Search And Delete Emails - EWS

This playbook searches EWS to identify and delete emails with similar attributes of a malicious email.

Microsoft Exchange On-Premise · 11 tasks · 6 inputs · 0 outputs

Details

IDsearch_and_delete_emails_-_ews
From Version5.0.0
Tasks11

README

Searches EWS to identify and delete emails with similar attributes of a malicious email.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • EWS v2

Scripts

  • BuildEWSQuery

Commands

  • ews-delete-items
  • ews-search-mailboxes

Playbook Inputs

Name Description Default Value Source Required
From The value of the malicious email’s “From” attribute. emailfrom incident Required
Subject The value of the malicious email’s “Subject” attribute. emailsubject incident Optional
AttachmentName The value of the malicious email’s AttachmentName attribute. attachmentname incident Optional
SearchThisWeek Limit the search to the current week. Can be “true” or “false”. true - Required
Limit The maximum number of search results. 20 - Required
DeleteType The deletion type. Can be, “trash”, “soft”, or “hard”. trash - Required

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Search_And_Delete_Emails_EWS

Inputs

  • From — The value of the malicious email's "From" attribute.
  • Subject — The value of the malicious email's "Subject" attribute.
  • AttachmentName — The value of the malicious email's "AttachmentName" attribute.
  • SearchThisWeek — Limit the search to the current week (true/false).
  • Limit — The maximum number of search results.
  • DeleteType — The deletion type (trash, soft, or hard).

Commands used

ews-delete-items ews-search-mailboxes

Flowchart

No yes yes yes Start Start Search EWS for similar emails - ews-search-mailboxes Search EWS for similar em... ews-search-mailboxes Build EWS query Build EWS query Search all mailboxes in EWS Search all mailboxes in EWS Build EWS query - BuildEWSQuery Build EWS query BuildEWSQuery Delete similar emails Delete similar emails Should the found emails be deleted from EWS? Should the found emails b... Done Done Delete emails from EWS - ews-delete-items Delete emails from EWS ews-delete-items Were similar emails found? Were similar emails found? Is EWS v2 enabled? Is EWS v2 enabled?

Source

playbook-Search_And_Delete_Emails_-_EWS.yml
Download History Raw 
id: search_and_delete_emails_-_ews
version: -1
name: Search And Delete Emails - EWS
fromversion: 5.0.0
description: This playbook searches EWS to identify and delete emails with similar attributes of a malicious email.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 4c53eeae-7958-4117-8776-d84f5e018bda
    type: start
    task:
      id: 4c53eeae-7958-4117-8776-d84f5e018bda
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 50
        }
      }
  "1":
    id: "1"
    taskid: e0bc8761-e7dd-41fa-80a6-516440e7218e
    type: regular
    task:
      id: e0bc8761-e7dd-41fa-80a6-516440e7218e
      version: -1
      name: Search EWS for similar emails
      description: Search all mailboxes in EWS to identify emails with similar attributes of a malicious email.
      script: EWS v2|||ews-search-mailboxes
      type: regular
      iscommand: true
      brand: EWS v2
    nexttasks:
      '#none#':
      - "17"
    scriptarguments:
      email_addresses: {}
      filter:
        complex:
          root: EWS
          accessor: Query
      limit:
        complex:
          root: inputs.Limit
      mailbox-search-scope: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 835
        }
      }
  "2":
    id: "2"
    taskid: 655f4055-484e-4068-8af2-0e4ec6f8de30
    type: title
    task:
      id: 655f4055-484e-4068-8af2-0e4ec6f8de30
      version: -1
      name: Build EWS query
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
  "9":
    id: "9"
    taskid: a11f4022-156a-4441-86f3-70039fac11c5
    type: title
    task:
      id: a11f4022-156a-4441-86f3-70039fac11c5
      version: -1
      name: Search all mailboxes in EWS
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 690
        }
      }
  "10":
    id: "10"
    taskid: 58c8b53f-8817-4aaa-8231-823b45d96671
    type: regular
    task:
      id: 58c8b53f-8817-4aaa-8231-823b45d96671
      version: -1
      name: Build EWS query
      description: Returns an EWS query according to the malicious email's attributes.
      scriptName: BuildEWSQuery
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      SearchThisWeek:
        simple: ${inputs.SearchThisWeek}
      attachmentName:
        complex:
          root: inputs.AttachmentName
          filters:
          - - operator: general.isExists
              left:
                value:
                  simple: inputs.AttachmentName
                iscontext: true
      body: {}
      from:
        complex:
          root: inputs.From
          filters:
          - - operator: general.isExists
              left:
                value:
                  simple: inputs.From
                iscontext: true
      searchThisWeek:
        simple: ${inputs.SearchThisWeek}
      subject:
        complex:
          root: inputs.Subject
          filters:
          - - operator: general.isExists
              left:
                value:
                  simple: inputs.Subject
                iscontext: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 515
        }
      }
  "13":
    id: "13"
    taskid: 8bdae91c-64f9-4c0d-86f8-7aaf06a4a9d0
    type: title
    task:
      id: 8bdae91c-64f9-4c0d-86f8-7aaf06a4a9d0
      version: -1
      name: Delete similar emails
      description: ""
      type: title
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "14"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1185
        }
      }
  "14":
    id: "14"
    taskid: c9048666-c30d-4305-8d49-438d141cd770
    type: condition
    task:
      id: c9048666-c30d-4305-8d49-438d141cd770
      version: -1
      name: Should the found emails be deleted from EWS?
      description: |-
        Review the EWS search results and decide whether to delete all of the emails.

