Get Original Email - Gmail v2

This v2 playbook uses the reporter's email headers to retrieve the original email. This decreases the number of tasks to retrieve the original email. Use this playbook to retrieve the original email using the Gmail integration, including headers and attachments. Note: You must have the necessary Google Apps Domain-Wide Delegation of Authority permissions in your Gmail service to execute global search.

Gmail · 8 tasks · 2 inputs · 10 outputs

Details

ID	`Get Original Email - Gmail v2`
From Version	6.0.0
Tasks	8

README

This v2 playbook uses the reporter email headers to retrieve the original email. This decreases the amount of the tasks needed to retrieve the original email.

Use this playbook to retrieve the original email using Gmail integration, including headers and attachments.

You must have the necessary permissions in your Gmail service to execute global search: Google Apps Domain-Wide Delegation of Authority.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

Gmail

Scripts

Set
IsIntegrationAvailable

Commands

gmail-search
gmail-get-attachments

Playbook Inputs

Name	Description	Default Value	Required
MessageID	The original email message id to retrieve. Holds the value of the “Message-ID” header of the original email and not Gmail’s internal ID of the message.		Optional
UserID	The email address of the user for which to fetch the original email.		Optional

Playbook Outputs

Path	Description	Type
Email	The email object.	string
Email.To	The recipient of the email.	string
Email.From	The sender of the email.	string
Email.CC	The CC address of the email.	string
Email.BCC	The BCC address of the email.	string
Email.HTML	The HTML of the email.	string
Email.Body	The text body of the email.	string
Email.Headers	The headers of the email.	string
Email.Subject	The subject of the email.	string
File	The original attachments.	string

Playbook Image

Get Original Email - Gmail v2

Inputs

MessageID — The original email message ID to retrieve. Holds the value of the "Message-ID" header of the original email and not Gmail's internal ID of the message.
UserID — The email address of the authenticated user to fetch the original email for. For gmail, the authenticated user.

Outputs

Email — The email object
Email.To — The email recipient.
Email.From — The email sender.
Email.CC — The email CC address.
Email.BCC — The email BCC address.
Email.HTML — The HTML of the email.
Email.Body — The email text body.
Email.Headers — The email headers.
Email.Subject — The email subject.
File — The original attachments.

Commands used

gmail-get-attachments gmail-search

Flowchart

Source

playbook-Get_Original_Email_-_Gmail_v2.yml

Download History Raw

id: Get Original Email - Gmail v2
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Get Original Email - Gmail v2
description: |
  This v2 playbook uses the reporter's email headers to retrieve the original email. This decreases the number of tasks to retrieve the original email. 
  Use this playbook to retrieve the original email using the Gmail integration, including headers and attachments.
  Note: You must have the necessary Google Apps Domain-Wide Delegation of Authority permissions in your Gmail service to execute global search.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: d8403573-b211-4d44-885c-a365045c61a2
    type: start
    task:
      id: d8403573-b211-4d44-885c-a365045c61a2
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 280,
          "y": 1540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 77fd3720-3d21-4ffb-8f78-e6b62e5a5eb6
    type: condition
    task:
      id: 77fd3720-3d21-4ffb-8f78-e6b62e5a5eb6
      version: -1
      name: Is Gmail enabled?
      description: Returns 'yes' if an integration brand is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "3"
      "yes":
      - "17"
    scriptarguments:
      brandname:
        simple: Gmail
    results:
    - brandInstances
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 280,
          "y": 1690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 185c00fb-4375-4607-8b99-7538c88315bc
    type: title
    task:
      id: 185c00fb-4375-4607-8b99-7538c88315bc
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 280,
          "y": 2720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 8e8c940f-71fd-456e-8f11-fd6a450616c9
    type: regular
    task:
      id: 8e8c940f-71fd-456e-8f11-fd6a450616c9
      version: -1
      name: Retrieve the Original email from Gmail
      description: Searches for Gmail records of a specified Google user.
      script: Gmail|||gmail-search
      type: regular
      iscommand: true
      brand: Gmail
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      query:
        simple: Rfc822msgid:${inputs.MessageID}
      user-id:
        complex:
          root: inputs.UserID
    reputationcalc: 2
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 280,
          "y": 2100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: ea7b5d02-8ad9-435f-849b-d8aa29f18cdc
    type: condition
    task:
      id: ea7b5d02-8ad9-435f-849b-d8aa29f18cdc
      version: -1
      name: Was the original email retrieved?
      description: Verifies there is a Gmail email object in the context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "15"
      - "13"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: Gmail
                accessor: ID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 510,
          "y": 2280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 9384d956-2f69-4882-852d-6c86a0060ee3
    type: regular
    task:
      id: 9384d956-2f69-4882-852d-6c86a0060ee3
      version: -1
      name: Get attachments of the original email
      description: Retrieves the attachments of the original email from Gmail.
      script: Gmail|||gmail-get-attachments
      type: regular
      iscommand: true
      brand: Gmail
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      message-id:
        complex:
          root: Gmail
          accessor: ID
      user-id:
        complex:
          root: Gmail
          accessor: Mailbox
      user-key:
        complex:
          root: OriginalEmail
          accessor: Mailbox
    reputationcalc: 2
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 280,
          "y": 2450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 7d541973-de31-41bd-89ae-70c3869b01de
    type: regular
    task:
      id: 7d541973-de31-41bd-89ae-70c3869b01de
      version: -1
      name: Set output
      description: Sets the playbook outputs to context.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      key:
        simple: Email
      value:
        simple: '${Gmail={Subject: val[''Subject''], To: val[''To''], From: val[''From''], Text: val[''Body''], HTML: val[''Html''], Headers: val[''Headers''], CC: val[''CC''], BCC: val[''BCC'']}}'
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 737.5,
          "y": 2450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 67c1298f-d944-4a7f-83db-45f260e9977d
    type: condition
    task:
      id: 67c1298f-d944-4a7f-83db-45f260e9977d
      version: -1
      name: Verify Playbook Inputs
      description: Verifies the playbook inputs.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      Inputs-Exist:
      - "4"
    separatecontext: false
    conditions:
    - label: Inputs-Exist
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.MessageID
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.UserID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 280,
          "y": 1890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1245,
        "width": 837.5,
        "x": 280,
        "y": 1540
      }
    }
  }
inputs:
- key: MessageID
  value: {}
  required: false
  description: The original email message ID to retrieve. Holds the value of the "Message-ID" header of the original email and not Gmail's internal ID of the message.
  playbookInputQuery:
- key: UserID
  value: {}
  required: false
  description: The email address of the authenticated user to fetch the original email for. For gmail, the authenticated user.
  playbookInputQuery:
outputs:
- contextPath: Email
  description: The email object
  type: string
- contextPath: Email.To
  description: The email recipient.
  type: string
- contextPath: Email.From
  description: The email sender.
  type: string
- contextPath: Email.CC
  description: The email CC address.
  type: string
- contextPath: Email.BCC
  description: The email BCC address.
  type: string
- contextPath: Email.HTML
  description: The HTML of the email.
  type: string
- contextPath: Email.Body
  description: The email text body.
  type: string
- contextPath: Email.Headers
  description: The email headers.
  type: string
- contextPath: Email.Subject
  description: The email subject.
  type: string
- contextPath: File
  description: The original attachments.
  type: string
tests:
- Get Original Email - Gmail v2 - test
fromversion: 6.0.0
supportedModules:
- agentix
- xsiam