category: Email
provider: Microsoft
sectionorder:
- Connect
- Collect
commonfields:
  id: EWSO365
  version: -1
configuration:
- display: Azure Cloud
  name: azure_cloud
  type: 15
  required: false
  defaultvalue: Worldwide
  options:
  - Worldwide
  - US GCC
  - US GCC-High
  - DoD
  - Germany
  - China
  section: Connect
  advanced: true
  additionalinfo: More information about National clouds can be found here - https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#using-national-cloud
- additionalinfo: ID can be received from the admin consent procedure - see Detailed Instructions.
  display: ID / Application ID
  name: _client_id
  type: 0
  section: Connect
  required: false
- additionalinfo: Token can be received from the admin consent procedure - see Detailed Instructions.
  display: Token / Tenant ID
  name: _tenant_id
  type: 0
  section: Connect
  required: false
- additionalinfo: Key can be received from the admin consent procedure - see Detailed Instructions.
  displaypassword: Key / Application Secret
  name: credentials
  type: 9
  hiddenusername: true
  section: Connect
  display: ''
  required: false
- additionalinfo: Mailbox to run commands on and to fetch incidents from. To use this functionality, your account must have delegation for the account specified. For more information, see https://xsoar.pan.dev/docs/reference/integrations/ewso365#additional-information
  display: Email Address
  name: default_target_mailbox
  required: true
  type: 0
  section: Connect
- additionalinfo: If this parameter is given, the commands will run with the UPN mailbox instead of the default target mailbox.
  display: UPN Address
  name: upn_mailbox
  type: 0
  section: Connect
  advanced: true
  required: false
- defaultvalue: Inbox
  display: Name of the folder from which to fetch incidents
  name: folder
  required: false
  type: 0
  additionalinfo: Supports Exchange Folder ID and sub-folders e.g. Inbox/Phishing.
  section: Collect
- defaultvalue: 'Impersonation'
  display: Access Type (Impersonation is deprecated as of February 2025)
  name: access_type
  type: 15
  options:
  - Impersonation
  - Delegate
  section: Connect
  advanced: true
  required: false
- display: Public Folder
  name: is_public_folder
  type: 8
  section: Connect
  advanced: true
  defaultvalue: 'false'
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
  supportedModules:
  - agentix
  - xsiam
- defaultvalue: '10 minutes'
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: fetch_time
  type: 0
  section: Collect
  required: false
- display: Maximum number of incidents per fetch (up to 200). Performance might be affected by a value higher than 50.
  name: max_fetch
  type: 0
  defaultvalue: '50'
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Mark fetched emails as read
  name: mark_as_read
  type: 8
  section: Collect
  advanced: true
  required: false
  additionalinfo: When 'Mark fetched emails as read' is enabled and emails are fetched by modification time, emails will be re-fetched in the next cycle after being marked as read (due to metadata changes). This is expected behavior.
- display: Timeout (in seconds) for HTTP requests to Exchange Server
  name: request_timeout
  type: 0
  defaultvalue: '120'
  section: Connect
  advanced: true
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  defaultvalue: 'false'
  section: Connect
  advanced: true
  required: false
- display: Run as a separate process (protects against memory depletion)
  name: separate_process
  type: 8
  defaultvalue: 'false'
  section: Connect
  advanced: true
  required: false
- additionalinfo: Select this checkbox if you are using a self-deployed Azure application.
  display: Use a self deployed Azure Application
  name: self_deployed
  type: 8
  section: Connect
  advanced: false
  required: false
- additionalinfo: Use the "ID" parameter instead.
  display: ID / Application ID (Deprecated)
  name: client_id
  type: 4
  hidden: true
  section: Connect
  advanced: true
  required: false
- additionalinfo: Use the "Token" parameter instead.
  display: Token / Tenant ID (Deprecated)
  name: tenant_id
  type: 4
  hidden: true
  section: Connect
  advanced: true
  required: false
- additionalinfo: Use the "Key" parameter instead.
  display: Key / Application Secret (Deprecated)
  name: client_secret
  type: 4
  hidden: true
  section: Connect
  advanced: true
  required: false
- defaultvalue: '1'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: Default is to filter by received-time, which works well if the folder is an "Inbox". But for a folder emails are dragged into for attention, if we filter by received-time, out-of-order processing of emails means some are ignored. Filtering by modified-time works better for such a scenario. This works best if any modifications (such as tagging) happens before moving the email into the folder, such that the move into the folder is the last modification, and triggers Cortex XSOAR to fetch it as an incident.
  display: What time field should we filter incidents by?
  name: incidentFilter
  options:
  - received-time
  - modified-time
  type: 15
  section: Collect
  advanced: true
  required: false
- display: Use legacy attachment name
  name: legacy_name
  section: Collect
  type: 8
  advanced: true
  defaultvalue: 'false'
- display: Skip unparsable emails during fetch incidents
  name: skip_unparsable_emails
  section: Collect
  type: 8
  advanced: true
  required: false
description: The new EWS O365 integration uses OAuth 2.0 protocol and can be used with Exchange Online and Office 365 (mail).
display: EWS O365
name: EWSO365
script:
  commands:
  - arguments:
    - description: The ID of the email message for which to get the attachments.
      name: item-id
      required: true
    - description: The mailbox in which this attachment was found. If empty, the default mailbox is used. Otherwise the user might require impersonation rights to this mailbox.
      name: target-mailbox
    - description: The attachments ids to get. If none - all attachments will be retrieve from the message. Support multiple attachments with comma-separated value or array.