        Note: You cannot delete a subset of the emails.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "No":
      - "15"
      "yes":
      - "16"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1330
        }
      }
  "15":
    id: "15"
    taskid: 24c2be15-9c43-417e-8623-ff007f5e2c64
    type: title
    task:
      id: 24c2be15-9c43-417e-8623-ff007f5e2c64
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1680
        }
      }
  "16":
    id: "16"
    taskid: 732d5134-ac55-4a8f-8ffb-1a7c618d82d5
    type: regular
    task:
      id: 732d5134-ac55-4a8f-8ffb-1a7c618d82d5
      version: -1
      name: Delete emails from EWS
      description: Delete all similar emails from all mailboxes in EWS.
      script: EWS v2|||ews-delete-items
      type: regular
      iscommand: true
      brand: EWS v2
    nexttasks:
      '#none#':
      - "15"
    scriptarguments:
      delete-type:
        complex:
          root: inputs.DeleteType
      item-ids:
        complex:
          root: EWS
          accessor: Items.itemId
      target-mailbox:
        complex:
          root: EWS
          accessor: Items.mailbox
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1505
        }
      }
  "17":
    id: "17"
    taskid: a34b7b16-4ed8-4c74-8fd9-62ca07a6f6bb
    type: condition
    task:
      id: a34b7b16-4ed8-4c74-8fd9-62ca07a6f6bb
      version: -1
      name: Were similar emails found?
      description: 'Did the EWS search identify emails similar to the malicious email? '
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "15"
      "yes":
      - "13"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: EWS
                accessor: Items.itemId
            iscontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1010
        }
      }
  "18":
    id: "18"
    taskid: a0a62307-da9a-447a-8d5f-8c63ee4b156a
    type: condition
    task:
      id: a0a62307-da9a-447a-8d5f-8c63ee4b156a
      version: -1
      name: Is EWS v2 enabled?
      description: |
        Verify that there’s a valid instance of EWS v2 enabled.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "15"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: general.isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: string.isEqual
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: EWS v2
                    ignorecase: true
                - - operator: string.isEqual
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 275,
          "y": 195
        }
      }
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1695,
        "width": 605,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: From
  value:
    complex:
      root: incident
      accessor: emailfrom
  required: true
  description: The value of the malicious email's "From" attribute.
- key: Subject
  value:
    complex:
      root: incident
      accessor: emailsubject
  required: false
  description: The value of the malicious email's "Subject" attribute.
- key: AttachmentName
  value:
    complex:
      root: incident
      accessor: attachmentname
  required: false
  description: The value of the malicious email's "AttachmentName" attribute.
- key: SearchThisWeek
  value:
    simple: "true"
  required: true
  description: Limit the search to the current week (true/false).
- key: Limit
  value:
    simple: "20"
  required: true
  description: The maximum number of search results.
- key: DeleteType
  value:
    simple: trash
  required: true
  description: The deletion type (trash, soft, or hard).
outputs: []
tests:
- No test
supportedModules:
- agentix
- xsiam
- edr
- cloud
- cloud_runtime_security