Search And Delete Emails - Gmail

This playbook searches Gmail to identify and delete emails with similar attributes to the malicious email.

Gmail · 15 tasks · 6 inputs · 0 outputs

Details

ID	`Search And Delete Emails - Gmail`
From Version	6.0.0
Tasks	15

README

This playbook searches Gmail to identify and delete emails with similar attributes to the malicious email.\
Note: Searching through large amount of mailboxes might trigger a 429 error code. You can find more details here: https://developers.google.com/gmail/api/guides/handle-errors#:~:text=A%20429%20%22Too%20many%20requests,per%2Duser%20concurrent%20request%20limit.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

Gmail

Scripts

GetTime
Set

Commands

extractIndicators
gmail-delete-mail
gmail-search-all-mailboxes

Playbook Inputs

Name	Description	Default Value	Required
From	The value of the malicious email’s “From” attribute.		Optional
Subject	The value of the malicious email’s “Subject” attribute.		Optional
AttachmentName	The value of the malicious email’s “AttachmentName” attribute.		Optional
Limit	The maximum number of search results.	50	Optional
DeleteType	The deletion type (trash or permanent). For permanent choose ‘True’.	False	Optional
SearchThisWeek	Limit the search to the current week (true/false).	true	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Search And Delete Emails - Gmail

Inputs

From — The value of the malicious email's "From" attribute.
Subject — The value of the malicious email's "Subject" attribute.
AttachmentName — The value of the malicious email's "AttachmentName" attribute.
Limit — The maximum number of search results.
DeleteType — The deletion type (trash or permanent). For permanent choose 'True'.
SearchThisWeek — Limit the search to the current week (true/false).

Commands used

extractIndicators gmail-delete-mail gmail-search-all-mailboxes

Flowchart

Source

playbook-Search_And_Delete_Emails_-_Gmail.yml

Download History Raw

id: Search And Delete Emails - Gmail
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Search And Delete Emails - Gmail
description: This playbook searches Gmail to identify and delete emails with similar attributes to the malicious email.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 5a9d84d3-4a84-49e7-8972-8fbdb62dd634
    type: start
    task:
      id: 5a9d84d3-4a84-49e7-8972-8fbdb62dd634
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 100,
          "y": 60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "1":
    id: "1"
    taskid: 151131f2-0195-46a9-81cd-17c5a6edf387
    type: condition
    task:
      id: 151131f2-0195-46a9-81cd-17c5a6edf387
      version: -1
      name: Is Gmail enabled?
      description: Checks if the Gmail integration is enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "8"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Gmail
                    ignorecase: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                    ignorecase: true
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 100,
          "y": 200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 3599887c-fcc3-4676-8b31-2759f6dae2f0
    type: title
    task:
      id: 3599887c-fcc3-4676-8b31-2759f6dae2f0
      version: -1
      name: Search all mailboxes in Gmail
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "9"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 100,
          "y": 400
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 6f955c81-9371-410c-8bcc-a721f65608e1
    type: regular
    task:
      id: 6f955c81-9371-410c-8bcc-a721f65608e1
      version: -1
      name: Search Gmail for similar emails last 7 days
      description: Searches the Gmail records for all Google users from the last 7 days.
      script: '|||gmail-search-all-mailboxes'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      after:
        complex:
          root: TimeNowUnix
          transformers:
          - operator: TimeStampToDate
          - operator: RegexExtractAll
            args:
              error_if_no_match: {}
              ignore_case: {}
              multi_line: {}
              period_matches_newline: {}
              regex:
                value:
                  simple: ^[^T]+
      filename:
        complex:
          root: inputs.AttachmentName
      from:
        complex:
          root: inputs.From
      include-spam-trash:
        simple: "True"
      max-results:
        complex:
          root: inputs.Limit
      subject:
        complex:
          root: inputs.Subject
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: '"'
              suffix:
                value:
                  simple: '"'
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 100,
          "y": 930
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: a9931d1e-df8a-45da-879b-d09f66d477c7
    type: regular
    task:
      id: a9931d1e-df8a-45da-879b-d09f66d477c7
      version: -1
      name: Delete emails from Gmail
      description: Deletes an email from the user's mailbox.
      script: '|||gmail-delete-mail'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      message-id:
        complex:
          root: GmailSearchResults
          accessor: ID
      permanent:
        complex:
          root: inputs.DeleteType
      user-id:
        complex:
          root: GmailSearchResults
          accessor: Mailbox
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 460,
          "y": 2170
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "6":
    id: "6"
    taskid: 07d73995-ee71-492e-807e-9384c484724c
    type: condition
    task:
      id: 07d73995-ee71-492e-807e-9384c484724c
      version: -1
      name: Were similar emails found?
      description: Checks if similar emails were found.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "8"
      "yes":
      - "13"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: Gmail.Subject
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: Gmail.Subject
                      iscontext: true
                    right:
                      value:
                        simple: inputs.Subject
                      iscontext: true
            iscontext: true
    view: |-
      {
        "position": {
          "x": 100,
          "y": 1120
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "7":
    id: "7"
    taskid: 061e87a9-eb34-4a37-8611-7ff36f771121
    type: title
    task:
      id: 061e87a9-eb34-4a37-8611-7ff36f771121
      version: -1
      name: Delete similar emails
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "12"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 460,
          "y": 1830
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: f91ff578-311c-4f1b-8338-39c6337656aa
    type: title
    task:
      id: f91ff578-311c-4f1b-8338-39c6337656aa
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 100,
          "y": 2350
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "9":
    id: "9"
    taskid: e4fcf874-1d62-40e8-8b0b-54110b5408b6
    type: condition
    task:
      id: e4fcf874-1d62-40e8-8b0b-54110b5408b6
      version: -1
      name: 'Search only a week time range? '
      description: Whether to limit the search time range to a week.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "11"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.SearchThisWeek
            iscontext: true
          right:
            value:
              simple: "true"
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 100,
          "y": 540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: c62f6396-a63c-484d-840b-a4ae58a7ec3c
    type: regular
    task:
      id: c62f6396-a63c-484d-840b-a4ae58a7ec3c
      version: -1
      name: Set time range
      description: |
        Retrieves the current date and time.
      scriptName: GetTime
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      daysAgo:
        simple: "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 100,
          "y": 750
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 5a461fd8-77a4-486b-834c-10c4a9a81571
    type: regular
    task:
      id: 5a461fd8-77a4-486b-834c-10c4a9a81571
      version: -1
      name: Search Gmail for similar emails
      description: Searches the Gmail records for all Google users to find similar emails.
      script: '|||gmail-search-all-mailboxes'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      after:
        complex:
          root: TimeNowUnix
          transformers:
          - operator: TimeStampToDate
          - operator: RegexExtractAll
            args:
              error_if_no_match: {}
              ignore_case: {}
              multi_line: {}
              period_matches_newline: {}
              regex:
                value:
                  simple: ^[^T]+
      filename:
        complex:
          root: inputs.AttachmentName
      from:
        complex:
          root: inputs.From
      include-spam-trash:
        simple: "True"
      max-results:
        complex:
          root: inputs.Limit
      subject:
        complex:
          root: inputs.Subject
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 510,
          "y": 930
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 334b71e3-238f-4f87-8f8d-70da906f712d
    type: condition
    task:
      id: 334b71e3-238f-4f87-8f8d-70da906f712d
      version: -1
      name: Should the found emails be deleted from Gmail?
      description: |-
        Reviews the Gmail search results and decides whether to delete all of the emails.
        Note: You cannot delete a subset of the emails.

