Phishing - Get Original Email Loop

When the "Get Original Email - Generic v2" playbook is looped, there is no actual way to distinguish which retrieved file is related to which Message-ID. In order to solve this issue, this playbook will be looped instead and will output the "FileAssociation" key with the File-MessageID association.

Phishing · 8 tasks · 3 inputs · 4 outputs

Details

ID	`Phishing - Get Original Email Loop`
From Version	6.8.0
Tasks	8

README

When the Get Original Email - Generic v2 playbook is looped, there is no actual way to distinguish which retrieved file is related to which Message-ID. In order to solve this issue, this playbook will be looped instead and will output the “FileAssociation” key with the File-MessageID association.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Get Original Email - Generic v2

Integrations

This playbook does not use any integrations.

Scripts

DeleteContext
SetAndHandleEmpty

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Required
MessageID	The original email message ID to retrieve. This should hold the value of the “Message-ID” header of the original email.	Optional
UserID	The email address of the user to fetch the original email for. For Gmail, the authenticated user.	Optional
EmailBrand	If this value is provided, only the relevant playbook runs. If no value is provided, all sub-playbooks are run. Possible values: - Gmail - EWS v2 - EWSO365 - MicrosoftGraphMail - EmailSecurityGateway Choosing EmailSecurityGateway executes the following if enabled: - FireEye EX (Email Security) - Proofpoint TAP - Mimecast	Optional

Playbook Outputs

Path	Description	Type
FileAssociation	When this playbook is looped, the EntryID of each retrieved eml file would be saved alongside the associated Message-ID inside the “FileAssociation” context key.	string
FileAssociation.EntryID	The retrieved file EntryID. When this playbook is looped, the EntryID of each retrieved eml file would be saved alongside the associated Message-ID inside the “FileAssociation” context key.	string
FileAssociation.MessageID	The retrieved email Message-ID. When this playbook is looped, the EntryID of each retrieved eml file would be saved alongside the associated Message-ID inside the “FileAssociation” context key.	string
File	The original email attachments.	string

Playbook Image

Phishing - Get Original Email Loop

Inputs

MessageID — The original email message ID to retrieve. This should hold the value of the "Message-ID" header of the original email.
UserID — The email address of the user to fetch the original email for. For Gmail, the authenticated user.
EmailBrand — If this value is provided, only the relevant playbook runs. If no value is provided, all sub-playbooks are run. Possible values: - Gmail - EWS v2 - EWSO365 - MicrosoftGraphMail - EmailSecurityGateway Choosing EmailSecurityGateway executes the following if enabled: - FireEye EX (Email Security) - Proofpoint TAP - Mimecast

Outputs

FileAssociation — When this playbook is looped, the EntryID of each retrieved eml file would be saved alongside the associated Message-ID inside the "FileAssociation" context key.
FileAssociation.EntryID — The retrieved file EntryID. When this playbook is looped, the EntryID of each retrieved eml file would be saved alongside the associated Message-ID inside the "FileAssociation" context key.
FileAssociation.MessageID — The retrieved email Message-ID. When this playbook is looped, the EntryID of each retrieved eml file would be saved alongside the associated Message-ID inside the "FileAssociation" context key.
File — The original email attachments.

Flowchart

Source

playbook-Phishing_-_Get_Original_Email_Loop.yml

Download History Raw

id: Phishing - Get Original Email Loop
version: -1
name: Phishing - Get Original Email Loop
description: When the "Get Original Email - Generic v2" playbook is looped, there is no actual way to distinguish which retrieved file is related to which Message-ID. In order to solve this issue, this playbook will be looped instead and will output the "FileAssociation" key with the File-MessageID association.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 98e51582-aa46-476c-89f9-de96c38560c1
    type: start
    task:
      id: 98e51582-aa46-476c-89f9-de96c38560c1
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": -140
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 3f2d324b-e49b-496b-8f70-ab01ec03d818
    type: playbook
    task:
      id: 3f2d324b-e49b-496b-8f70-ab01ec03d818
      version: -1
      name: Get Original Email - Generic v2
      description: |-
        This v2 playbook is used inside the phishing flow. The inputs in this version do not use labels and also allow the user to supply an email brand.
        Note: You must have the necessary permissions in your email service to execute a global search.

