IdentifyAttachedEmail

Identify whether the incident includes an email message attached as an eml or msg file and return the answer to playbook. Also saves the identified entry ID to context for use for later. Commonly used in automated playbooks that handle phishing reports sent to a special phishing mailbox set up by the security team.

python · Common Scripts

Details

ID	`IdentifyAttachedEmail`
Language	python
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10404775`
Tags	phishing email Condition

README

Identify whether the incident includes an email message attached as an eml or msg file and return the answer to playbook.
Also saves the identified entry ID to context for use for later.
Commonly used in automated playbooks that handle phishing reports sent to a special phishing mailbox set up by the security team.

Script Data

Name	Description
Script Type	python2
Tags	phishing, email, Condition
Cortex XSOAR Version	5.0.0

Used In

This script is used in the following playbooks and scripts.

Process Email - Core
Process Email - Core v2
Process Email - Generic
Process Email - Generic v2

Inputs

Argument Name	Description
entryid	Specific entryid to check if it is an email attachment. If not specified will check all entries of the incident.

Outputs

Path	Description	Type
yes	If incident contains an email attachment.	Unknown
no	If incident does not contain an email attachment	Unknown
reportedemailentryid	The entry IDs of the email attachments found.	String

Source

IdentifyAttachedEmail.py IdentifyAttachedEmail_test.py IdentifyAttachedEmail.yml

Download History Raw

commonfields:
  id: IdentifyAttachedEmail
  version: -1
name: IdentifyAttachedEmail
script: ''
type: python
subtype: python3
tags:
- phishing
- email
- Condition
comment: Identify whether the incident includes an email message attached as an eml or msg file and return the answer to playbook. Also saves the identified entry ID to context for use for later. Commonly used in automated playbooks that handle phishing reports sent to a special phishing mailbox set up by the security team.
enabled: true
args:
- name: entryid
  description: Specific entryid to check if it is an email attachment. If not specified will check all entries of the incident.
  isArray: true
outputs:
- contextPath: yes
  description: If incident contains an email attachment.
- contextPath: no
  description: If incident does not contain an email attachment.
- contextPath: reportedemailentryid
  description: The entry IDs of the email attachments found.
  type: String
system: true
scripttarget: 0
dependson: {}
timeout: 0s
tests:
- Process Email - Generic - Test - Incident Starter
- Phishing v2 - Test - Incident Starter
fromversion: 5.0.0
dockerimage: demisto/python3:3.12.13.10404775