        **Found emails details:**

        Users:
        *${GmailTo}*

        Email IDs:
        *${GmailSearchResults.ID}*
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "8"
      "Yes":
      - "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 460,
          "y": 1980
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: cc9c4b4c-dbf5-4696-82f5-f19c331f90da
    type: regular
    task:
      id: cc9c4b4c-dbf5-4696-82f5-f19c331f90da
      version: -1
      name: Extract similar emails
      description: From the retrieved emails, extracts only emails with a subject identical to the searched email's subject.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    scriptarguments:
      key:
        simple: GmailSearchResults
      value:
        complex:
          root: Gmail
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: Gmail.Subject
                iscontext: true
              right:
                value:
                  simple: inputs.Subject
                iscontext: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 460,
          "y": 1320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: e761048e-6e11-42ee-8591-dd470c72cd2b
    type: regular
    task:
      id: e761048e-6e11-42ee-8591-dd470c72cd2b
      version: -1
      name: Extract "To" emails
      description: Extracts email addresses from the "To" fields.
      script: Builtin|||extractIndicators
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      text:
        complex:
          root: GmailSearchResults
          accessor: To
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 460,
          "y": 1480
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 3cba94cc-9e68-4dd2-8d94-dfa56b808f0c
    type: regular
    task:
      id: 3cba94cc-9e68-4dd2-8d94-dfa56b808f0c
      version: -1
      name: Remove duplicates
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      key:
        simple: GmailTo
      value:
        complex:
          root: ExtractedIndicators
          accessor: Email
          transformers:
          - operator: uniq
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 460,
          "y": 1650
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "12_5_Yes": 0.44,
      "12_8_#default#": 0.46,
      "1_2_yes": 0.39,
      "1_8_#default#": 0.22,
      "6_8_#default#": 0.19,
      "9_10_yes": 0.61
    },
    "paper": {
      "dimensions": {
        "height": 2355,
        "width": 790,
        "x": 100,
        "y": 60
      }
    }
  }
inputs:
- key: From
  value: {}
  required: false
  description: The value of the malicious email's "From" attribute.
  playbookInputQuery:
- key: Subject
  value: {}
  required: false
  description: The value of the malicious email's "Subject" attribute.
  playbookInputQuery:
- key: AttachmentName
  value: {}
  required: false
  description: The value of the malicious email's "AttachmentName" attribute.
  playbookInputQuery:
- key: Limit
  value:
    simple: "50"
  required: false
  description: The maximum number of search results.
  playbookInputQuery:
- key: DeleteType
  value:
    simple: "False"
  required: false
  description: |-
    The deletion type (trash or permanent).
    For permanent choose 'True'.
  playbookInputQuery:
- key: SearchThisWeek
  value:
    simple: "true"
  required: false
  description: Limit the search to the current week (true/false).
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 6.0.0
supportedModules:
- agentix
- xsiam
- edr
- cloud
- cloud_runtime_security