Get Original Email - Microsoft Graph Mail

This playbook retrieves the original email using the Microsoft Graph Mail integration. Note: You must have the necessary permissions in the Microsoft Graph Mail integration as described in the [message-get API](https://docs.microsoft.com/en-us/graph/api/message-get) and the [user-list-messages API](https://docs.microsoft.com/en-us/graph/api/user-list-messages)

Microsoft Graph Mail · 8 tasks · 3 inputs · 1 output

Details

ID	`Get Original Email - Microsoft Graph Mail`
From Version	6.0.0
Tasks	8

README

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

MicrosoftGraphMail

Scripts

Set
IsIntegrationAvailable

Commands

msgraph-mail-list-emails
msgraph-mail-get-email-as-eml

Playbook Inputs

Name	Description	Default Value	Required
UserID	The email address of the reporting user.		Optional
MessageID	The InReplyTo header in the forwarded email.		Optional
ThreadTopic	The ThreadTopic header in the forwarded email.		Optional
PagesToPull	The number of pages of emails to return (maximum is 10 emails per page).	10	Optional

Playbook Outputs

Path	Description	Type
File	The original email as an EML file.	string

Playbook Image

Get Original Email - Microsoft Graph Mail

Inputs

UserID — The email address of the reporting user.
MessageID — The InReplyTo header in the forwarded email.
PagesToPull — The number of pages of emails to return (maximum is 10 emails per page).

Outputs

File — The original email as an EML file.

Commands used

msgraph-mail-get-email-as-eml msgraph-mail-list-emails

Flowchart

Source

playbook-Get_Original_Email_-_Microsoft_Graph_Mail.yml

Download History Raw

id: Get Original Email - Microsoft Graph Mail
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Get Original Email - Microsoft Graph Mail
description: |-
  This playbook retrieves the original email using the Microsoft Graph Mail integration.
  Note: You must have the necessary permissions in the Microsoft Graph Mail integration as described in the [message-get API](https://docs.microsoft.com/en-us/graph/api/message-get) and the [user-list-messages API](https://docs.microsoft.com/en-us/graph/api/user-list-messages)
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 5607d1c6-85b0-4181-8b10-bb3a5b113c6f
    type: start
    task:
      id: 5607d1c6-85b0-4181-8b10-bb3a5b113c6f
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -20,
          "y": 160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: d2eca123-db35-4b27-88d8-a8b77ffd6784
    type: title
    task:
      id: d2eca123-db35-4b27-88d8-a8b77ffd6784
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -20,
          "y": 1590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 0db04b60-0358-4214-851a-42598fa48cd3
    type: condition
    task:
      id: 0db04b60-0358-4214-851a-42598fa48cd3
      version: -1
      name: Is Microsoft Graph Mail enabled?
      description: Returns 'yes' if an integration brand is available.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "14"
    scriptarguments:
      brandname:
        simple: MicrosoftGraphMail
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -20,
          "y": 310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 8e468b02-e02c-4aeb-804c-0b73dfa0b1c8
    type: regular
    task:
      id: 8e468b02-e02c-4aeb-804c-0b73dfa0b1c8
      version: -1
      name: Search for messages by encoded MessageID
      description: Gets the properties of returned emails. Typically shows partial results. Use the "page_size" and "pages_to_pull" arguments to get all results.
      script: MicrosoftGraphMail|||msgraph-mail-list-emails
      type: regular
      iscommand: true
      brand: MicrosoftGraphMail
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      odata:
        simple: $filter=internetMessageId eq '${EncodedMessageID}'
      pages_to_pull:
        complex:
          root: inputs.PagesToPull
      user_id:
        complex:
          root: inputs.UserID
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -20,
          "y": 905
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 2775b599-4846-4049-8c4e-1e2e660f27c5
    type: condition
    task:
      id: 2775b599-4846-4049-8c4e-1e2e660f27c5
      version: -1
      name: Was a matching email found?
      description: Verifies that an email object with a message ID that matches the InReplyTo ID of the forwarded email was found.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "Yes":
      - "13"
    separatecontext: false
    conditions:
    - label: "Yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: MSGraphMail
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: MSGraphMail.InternetMessageID
                      iscontext: true
                    right:
                      value:
                        simple: inputs.MessageID
                      iscontext: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: MSGraphMail.UserID
                      iscontext: true
                    right:
                      value:
                        simple: inputs.UserID
                      iscontext: true
                accessor: InternetMessageID
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -20,
          "y": 1090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: e2653b70-6db7-4385-8281-0c31a7b5c91c
    type: regular
    task:
      id: e2653b70-6db7-4385-8281-0c31a7b5c91c
      version: -1
      name: Get original email
      description: Retrieves an email message by message ID and uploads the content as an EML file.
      script: MicrosoftGraphMail|||msgraph-mail-get-email-as-eml
      type: regular
      iscommand: true
      brand: MicrosoftGraphMail
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      message_id:
        complex:
          root: MSGraphMail
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: MSGraphMail.InternetMessageID
                iscontext: true
              right:
                value:
                  simple: inputs.MessageID
                iscontext: true
          - - operator: isEqualString
              left:
                value:
                  simple: MSGraphMail.UserID
                iscontext: true
              right:
                value:
                  simple: inputs.UserID
                iscontext: true
          accessor: ID
          transformers:
          - operator: StripChars
            args:
              chars:
                value:
                  simple: <>
          - operator: uniq
      user_id:
        complex:
          root: inputs.UserID
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -20,
          "y": 1310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 43134294-3804-4b55-8591-9845b146370f
    type: condition
    task:
      id: 43134294-3804-4b55-8591-9845b146370f
      version: -1
      name: Verify required inputs
      description: Verifies that the required input values exist for retrieving the original email.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.UserID
            iscontext: true
          right:
            value: {}
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.MessageID
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -20,
          "y": 510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 062e413e-5f77-48bf-8f26-fffdaf91b333
    type: regular
    task:
      id: 062e413e-5f77-48bf-8f26-fffdaf91b333
      version: -1
      name: Set EncodedMessageID
      description: Since the MessageID may contain special characters, it should be URL encoded in order to use it in the next task.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      key:
        simple: EncodedMessageID
      value:
        complex:
          root: inputs.MessageID
          transformers:
          - operator: URLEncode
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -20,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "10_14_yes": 0.57,
      "10_2_#default#": 0.31,
      "12_13_Yes": 0.58,
      "12_2_#default#": 0.78,
      "14_2_#default#": 0.37
    },
    "paper": {
      "dimensions": {
        "height": 1495,
        "width": 380,
        "x": -20,
        "y": 160
      }
    }
  }
inputs:
- key: UserID
  value: {}
  required: false
  description: The email address of the reporting user.
  playbookInputQuery:
- key: MessageID
  value: {}
  required: false
  description: The InReplyTo header in the forwarded email.
  playbookInputQuery:
- key: PagesToPull
  value:
    simple: "10"
  required: false
  description: The number of pages of emails to return (maximum is 10 emails per page).
  playbookInputQuery:
outputs:
- contextPath: File
  description: The original email as an EML file.
  type: string
tests:
- Get Original Email - Microsoft Graph Mail - test
fromversion: 6.0.0
supportedModules:
- agentix
- xsiam