Search in mailboxes Gmail (Loop) with polling

This playbook should only run as a sub-playbook for the Search-all-mailboxes - Gmail playbook, it should not run alone.

Gmail · 8 tasks · 15 inputs · 18 outputs

Details

ID	`Search in mailboxes Gmail (Loop) with polling`
From Version	6.5.0
Tasks	8

README

This playbook should only run as a sub-playbook for the Search-all-mailboxes - Gmail playbook, it should not run alone.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

Gmail

Scripts

Set
DeleteContext

Commands

gmail-search-all-mailboxes

Playbook Inputs

Name	Description	Required
after	Search for messages sent after a specific date. For example, 2018/05/06	Optional
before	Search for messages sent before a specific date. For example, 2018/05/09	Optional
fields	Enables partial responses to be retrieved in a comma-separated list. For more information, see https://developers.google.com/gdata/docs/2.0/basics#PartialResponse.	Optional
filename	Attachments with a certain name or file type. For example, “pdf” or “report.pdf”	Optional
from	Specifies the sender. For example, “john”	Optional
to	Specifies the receiver. For example, “john”	Optional
has-attachments	Whether to search for messages sent with attachments.	Optional
in	Messages in any folder, including Spam and Trash. For example, shopping	Optional
include-spam-trash	Includes messages from SPAM and TRASH in the results. (Default: false)	Optional
labels-ids	Returns messages with labels that match all of the specified label IDs in a comma-separated list.	Optional
page-token	This argument is not usable	Optional
query	Returns messages matching the specified query. Supports the same query format as the Gmail search box. For example, “from:someuser@example.com rfc822msgid: is:unread”. For more syntax information,see “https://support.google.com/mail/answer/7190?hl=en”	Optional
subject	Words in the subject line. For example, “alert”	Optional
searching_accounts	Used to track a search’s progress	Optional

Playbook Outputs

Path	Description	Type
Gmail.Mailboxes	The Gmail mailbox.	unknown
Gmail.ID	The inner ID of the Gmail message.	unknown
Gmail.ThreadId	The thread ID.	unknown
Gmail.Format	The MIME type of the email.	unknown
Gmail.Labels	The labels of a specific email.	unknown
Gmail.To	The email address of the receiver.	unknown
Gmail.From	The email address of the sender.	unknown
Gmail.Cc	The additional recipient email address (CC).	unknown
Gmail.Bcc	The additional recipient email address (BCC).	unknown
Gmail.Subject	The subject of the specific email.	unknown
Gmail.Body	The content of the email.	unknown
Gmail.Attachments	The attachments of the email. IDs are separated by commas.	unknown
Gmail.Headers	All headers of specific mail (list).	unknown
Email.Attachments.entryID	Email Attachments. IDs are separated by commas.	unknown
NewPageToken	In the next iteration, additional accounts will be imported using this output.	unknown
Stop	The result of this output causes the loop to end.	unknown
SearchFromAccountIndex	A search is performed from an account index (Enables the search process to be followed).	unknown
SearchToAccountIndex	A search is performed to an account index (Enables the search process to be followed).	unknown

Playbook Image

Search in mailboxes Gmail (Loop) with polling

Inputs

after — Search for messages sent after a specific date. For example, 2018/05/06
before — Search for messages sent before a specific date. For example, 2018/05/09
fields — Enables partial responses to be retrieved in a comma-separated list. For more information, see https://developers.google.com/gdata/docs/2.0/basics#PartialResponse.
filename — Attachments with a certain name or file type. For example, "pdf" or "report.pdf"
from — Specifies the sender. For example, "john"
to — Specifies the receiver. For example, "john"
has-attachments — Whether to search for messages sent with attachments.
in — Messages in any folder, including Spam and Trash. For example, shopping
include-spam-trash — Includes messages from SPAM and TRASH in the results. (Default: false)
labels-ids — Returns messages with labels that match all of the specified label IDs in a comma-separated list.
page-token — This argument is not usable
query — Returns messages matching the specified query. Supports the same query format as the Gmail search box. For example, "from:someuser@example.com rfc822msgid: is:unread". For more syntax information,see "https://support.google.com/mail/answer/7190?hl=en"
subject — Words in the subject line. For example, "alert"
search_to — Used to track a search's progress
search_from — Used to track a search's progress

Outputs

Gmail.Mailboxes — The Gmail mailbox.
Gmail.ID — The inner ID of the Gmail message.
Gmail.ThreadId — The thread ID.
Gmail.Format — The MIME type of the email.
Gmail.Labels — The labels of a specific email.
Gmail.To — The email address of the receiver.
Gmail.From — The email address of the sender.
Gmail.Cc — The additional recipient email address (CC).
Gmail.Bcc — The additional recipient email address (BCC).
Gmail.Subject — The subject of the specific email.
Gmail.Body — The content of the email.
Gmail.Attachments — The attachments of the email. IDs are separated by commas.
Gmail.Headers — All headers of specific mail (list).
Email.Attachments.entryID — Email Attachments. IDs are separated by commas.
NewPageToken — In the next iteration, additional accounts will be imported using this output.
Stop — The result of this output causes the loop to end.
SearchFromAccountIndex — A search is performed from an account index (Enables the search process to be followed).
SearchToAccountIndex — A search is performed to an account index (Enables the search process to be followed).

