inputs · 17 outputs

Details

ID	`Email Address Enrichment - Generic v2`
From Version	5.0.0
Tasks	13

README

DEPRECATED. Use “Email Address Enrichment - Generic v2.1” playbook instead. Enriches email addresses.

Email address enrichment involves:

Getting information from Active Directory for internal addresses.
Getting the domain-squatting reputation for external addresses.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

Exists
IsEmailAddressInternal
ADGetUser
EmailDomainSquattingReputation

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Default Value	Source	Required
InternalDomains	The CSV list of internal domains. The list will be used to determine whether an email address is internal or external.	None	inputs.InternalDomains	Optional
Email	The email addresses to enrich.	Email.Address	Account	Optional
Domain	The domains associated with the incident.	inputs.Domain	-	Optional

Playbook Outputs

Path	Description	Type
Account	The account object.	unknown
Account.Email.Address	The email account full address.	string
Account.Groups	The groups the account belongs to.	string
Account.Email.Domain	The email account domain.	string
Account.Email.NetworkType	The email account networktype. Can be, “Internal” or “External”.	string
Account.Type	The account entity type.	string
Account.Email.Username	The email account username.	string
Account.ID	The unique account DN (Distinguished Name).	string
Account.DisplayName	The account display name.	string
Account.Manager	The account’s manager.	string
Account.Email.Distance.Domain	The compared domain.	string
Account.Email.Distance.Value	The distance between the email domain and the compared domain.	number
DBotScore.Indicator	The indicator.	string
DBotScore	The DBotScore object.	unknown
DBotScore.Type	The indicator type.	string
DBotScore.Vendor	The DBot score vendor.	string
DBotScore.Score	The DBot score.	number

Playbook Image

Email_Address_Enrichment_Generic_v2

Inputs

InternalDomains — A CSV list of internal domains. The list will be used to determine whether an email address is internal or external.
Email — The email addresses to enrich.
Domain — The domains associated with the incident.

Outputs

Account — The Account object.
Account.Email.Address — The email account full address.
Account.Groups — The groups the account belongs to.
Account.Email.Domain — The email account domain.
Account.Email.NetworkType — The email account NetworkType (Internal/External).
Account.Type — Account entity type.
Account.Email.Username — The email account username.
Account.ID — The unique account DN (Distinguished Name).
Account.DisplayName — The account display name.
Account.Manager — The account's manager.
Account.Email.Distance.Domain — The compared domain.
Account.Email.Distance.Value — The distance between the email domain and the compared domain.
DBotScore.Indicator — The indicator.
DBotScore — The DBotScore object.
DBotScore.Type — The indicator type.
DBotScore.Vendor — The DBot score vendor.
DBotScore.Score — The DBot score.

