Search all mailboxes - Gmail with polling

id: Search all mailboxes - Gmail with polling
version: -1
name: Search all mailboxes - Gmail with polling
description: This playbook searches Gmail records for all Google users, designed for large companies with over 2500 Google users.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 543bfdb9-dd11-4956-84d7-613584e8737a
    type: start
    task:
      id: 543bfdb9-dd11-4956-84d7-613584e8737a
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: dd127952-ee61-4659-82b8-345b555d57e9
    type: title
    task:
      id: dd127952-ee61-4659-82b8-345b555d57e9
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 49e6a7e7-5b80-4be3-8a6e-9da4856d252c
    type: regular
    task:
      id: 49e6a7e7-5b80-4be3-8a6e-9da4856d252c
      version: -1
      name: DeleteContext
      description: |-
        Delete field from context.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      all:
        simple: "yes"
      keysToKeep:
        simple: Gmail,SearchingAccounts
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: b377f60a-0aa1-41aa-8692-8a019a6dd430
    type: playbook
    task:
      id: b377f60a-0aa1-41aa-8692-8a019a6dd430
      version: -1
      name: Search in mailboxes Gmail (Loop) with polling
      description: This playbook should only run as a sub-playbook for the Search-all-mailboxes - Gmail playbook, it should not run alone.
      playbookName: Search in mailboxes Gmail (Loop) with polling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      after:
        complex:
          root: inputs.after
      before:
        complex:
          root: inputs.before
      fields:
        complex:
          root: inputs.fields
      filename:
        complex:
          root: inputs.filename
      from:
        complex:
          root: inputs.from
      has-attachments:
        complex:
          root: inputs.has-attachments
      in:
        complex:
          root: inputs.in
      include-spam-trash:
        complex:
          root: inputs.include-spam-trash
      labels-ids:
        complex:
          root: inputs.labels-ids
      page-token:
        complex:
          root: NewPageToken
      query:
        complex:
          root: inputs.query
      search_from:
        complex:
          root: SearchFromAccountIndex
      search_to:
        complex:
          root: SearchToAccountIndex
      subject:
        complex:
          root: inputs.subject
      to:
        complex:
          root: inputs.to
    separatecontext: false
    continueonerrortype: ""
    loop:
      iscommand: false
      builtincondition:
      - - operator: isEqualString
          left:
            value:
              simple: Stop
            iscontext: true
          right:
            value:
              simple: "true"
      exitCondition: ""
      wait: 5
      max: 100
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 560,
        "width": 380,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: after
  value: {}
  required: false
  description: Search for messages sent after a specific date. For example, 2018/05/06
  playbookInputQuery:
- key: before
  value: {}
  required: false
  description: Search for messages sent before a specific date. For example, 2018/05/09
  playbookInputQuery:
- key: fields
  value: {}
  required: false
  description: Enables partial responses to be retrieved in a comma-separated list. For more information, see https://developers.google.com/gdata/docs/2.0/basics#PartialResponse.
  playbookInputQuery:
- key: filename
  value: {}
  required: false
  description: Attachments with a certain name or file type. For example, "pdf" or "report.pdf"
  playbookInputQuery:
- key: from
  value: {}
  required: false
  description: Specifies the sender. For example, "john"
  playbookInputQuery:
- key: to
  value: {}
  required: false
  description: Specifies the receiver. For example, "john"
  playbookInputQuery:
- key: has-attachments
  value: {}
  required: false
  description: Whether to search for messages sent with attachments.
  playbookInputQuery:
- key: in
  value: {}
  required: false
  description: Messages in any folder, including Spam and Trash. For example, shopping
  playbookInputQuery:
- key: include-spam-trash
  value: {}
  required: false
  description: 'Includes messages from SPAM and TRASH in the results. (Default: false)'
  playbookInputQuery:
- key: labels-ids
  value: {}
  required: false
  description: Returns messages with labels that match all of the specified label IDs in a comma-separated list.
  playbookInputQuery:
- key: subject
  value: {}
  required: false
  description: Words in the subject line. For example, "alert"
  playbookInputQuery:
- key: query
  value: {}
  required: false
  description: 'Returns messages matching the specified query. Supports the same query format as the Gmail search box. For example, "from:someuser@example.com rfc822msgid: is:unread". For more syntax information,see "https://support.google.com/mail/answer/7190?hl=en"'
  playbookInputQuery:
outputs:
- contextPath: Gmail.Mailboxes
  description: The Gmail mailbox.
- contextPath: Gmail.ID
  description: The inner ID of the Gmail message.
- contextPath: Gmail.ThreadId
  description: The thread ID.
- contextPath: Gmail.Format
  description: The MIME type of the email.
- contextPath: Gmail.Labels
  description: The labels of a specific email.
- contextPath: Gmail.To
  description: The email address of the receiver.
- contextPath: Gmail.From
  description: The email address of the sender.
- contextPath: Gmail.Cc
  description: The additional recipient email address (CC).
- contextPath: Gmail.Bcc
  description: The additional recipient email address (BCC).
- contextPath: Gmail.Subject
  description: The subject of the specific email.
- contextPath: Gmail.Body
  description: The content of the email.
- contextPath: Gmail.Attachments
  description: The attachments of the email. IDs are separated by commas.
- contextPath: Gmail.Headers
  description: All headers of a specific mail (list).
tests:
- No tests
fromversion: 6.5.0
supportedModules:
- agentix
- xsiam