Commands used

gmail-search-all-mailboxes

Flowchart

Source

playbook-Search-in-mailboxes_Loop_with_polling.yml

Download History Raw

id: Search in mailboxes Gmail (Loop) with polling
version: -1
name: Search in mailboxes Gmail (Loop) with polling
description: This playbook should only run as a sub-playbook for the Search-all-mailboxes - Gmail playbook, it should not run alone.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: ffd081fd-2d32-4c72-887f-849c7bb34923
    type: start
    task:
      id: ffd081fd-2d32-4c72-887f-849c7bb34923
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "33"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "8":
    id: "8"
    taskid: 0b7fe62d-601c-4968-8049-f46b1ba4ccb4
    type: title
    task:
      id: 0b7fe62d-601c-4968-8049-f46b1ba4ccb4
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 4d42bafa-1d6d-4991-8547-c948982ad34d
    type: regular
    task:
      id: 4d42bafa-1d6d-4991-8547-c948982ad34d
      version: -1
      name: DeleteContext
      description: |-
        Delete field from context.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      all:
        simple: "yes"
      keysToKeep:
        simple: Gmail,NewPageToken,Stop,SearchFromAccountIndex,SearchToAccountIndex
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: b6a073df-cacd-4878-85ea-6c191ef3ef8c
    type: regular
    task:
      id: b6a073df-cacd-4878-85ea-6c191ef3ef8c
      version: -1
      name: Set Stop
      description: |-
        Set a value in context under the key you entered.