Flowchart

Source

playbook-Email_Address_Enrichment_-_Generic_v2.yml

Download History Raw

id: Email Address Enrichment - Generic v2
version: -1
fromversion: 5.0.0
name: Email Address Enrichment - Generic v2
description: |-
  Deprecated. Use "Email Address Enrichment - Generic v2.1" playbook instead. Enrich email addresses.  Email address enrichment involves:
  - Getting information from Active Directory for internal addresses
  - Getting the domain-squatting reputation for external addresses
starttaskid: "0"
hidden: true
tasks:
  "0":
    id: "0"
    taskid: 10b003be-68f2-4e57-8f11-d0475f1aac42
    type: start
    task:
      id: 10b003be-68f2-4e57-8f11-d0475f1aac42
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "4":
    id: "4"
    taskid: 01ab9a35-e60e-4331-826d-48194fb5a771
    type: title
    task:
      id: 01ab9a35-e60e-4331-826d-48194fb5a771
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    scriptarguments:
      details: {}
      fromclosedate: {}
      fromdate: {}
      fromduedate: {}
      id: {}
      level: {}
      name: {}
      notstatus: {}
      owner: {}
      page: {}
      query:
        simple: entry.contents:${Account.Username}
      reason: {}
      size: {}
      sort: {}
      status: {}
      toclosedate: {}
      todate: {}
      toduedate: {}
      type: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 1410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: db8113cf-a721-49a6-83dd-152e83c7d962
    type: condition
    task:
      id: db8113cf-a721-49a6-83dd-152e83c7d962
      version: -1
      name: Are there email addresses to check?
      description: Determines whether the playbook's input contains at least one email address.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "20"
      "yes":
      - "9"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.Email
            iscontext: true
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "9":
    id: "9"
    taskid: 17c82691-cc28-445a-8aea-129217f589d6
    type: regular
    task:
      id: 17c82691-cc28-445a-8aea-129217f589d6
      version: -1
      name: Classify email addresses as internal or external
      description: Adds a NetworkType attribute to all email addresses. The NetworkType attribute determines whether the email address is an internal or external email address, according to the domains that were passed as arguments to this playbook.
      scriptName: IsEmailAddressInternal
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "13"
      - "14"
    scriptarguments:
      domain:
        complex:
          root: inputs.InternalDomains
          transformers:
          - operator: uniq
      email:
        complex:
          root: inputs.Email
          transformers:
          - operator: uniq
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "10":
    id: "10"
    taskid: e82515ea-9f9a-4273-8182-e6a84b24e4d6
    type: title
    task:
      id: e82515ea-9f9a-4273-8182-e6a84b24e4d6
      version: -1
      name: Internal
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "17"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 672.5,
          "y": 785
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "11":
    id: "11"
    taskid: d501d6f3-d086-40fa-8c28-052fc32787fb
    type: title
    task:
      id: d501d6f3-d086-40fa-8c28-052fc32787fb
      version: -1
      name: External
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 100.5,
          "y": 785
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "12":
    id: "12"
    taskid: 5499e24d-dd70-4b65-88af-eeca45b06f9f
    type: regular
    task:
      id: 5499e24d-dd70-4b65-88af-eeca45b06f9f
      version: -1
      name: Get email address info from Active Directory
      description: Uses Active Directory to get user information for internal emails. addresses.
      scriptName: ADGetUser
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      attributes: {}
      customFieldData: {}
      customFieldType: {}
      dn: {}
      email:
        complex:
          root: Account
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: Account.Email.NetworkType
                iscontext: true
              right:
                value:
                  simple: Internal
              ignorecase: true
          accessor: Email.Address
          transformers:
          - operator: uniq
      headers: {}
      limit: {}
      name: {}
      nestedSearch: {}
      userAccountControlOut: {}
      username: {}
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 672.5,
          "y": 1215
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "13":
    id: "13"
    taskid: 2d740d11-a326-4913-83f1-8df803c0a3eb
    type: condition
    task:
      id: 2d740d11-a326-4913-83f1-8df803c0a3eb
      version: -1
      name: Are there any external email addresses?
      description: Checks whether there are email addresses with a NetworkType attribute value of "External".
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "11"
    scriptarguments:
      value:
        complex:
          root: Account
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: Account.Email.NetworkType
                iscontext: true
              right:
                value:
                  simple: External
              ignorecase: true
          accessor: Email
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 100.5,
          "y": 580
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "14":
    id: "14"
    taskid: e521733d-b152-4a1f-8050-e7658405a187
    type: condition
    task:
      id: e521733d-b152-4a1f-8050-e7658405a187
      version: -1
      name: Are there any internal email addresses?
      description: Checks whether there are email addresses with a NetworkType attribute value of "Internal".
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "10"
    scriptarguments:
      value:
        complex:
          root: Account
