MimecastFindEmail

Find an email across all mailboxes, and return the list of mailboxes where the email was found, as well as Yes if the mail was found anywhere or No otherwise.

python · Mimecast

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401

MAILBOXES_CTXKEY = "Mailboxes"


def main() -> None:
    res = []
    resp = demisto.executeCommand("mimecast-query", demisto.args())

    if isError(resp[0]):
        demisto.results(resp)
    else:
        data = demisto.get(resp[0], "Contents.data")
        if data:
            users = set()
            items = demisto.get(data[0], "items")
            if isinstance(items, list):
                for mail in items:
                    users.add(mail["displayto"])

            users = list(users)  # type: ignore
            if users:
                markdownString = "### Mailboxes with email(s) matching the query:\n"
                markdownString += "".join(["* " + s + "\n" for s in users])
                res.append({"ContentsFormat": formats["markdown"], "Type": entryTypes["note"], "Contents": markdownString})

                users_str = ",".join([str(s) for s in users])
                demisto.setContext(MAILBOXES_CTXKEY, users_str)

                answer = "yes"
            else:
                demisto.debug("\nNo relevant mails have been found\n")
                answer = "no"
        else:
            demisto.debug("\nNo relevant mails have been found\n")
            answer = "no"

        res.append({"Type": entryTypes["note"], "ContentsFormat": formats["text"], "Contents": answer})
        demisto.results(res)


if __name__ in ["__main__", "builtin", "builtins"]:
    main()

README

Searches all mailboxes to find an email, and returns the list of mailboxes where the email was found. “Yes” will be displayed if the mail was found anywhere or “No” if not.

Script Data

Name Description
Script Type python
Tags Mimecast

Dependencies

This script uses the following commands and scripts.

  • mimecast-query

Inputs

Argument Name Description
queryXml The query string XML for the search, using Mimecast Unified Search Experience (MUSE). For more on information click here. Using this will override other query arguments.
text The search for this text in API messages.
dryRun Will not execute the query, but will just return the query string that was built.
date Searches the specific dates only.
dateFrom Searches emails from a specific date. In format 2015-09-21T23:00:00Z.
dateTo Searches emails up until a specific date. In format 2015-09-21T23:00:00Z.
sentTo The filter on the messages to a specific address.
sentFrom The filter on the messages from a specific address.
subject Searches emails by subject. This will override the text argument.
attachmentType The messages with and without attachments. Any messages with any attachment documents can contain, “doc”, “dot”, “docx”, “docm”, “dotx”, “dotm”, “pdf”, “rtf”, “html” attachments. Spreadsheets can contain, “xls”, “xlt”, “xlsx”, “xlsm”, “xltx”, “xltm”, “xlsb”, “xlam”, “csv”. Presentations can contain, “ppt”, “pptx”, “pptm”, “potx”, “potm”, “ppam”, “ppsx”, “ppsm”, “sldx”, “sldm”, “thms”, “pps”. Text messages can contain, “txt”, “text”, “html”, “log”. Images messages can contain, “jpg”, “jpeg”, “png”, “bmp”, “gif”, “psd”, “tif”, “tiff”. Media messages can contain, “mp3”, “mp4”, “m4a”, “mpg”, “mpeg”, “avi”, “wav”, “aac”, “wma”, “mov”. Zip messages can contain, “zip”, “rar”, “cab”, “gz”, “gzip”, “7z”. None messages will have no attachments and will not be present in the results.
attachmentText Searches for text in the attachments.
body Searches emails by text in the body. This will override the text and subject arguments.
pageSize Sets the number of results to return per page. The default is 25.
startRow Sets the result to start returning results. The default is 0.
active Defines if the search should query recently received messages that are not fully indexed yet. The default is false. Search can be done by mailbox and date time across active messages.

Outputs

There are no outputs for this script.