DeleteReportedEmail

Details

ID	`DeleteReportedEmail`
Language	python
From Version	6.1.0
Docker Image	`demisto/python3:3.12.13.10404775`
Tags	basescript

README

A script for deleting reported phishing emails from the mailbox in which they were reported.

Note

The script was specifically developed for use by the Delete Reported Email layout on the Phishing - Generic v3 playbook, and should not be used elsewhere.

Script Data

Name	Description
Script Type	python3
Tags	basescript
Cortex XSOAR Version	6.1.0

Inputs

Argument Name	Description
delete_type	The type of deletion - soft allows restoring, hard doesn’t.
delete_from_brand	The brand for which to delete this email from. The default value is the incident using the brand.
search_name	Argument used for the generic polling flow within the security and compliance search.
polling	Use the Cortex XSOAR built-in polling to retrieve the result when it’s ready.
interval_in_seconds	Interval in seconds between each poll.

Outputs

Path	Description	Type
DeleteReportedEmail.result	Whether the deletion operation was successful, skipped, or failed	String
DeleteReportedEmail.deletion_failure_reason	The reason of failure if the deletion operation failed or skipped	String
DeleteReportedEmail.delete_type	Whether the deletion operation was hard or soft.	String
DeleteReportedEmail.using_brand	The email service that was used to delete the email.	String
DeleteReportedEmail.email_subject	The subject of the deleted email.	String
DeleteReportedEmail.message_id	The message ID of the deleted email.	String

Troubleshooting

If the Reported Email Origin field is missing or has a value of None, the script will not be able to locate the email and fail.
This can happen if the email forwarded to the listener mailbox was not forwarded as an attachment (with an EML file) as it should.
If either the Reported Email Message ID or Reported Email To fields are missing, the cause is likely to be one of the following:
- An EML file was not attached to the email.
- The playbook is being used as a sub-playbook, causing the EML file to exist only in the parent playbook.
- The Process Email - Generic v2 sub-playbook failed, or the ParseEmailFilesV2 step within it specifically failed.
The script is not supporting multiple recipients in the Reported Email To field.

Source

DeleteReportedEmail.py DeleteReportedEmail_test.py DeleteReportedEmail.yml

Download History Raw

args:
- description: 'The type of deletion - soft allows restoring, hard does not.'
  name: delete_type
  auto: PREDEFINED
  predefined:
  - soft
  - hard
- description: 'The brand from which to delete this email. The default value is the incident using brand.'
  name: delete_from_brand
- description: 'Argument used for the generic polling flow within the security and compliance search.'
  name: search_name
- description: 'Argument used for the MS Graph eDiscovery polling flow to hold the case ID. Should not be set by the user.'
  name: case_id
  hidden: true
- description: 'Argument used for the MS Graph eDiscovery polling flow to hold the search ID. Should not be set by the user.'
  name: search_id
  hidden: true
- auto: PREDEFINED
  description: Whether to use the Cortex XSOAR built-in polling to retrieve the result when it's ready.
  name: polling
  predefined:
  - 'true'
  - 'false'
- description: Interval in seconds between each poll.
  name: interval_in_seconds
comment: 'Use this script to delete a reported phishing email from the mailbox it was reported to.'
commonfields:
  id: DeleteReportedEmail
  version: -1
name: DeleteReportedEmail
polling: true
outputs:
- contextPath: DeleteReportedEmail.result
  description: 'Whether the deletion operation was successful, skipped, or failed.'
  type: String
- contextPath: DeleteReportedEmail.deletion_failure_reason
  description: 'The reason for the failure if the deletion operation failed or was skipped.'
  type: String
- contextPath: DeleteReportedEmail.delete_type
  description: 'Whether the deletion operation was hard or soft.'
  type: String
- contextPath: DeleteReportedEmail.using_brand
  description: 'The email service that was used to delete the email.'
  type: String
- contextPath: DeleteReportedEmail.email_subject
  description: 'The subject of the deleted email.'
  type: String
- contextPath: DeleteReportedEmail.message_id
  description: 'The message ID of the deleted email.'
  type: String
script: '-'
tags:
- basescript
timeout: '0'
type: python
subtype: python3
dockerimage: demisto/python3:3.12.13.10404775
fromversion: '6.1.0'
tests:
- No tests (auto formatted)