Search And Delete Emails - Generic Deprecated

Deprecated. Use `Search And Delete Emails - Generic v2` instead. This playbook searches and delete emails with similar attributes of a malicious email.

Common Playbooks · 3 tasks · 3 inputs · 0 outputs

Details

ID	`search_and_delete_emails_-_generic`
From Version	5.0.0
Tasks	3

README

Deprecated. Use Search And Delete Emails - Generic v2 instead. This playbook searches and delete emails with similar attributes of a malicious email.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Search And Delete Emails - EWS

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Default Value	Required
From	The value of the malicious email’s “From” attribute.	incident.emailfrom	Optional
Subject	The value of the malicious email’s “Subject” attribute.	incident.emailsubject	Optional
AttachmentName	The value of the malicious email’s “AttachmentName” attribute.	incident.attachmentname	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Search And Delete Emails - Generic

Inputs

From — The value of the malicious email's "From" attribute.
Subject — The value of the malicious email's "Subject" attribute.
AttachmentName — The value of the malicious email's "AttachmentName" attribute.

Flowchart

Source

playbook-Search_And_Delete_Emails_-_Generic.yml playbook-Search_And_Delete_Emails_-_Generic_-_v2_6_1.yml playbook-Search_And_Delete_Emails_-_Generic_-_v2_6_1_README.md

Download History Raw

id: search_and_delete_emails_-_generic
version: -1
name: Search And Delete Emails - Generic
deprecated: true
description: Deprecated. Use `Search And Delete Emails - Generic v2` instead. This playbook searches and delete emails with similar attributes of a malicious email.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 808e9cce-8112-49d4-8624-907a6fbeb394
    type: start
    task:
      id: 808e9cce-8112-49d4-8624-907a6fbeb394
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 2c636e7e-8de1-4535-8c36-454b2c36cc75
    type: playbook
    task:
      id: 2c636e7e-8de1-4535-8c36-454b2c36cc75
      version: -1
      name: Search And Delete Emails - EWS
      description: This playbook searches EWS to identify and delete emails with similar attributes of a malicious email.
      playbookName: Search And Delete Emails - EWS
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      AttachmentName:
        complex:
          root: inputs.AttachmentName
      DeleteType:
        simple: trash
      From:
        complex:
          root: inputs.From
      Limit:
        simple: "20"
      SearchThisWeek:
        simple: "true"
      Subject:
        complex:
          root: inputs.Subject
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "2":
    id: "2"
    taskid: 88c58e53-8fe7-4ca2-8697-0ed3f67191fe
    type: title
    task:
      id: 88c58e53-8fe7-4ca2-8697-0ed3f67191fe
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 385,
        "width": 380,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: From
  value:
    complex:
      root: incident
      accessor: emailfrom
  required: false
  description: The value of the malicious email's "From" attribute.
  playbookInputQuery:
- key: Subject
  value:
    complex:
      root: incident
      accessor: emailsubject
  required: false
  description: The value of the malicious email's "Subject" attribute.
  playbookInputQuery:
- key: AttachmentName
  value:
    complex:
      root: incident
      accessor: attachmentname
  required: false
  description: The value of the malicious email's "AttachmentName" attribute.
  playbookInputQuery:
outputs: []
fromversion: 5.0.0
tests:
- No test