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: Account.Email.NetworkType
                iscontext: true
              right:
                value:
                  simple: Internal
              ignorecase: true
          accessor: Email
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 672.5,
          "y": 580
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "15":
    id: "15"
    taskid: 14d9b7c3-73b3-49e7-887a-82c080a62d38
    type: regular
    task:
      id: 14d9b7c3-73b3-49e7-887a-82c080a62d38
      version: -1
      name: Check email addresses for domain-squatting
      description: Checks if an email address's domain is trying to squat other domains using Levenshtein distance algorithm.
      scriptName: EmailDomainSquattingReputation
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      domain:
        complex:
          root: inputs.Domain
          transformers:
          - operator: uniq
      email:
        complex:
          root: Account
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: Account.Email.NetworkType
                iscontext: true
              right:
                value:
                  simple: External
              ignorecase: true
          accessor: Email.Address
          transformers:
          - operator: uniq
      threshold: {}
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 100.5,
          "y": 1215
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "17":
    id: "17"
    taskid: 252874b2-867f-4406-8442-cc3999fac864
    type: condition
    task:
      id: 252874b2-867f-4406-8442-cc3999fac864
      version: -1
      name: Is Active Directory enabled?
      description: Checks if there's an active instance of the Active Directory integration enabled.
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "12"
    scriptarguments:
      value:
        complex:
          root: modules
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: modules.brand
                iscontext: true
              right:
                value:
                  simple: activedir
          - - operator: isEqualString
              left:
                value:
                  simple: modules.state
                iscontext: true
              right:
                value:
                  simple: active
          accessor: brand
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 672.5,
          "y": 960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "18":
    id: "18"
    taskid: 1f1a6cd8-5aaa-4b0a-8147-e91dc6beec49
    type: condition
    task:
      id: 1f1a6cd8-5aaa-4b0a-8147-e91dc6beec49
      version: -1
      name: Is there a domain list input?
      description: Checks if there is at least one domain to check for domain-squatting.
      scriptName: Exists
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "15"
    scriptarguments:
      value:
        complex:
          root: inputs.Domain
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 100.5,
          "y": 960
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "20":
    id: "20"
    taskid: 3ecf1917-78f6-4350-84bb-704fdaa1bf05
    type: title
    task:
      id: 3ecf1917-78f6-4350-84bb-704fdaa1bf05
      version: -1
      name: No Email Addresses
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -380,
          "y": 785
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {
      "13_11_yes": 0.64,
      "13_4_#default#": 0.16,
      "14_10_yes": 0.65,
      "14_4_#default#": 0.17,
      "17_4_#default#": 0.23,
      "18_4_#default#": 0.23,
      "5_20_#default#": 0.35
    },
    "paper": {
      "dimensions": {
        "height": 1425,
        "width": 1432.5,
        "x": -380,
        "y": 50
      }
    }
  }
inputs:
- key: InternalDomains
  value:
    complex:
      root: inputs.InternalDomains
      transformers:
      - operator: uniq
  required: false
  description: A CSV list of internal domains. The list will be used to determine whether an email address is internal or external.
- key: Email
  value:
    complex:
      root: Account
      accessor: Email.Address
      transformers:
      - operator: uniq
  required: false
  description: The email addresses to enrich.
- key: Domain
  value:
    simple: inputs.Domain
  required: false
  description: The domains associated with the incident.
outputs:
- contextPath: Account
  description: The Account object.
  type: unknown
- contextPath: Account.Email.Address
  description: The email account full address.
  type: string
- contextPath: Account.Groups
  description: The groups the account belongs to.
  type: string
- contextPath: Account.Email.Domain
  description: The email account domain.
  type: string
- contextPath: Account.Email.NetworkType
  description: The email account NetworkType (Internal/External).
  type: string
- contextPath: Account.Type
  description: Account entity type.
  type: string
- contextPath: Account.Email.Username
  description: The email account username.
  type: string
- contextPath: Account.ID
  description: The unique account DN (Distinguished Name).
  type: string
- contextPath: Account.DisplayName
  description: The account display name.
  type: string
- contextPath: Account.Manager
  description: The account's manager.
  type: string
- contextPath: Account.Email.Distance.Domain
  description: The compared domain.
  type: string
- contextPath: Account.Email.Distance.Value
  description: 'The distance between the email domain and the compared domain. '
  type: number
- contextPath: DBotScore.Indicator
  description: The indicator.
  type: string
- contextPath: DBotScore
  description: The DBotScore object.
  type: unknown
- contextPath: DBotScore.Type
  description: The indicator type.
  type: string
- contextPath: DBotScore.Vendor
  description: The DBot score vendor.
  type: string
- contextPath: DBotScore.Score
  description: The DBot score.
  type: number
tests:
- No tests
deprecated: true