        When the nextPageToken value is not received, this task determines that the loop is ending.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: Stop
      value:
        simple: "true"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 50,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "18":
    id: "18"
    taskid: ae04c6e3-b927-4648-8008-28fdd16a8371
    type: regular
    task:
      id: ae04c6e3-b927-4648-8008-28fdd16a8371
      version: -1
      name: Set NewPageToken
      description: Set a value in context under the key you entered.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      append:
        simple: "false"
      key:
        simple: NewPageToken
      value:
        complex:
          root: PageToken
          accessor: NextPageToken
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 480,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "19":
    id: "19"
    taskid: 88d4d553-cf57-460d-8c91-272f69370990
    type: condition
    task:
      id: 88d4d553-cf57-460d-8c91-272f69370990
      version: -1
      name: Is there NextPageToken
      description: Checks if there is a new NextPageToken for next iteration.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "17"
      "yes":
      - "18"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: PageToken
                accessor: NextPageToken
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "32":
    id: "32"
    taskid: 856ec299-25b1-417d-84c5-f75660e999c4
    type: regular
    task:
      id: 856ec299-25b1-417d-84c5-f75660e999c4
      version: -1
      name: Search in mailboxes
      description: Searches the Gmail records for all Google users.
      script: '|||gmail-search-all-mailboxes'
      type: regular
      iscommand: true
      brand: Gmail
    nexttasks:
      '#none#':
      - "19"
    scriptarguments:
      after:
        complex:
          root: inputs.after
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.after
                iscontext: true
      before:
        complex:
          root: inputs.before
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.before
                iscontext: true
      fields:
        complex:
          root: inputs.fields
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.fields
                iscontext: true
      filename:
        complex:
          root: inputs.filename
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.filename
                iscontext: true
      from:
        complex:
          root: inputs.from
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.from
                iscontext: true
      has-attachments:
        complex:
          root: inputs.has-attachments
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.has-attachments
                iscontext: true
      in:
        complex:
          root: inputs.in
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.in
                iscontext: true
      include-spam-trash:
        complex:
          root: inputs.include-spam-trash
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.include-spam-trash
                iscontext: true
      labels-ids:
        complex:
          root: inputs.labels-ids
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.labels-ids
                iscontext: true
      page-token:
        complex:
          root: inputs.page-token
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.page-token
                iscontext: true
      query:
        complex:
          root: inputs.query
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.query
                iscontext: true
      search_to:
        complex:
          root: inputs.search_to
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.search_to
                iscontext: true
      search_from:
        complex:
          root: inputs.search_from
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.search_from
                iscontext: true
      show-only-mailboxes:
        simple: "true"
      subject:
        complex:
          root: inputs.subject
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.subject
                iscontext: true
      to:
        complex:
          root: inputs.to
          filters:
          - - operator: isNotEmpty
              left:
                value:
                  simple: inputs.to
                iscontext: true
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 2
    isoversize: false
    isautoswitchedtoquietmode: false
  "33":
    id: "33"
    taskid: 3c4418eb-a8d8-446a-874a-1f9ec2c6607c
    type: regular
    task:
      id: 3c4418eb-a8d8-446a-874a-1f9ec2c6607c
      version: -1
      name: Delete SearchFromAccountIndex and SearchToAccountIndex keys previous
      description: |-
        Delete field from context.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations 
        - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script
        - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "32"
    scriptarguments:
      key:
        simple: SearchFromAccountIndex,SearchToAccountIndex
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": 265,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {
      "19_17_#default#": 0.9
    },
    "paper": {
      "dimensions": {
        "height": 1085,
        "width": 810,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: after
  value: {}
  required: false
  description: Search for messages sent after a specific date. For example, 2018/05/06
  playbookInputQuery:
- key: before
  value: {}
  required: false
  description: Search for messages sent before a specific date. For example, 2018/05/09
  playbookInputQuery:
- key: fields
  value: {}
  required: false
  description: Enables partial responses to be retrieved in a comma-separated list. For more information, see https://developers.google.com/gdata/docs/2.0/basics#PartialResponse.
  playbookInputQuery:
- key: filename
  value: {}
  required: false
  description: Attachments with a certain name or file type. For example, "pdf" or "report.pdf"
  playbookInputQuery:
- key: from
  value: {}
  required: false
  description: Specifies the sender. For example, "john"
  playbookInputQuery:
- key: to
  value: {}
  required: false
  description: Specifies the receiver. For example, "john"
  playbookInputQuery:
- key: has-attachments
  value: {}
  required: false
  description: Whether to search for messages sent with attachments.
  playbookInputQuery:
- key: in
  value: {}
  required: false
  description: Messages in any folder, including Spam and Trash. For example, shopping
  playbookInputQuery:
- key: include-spam-trash
  value: {}
  required: false
  description: 'Includes messages from SPAM and TRASH in the results. (Default: false)'
  playbookInputQuery:
- key: labels-ids
  value: {}
  required: false
  description: Returns messages with labels that match all of the specified label IDs in a comma-separated list.
  playbookInputQuery:
- key: page-token
  value: {}
  required: false
  description: This argument is not usable
  playbookInputQuery:
- key: query
  value: {}
  required: false
  description: 'Returns messages matching the specified query. Supports the same query format as the Gmail search box. For example, "from:someuser@example.com rfc822msgid: is:unread". For more syntax information,see "https://support.google.com/mail/answer/7190?hl=en"'
  playbookInputQuery:
- key: subject
  value: {}
  required: false
  description: Words in the subject line. For example, "alert"
  playbookInputQuery:
- key: search_to
  value: {}
  required: false
  description: Used to track a search's progress
  playbookInputQuery:
- key: search_from
  value: {}
  required: false
  description: Used to track a search's progress
  playbookInputQuery:
outputs:
- contextPath: Gmail.Mailboxes
  description: The Gmail mailbox.
- contextPath: Gmail.ID
  description: The inner ID of the Gmail message.
- contextPath: Gmail.ThreadId
  description: The thread ID.
- contextPath: Gmail.Format
  description: The MIME type of the email.
- contextPath: Gmail.Labels
  description: The labels of a specific email.
- contextPath: Gmail.To
  description: The email address of the receiver.
- contextPath: Gmail.From
  description: The email address of the sender.
- contextPath: Gmail.Cc
  description: The additional recipient email address (CC).
- contextPath: Gmail.Bcc
  description: The additional recipient email address (BCC).
- contextPath: Gmail.Subject
  description: The subject of the specific email.
- contextPath: Gmail.Body
  description: The content of the email.
- contextPath: Gmail.Attachments
  description: The attachments of the email. IDs are separated by commas.
- contextPath: Gmail.Headers
  description: All headers of specific mail (list).
- contextPath: Email.Attachments.entryID
  description: Email Attachments. IDs are separated by commas.
- contextPath: NewPageToken
  description: In the next iteration, additional accounts will be imported using this output.
- contextPath: Stop
  description: The result of this output causes the loop to end.
  type: unknown
- contextPath: SearchFromAccountIndex
  description: A search is performed from an account index (Enables the search process to be followed).
  type: String
- contextPath: SearchToAccountIndex
  description: A search is performed to an account index (Enables the search process to be followed).
  type: String
tests:
- No tests
fromversion: 6.5.0
supportedModules:
- agentix
- xsiam