PreprocessEmail

Preprocessing script for email communication layout. This script checks if the incoming email contains an Incident ID to link the mail to an existing incident, and tags the email as "email-thread". This script runs with elevated permissions. Cortex XSOAR recommends using the built-in RBAC functionality to limit access to only those users requiring access to this script. For more information about the preprocessing rules, refer to: https://demisto.developers.paloaltonetworks.com/docs/incidents/incident-pre-processing

python · Email Communication

Details

ID	`PreprocessEmail`
Language	python
From Version	5.0.0
Docker Image	`demisto/btfl-soup:1.0.1.10120494`
Tags	email preProcessing

README

This script checks incoming emails from the incident type. If the emails contain an 8-digit hash in the email subject, the script will add the email response to the existing incident in the War Room with the “email-thread” tag. If there is no 8-digit hash in the email subject, the preprocessing will open a new incident for this email.

Note: In order to avoid performance issues, incoming emails will be added to an existing incident as “email-thread” only if the incident was modified in the last 60 days.
If you wish to extend this period, navigate to Settings->Advanced->Lists and add a new list with the name XSOAR - Email Communication Days To Query. In the Data field fill in a single number representing the number of days to query back, for example: 90.

The script is a part of the Email Communication pack.
For more information, see the section about permissions here: For Cortex XSOAR 6, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations for Cortex XSOAR 8 Cloud, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script for Cortex XSOAR 8 On-prem, see the https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script.

Script Data

Name	Description
Script Type	python3
Tags	preProcessing, email
Cortex XSOAR Version	0.0.0

Inputs

Argument Name	Description
attachments	The context path for attachments
files	The context path for files

Outputs

There are no outputs for this script.

Source

PreprocessEmail.py PreprocessEmail_test.py PreprocessEmail.yml

Download History Raw

args:
- defaultValue: ${incident.attachment}
  description: Attachments.
  isArray: true
  name: attachments
- description: Files.
  name: files
- name: CreateIncidentUntaggedEmail
  description: Allow the creation of an email for which we can't find an existing incident.
  defaultValue: 'true'
- name: reputation_calc_async
  auto: PREDEFINED
  predefined:
  - 'true'
  - 'false'
  description: Specify whether to calculate the reputation in an asynchronous way.
  defaultValue: 'false'
- name: timezone
  defaultValue: UTC
  description: Timezone used for email thread timestamps (must be a valid IANA timezone such as UTC, Europe/London, or America/New_York; defaults to UTC if not specified or invalid).
comment: |-
  Preprocessing script for email communication layout.
  This script checks if the incoming email contains an Incident ID to link the mail to an existing incident, and tags the email as "email-thread".
  This script runs with elevated permissions. 
  Cortex XSOAR recommends using the built-in RBAC functionality to limit access to only those users requiring access to this script.
  For more information about the preprocessing rules, refer to: https://demisto.developers.paloaltonetworks.com/docs/incidents/incident-pre-processing
commonfields:
  id: PreprocessEmail
  version: -1
enabled: true
name: PreprocessEmail
script: ''
subtype: python3
system: true
tags:
- email
- preProcessing
type: python
dockerimage: demisto/btfl-soup:1.0.1.10120494
runas: DBotRole
tests:
- No tests (auto formatted)
fromversion: 5.0.0
contentitemexportablefields:
  contentitemfields:
    fromServerVersion: ''
scripttarget: 0