        To retrieve the email files directly from the email service providers, use one of the provided inputs (Agari Phishing Defense customers should also use the following):
        - EWS: eDiscovery
        - Gmail: Google Apps Domain-Wide Delegation of Authority
        - MSGraph: As described in the [message-get API](https://docs.microsoft.com/en-us/graph/api/message-get) and the [user-list-messages API](https://docs.microsoft.com/en-us/graph/api/user-list-messages)
        - EmailSecurityGateway retrieves EML files from:
            * FireEye EX
            * FireEye CM
            * Proofpoint Protection Server
            * Mimecast
      playbookName: Get Original Email - Generic v2
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      EmailBrand:
        complex:
          root: inputs.EmailBrand
      MessageID:
        complex:
          root: inputs.MessageID
      UserID:
        complex:
          root: inputs.UserID
    separatecontext: true
    continueonerrortype: ""
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 450,
          "y": 390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 3a8cb56c-0be9-4362-8a9d-ba4301b2ac64
    type: condition
    task:
      id: 3a8cb56c-0be9-4362-8a9d-ba4301b2ac64
      version: -1
      name: Was the email file retrieved?
      type: condition
      iscommand: false
      brand: ""
      description: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "7"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: File.EntryID
                filters:
                - - operator: notIn
                    left:
                      value:
                        simple: File.EntryID
                      iscontext: true
                    right:
                      value:
                        simple: CurrentFilesEntryIDs
                      iscontext: true
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 580
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: d463a69b-a148-4aa3-8344-cdedf786590d
    type: regular
    task:
      id: d463a69b-a148-4aa3-8344-cdedf786590d
      version: -1
      name: Set FileAssociation
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      key:
        simple: FileAssociation
      value:
        simple: '[{"MessageID":"${inputs.MessageID}", "EntryID": "${EntryID}"}]'
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1020
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: f58d0b00-222c-4ab5-8d3e-b537f005a134
    type: title
    task:
      id: f58d0b00-222c-4ab5-8d3e-b537f005a134
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: b96d91a9-5806-4c61-8a20-45f86b12c4f5
    type: regular
    task:
      id: b96d91a9-5806-4c61-8a20-45f86b12c4f5
      version: -1
      name: Save Current Files Entry IDs
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    scriptarguments:
      key:
        simple: CurrentFilesEntryIDs
      value:
        complex:
          root: File
          accessor: EntryID
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 190
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 527f7d73-3c22-47c5-8492-a3c9020e653b
    type: regular
    task:
      id: 527f7d73-3c22-47c5-8492-a3c9020e653b
      version: -1
      name: Save retrieved File's Entry ID
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: SetAndHandleEmpty
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      key:
        simple: EntryID
      value:
        complex:
          root: File.EntryID
          filters:
          - - operator: notIn
              left:
                value:
                  simple: File.EntryID
                iscontext: true
              right:
                value:
                  simple: CurrentFilesEntryIDs
                iscontext: true
          transformers:
          - operator: replace
            args:
              limit: {}
              replaceWith:
                value:
                  simple: '&'
              toReplace:
                value:
                  simple: \u0026
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 820
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 8e930533-4f85-46a6-8fc5-476ce4f0be89
    type: regular
    task:
      id: 8e930533-4f85-46a6-8fc5-476ce4f0be89
      version: -1
      name: Delete context
      description: |-
        Delete a field from context.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      key:
        simple: EntryID
      subplaybook:
        simple: "yes"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 450,
          "y": 10
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1405,
        "width": 380,
        "x": 450,
        "y": -140
      }
    }
  }
inputs:
- key: MessageID
  value: {}
  required: false
  description: The original email message ID to retrieve. This should hold the value of the "Message-ID" header of the original email.
  playbookInputQuery:
- key: UserID
  value: {}
  required: false
  description: The email address of the user to fetch the original email for. For Gmail, the authenticated user.
  playbookInputQuery:
- key: EmailBrand
  value: {}
  required: false
  description: |-
    If this value is provided, only the relevant playbook runs. If no value is provided, all sub-playbooks are run.
    Possible values:
    - Gmail
    - EWS v2
    - EWSO365
    - MicrosoftGraphMail
    - EmailSecurityGateway

    Choosing EmailSecurityGateway executes the following if enabled:
        - FireEye EX (Email Security)
        - Proofpoint TAP
        - Mimecast
  playbookInputQuery:
outputs:
- contextPath: FileAssociation
  description: When this playbook is looped, the EntryID of each retrieved eml file would be saved alongside the associated Message-ID inside the "FileAssociation" context key.
  type: string
- contextPath: FileAssociation.EntryID
  description: The retrieved file EntryID. When this playbook is looped, the EntryID of each retrieved eml file would be saved alongside the associated Message-ID inside the "FileAssociation" context key.
  type: string
- contextPath: FileAssociation.MessageID
  description: The retrieved email Message-ID. When this playbook is looped, the EntryID of each retrieved eml file would be saved alongside the associated Message-ID inside the "FileAssociation" context key.
  type: string
- contextPath: File
  description: The original email attachments.
  type: string
tests:
- No tests (auto formatted)
fromversion: 6.8.0