ShowCampaignRecipients
Displays the phishing campaign recipients' email addresses and the number of incidents each email address appears in.
python · Phishing Campaign
Source
from collections import Counter import demistomock as demisto # noqa: F401 from CommonServerPython import * # noqa: F401 EMAIL_TO_FIELD = "emailto" EMAIL_CC_FIELD = "emailcc" EMAIL_BCC_FIELD = "emailbcc" RECIPIENTS_FIELDS = [EMAIL_TO_FIELD, EMAIL_CC_FIELD, EMAIL_BCC_FIELD] def get_incident_ids() -> list | None: """ Gets all the campaign incident ids. Returns: List of all the ids. """ incidents = demisto.get(demisto.context(), "EmailCampaign.incidents") return [incident["id"] for incident in incidents] if incidents else None def get_campaign_recipients(incident_ids: list[str]) -> str: """ Gets the campaign recipients in a readable table. Args: incident_ids: All the campaign incident ids. Returns: MD table of the recipients and their amount. """ res = demisto.executeCommand("GetIncidentsByQuery", {"query": f"id:({' '.join(incident_ids)})"}) if isError(res): return_error(f"Error occurred while trying to get incidents by query: {get_error(res)}") incidents_from_query = json.loads(res[0]["Contents"]) if not incidents_from_query: return "No incidents found." recipients = [] for recipient_field in RECIPIENTS_FIELDS: recipients.extend([incident[recipient_field] for incident in incidents_from_query if recipient_field in incident]) if not recipients: return "No incident recipients found." recipients_counter: list = Counter(filter(None, recipients)).most_common() recipients_table_content = [{"Email": item[0], "Number Of Appearances": item[1]} for item in recipients_counter] headers = ["Email", "Number Of Appearances"] return tableToMarkdown("", recipients_table_content, headers=headers) def main(): try: if incident_ids := get_incident_ids(): campaign_recipients = get_campaign_recipients(incident_ids) return_results(CommandResults(readable_output=campaign_recipients, raw_response=campaign_recipients)) else: return_results( CommandResults( content_format="html", raw_response=( "<div style='text-align:center; font-size:17px; padding: 15px;'>Recipients" "</br> <div style='font-size:20px;'> No incident recipients found.</div></div>" ), ) ) except Exception as err: return_error(str(err)) if __name__ in ("__main__", "__builtin__", "builtins"): main()
README
Displays the phishing campaign recipients’ email addresses and the number of incidents each email address appears in. .
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | dynamic-section |
| Cortex XSOAR Version | 5.5.0 and later |
Inputs
There are no inputs for this script.
Outputs
There are no outputs for this script.