Search And Delete Emails - EWS

This playbook searches EWS to identify and delete emails with similar attributes of a malicious email.

Microsoft Exchange On-Premise · 11 tasks · 6 inputs · 0 outputs

Inputs

  • From — The value of the malicious email's "From" attribute.
  • Subject — The value of the malicious email's "Subject" attribute.
  • AttachmentName — The value of the malicious email's "AttachmentName" attribute.
  • SearchThisWeek — Limit the search to the current week (true/false).
  • Limit — The maximum number of search results.
  • DeleteType — The deletion type (trash, soft, or hard).

Commands used

ews-delete-items ews-search-mailboxes

Flowchart

No yes yes yes Start Start Search EWS for similar emails - ews-search-mailboxes Search EWS for similar em... ews-search-mailboxes Build EWS query Build EWS query Search all mailboxes in EWS Search all mailboxes in EWS Build EWS query - BuildEWSQuery Build EWS query BuildEWSQuery Delete similar emails Delete similar emails Should the found emails be deleted from EWS? Should the found emails b... Done Done Delete emails from EWS - ews-delete-items Delete emails from EWS ews-delete-items Were similar emails found? Were similar emails found? Is EWS v2 enabled? Is EWS v2 enabled?