      isArray: true
      name: attachment-ids
    description: Retrieves the actual attachments from an item (email message). To get all attachments for a message, only specify the item-id argument.
    name: ews-get-attachment
    outputs:
    - contextPath: EWS.Items.FileAttachments.attachmentId
      description: The attachment ID. Used for file attachments only.
      type: string
    - contextPath: EWS.Items.FileAttachments.attachmentName
      description: The attachment name. Used for file attachments only.
      type: string
    - contextPath: EWS.Items.FileAttachments.attachmentSHA256
      description: The SHA256 hash of the attached file.
      type: string
    - contextPath: EWS.Items.FileAttachments.attachmentLastModifiedTime
      description: The attachment last modified time. Used for file attachments only.
      type: date
    - contextPath: EWS.Items.ItemAttachments.datetimeCreated
      description: The created time of the attached email.
      type: date
    - contextPath: EWS.Items.ItemAttachments.datetimeReceived
      description: The received time of the attached email.
      type: date
    - contextPath: EWS.Items.ItemAttachments.datetimeSent
      description: The sent time of the attached email.
      type: date
    - contextPath: EWS.Items.ItemAttachments.receivedBy
      description: The received by address of the attached email.
      type: string
    - contextPath: EWS.Items.ItemAttachments.subject
      description: The subject of the attached email.
      type: string
    - contextPath: EWS.Items.ItemAttachments.textBody
      description: The body of the attached email (as text).
      type: string
    - contextPath: EWS.Items.ItemAttachments.headers
      description: The headers of the attached email.
      type: Unknown
    - contextPath: EWS.Items.ItemAttachments.hasAttachments
      description: Whether the attached email has attachments.
      type: boolean
    - contextPath: EWS.Items.ItemAttachments.itemId
      description: The attached email item ID.
      type: string
    - contextPath: EWS.Items.ItemAttachments.toRecipients
      description: A list of recipient email addresses for the attached email.
      type: Unknown
    - contextPath: EWS.Items.ItemAttachments.body
      description: The body of the attached email (as HTML).
      type: string
    - contextPath: EWS.Items.ItemAttachments.attachmentSHA256
      description: The SHA256 hash of the attached email (as EML file).
      type: string
    - contextPath: EWS.Items.ItemAttachments.FileAttachments.attachmentSHA256
      description: SHA256 hash of the attached files inside of the attached email.
      type: string
    - contextPath: EWS.Items.ItemAttachments.ItemAttachments.attachmentSHA256
      description: SHA256 hash of the attached emails inside of the attached email.
      type: string
    - contextPath: EWS.Items.ItemAttachments.isRead
      description: The read status of the attachment.
      type: String
  - arguments:
    - description: The ID of the email message for which to delete attachments.
      name: item-id
      required: true
    - description: The mailbox in which this attachment was found. If empty, the default mailbox is used. Otherwise the user might require impersonation rights to this mailbox.
      name: target-mailbox
    - description: A comma-separated list (or array) of attachment IDs to delete. If empty, all attachments will be deleted from the message.
      isArray: true
      name: attachment-ids
    description: Deletes the attachments of an item (email message).
    name: ews-delete-attachment
    outputs:
    - contextPath: EWS.Items.FileAttachments.attachmentId
      description: The ID of the deleted attachment, in case of file attachment.
      type: string
    - contextPath: EWS.Items.ItemAttachments.attachmentId
      description: The ID of the deleted attachment, in case of other attachment (for example, "email").
      type: string
    - contextPath: EWS.Items.FileAttachments.action
      description: 'The deletion action in case of file attachment. This is a constant value: ''deleted''.'
      type: string
    - contextPath: EWS.Items.ItemAttachments.action
      description: 'The deletion action in case of other attachment (for example, "email"). This is a constant value: ''deleted''.'
      type: string
  - description: Returns a list of searchable mailboxes. This command requires eDiscovery permissions to the Exchange Server. For more information, see the EWSv2 integration documentation.
    name: ews-get-searchable-mailboxes
    outputs:
    - contextPath: EWS.Mailboxes.mailbox
      description: Addresses of the searchable mailboxes.
      type: string
    - contextPath: EWS.Mailboxes.mailboxId
      description: IDs of the searchable mailboxes.
      type: string
    - contextPath: EWS.Mailboxes.displayName
      description: The email display name.
      type: string
    - contextPath: EWS.Mailboxes.isExternal
      description: Whether the mailbox is external.
      type: boolean
    - contextPath: EWS.Mailboxes.externalEmailAddress
      description: The external email address.
      type: string
    arguments: []
  - arguments:
    - description: The ID of the item to move.
      name: item-id
      required: true
    - description: The path to the folder to which to move the item. Complex paths are supported, for example, "Inbox\Phishing".
      name: target-folder-path
      required: true
    - description: The mailbox on which to run the command.
      name: target-mailbox
    - auto: PREDEFINED
      description: Whether the target folder is a public folder. Can be "True" or "False".
      name: is-public
      predefined:
      - 'True'
      - 'False'
    description: Move an item to different folder in the mailbox.
    name: ews-move-item
    outputs:
    - contextPath: EWS.Items.newItemID
      description: The item ID after move.
      type: string
    - contextPath: EWS.Items.messageID
      description: The item message ID.
      type: string
    - contextPath: EWS.Items.itemId
      description: The original item ID.
      type: string
    - contextPath: EWS.Items.action
      description: The action taken. The value will be "moved".
      type: string
    compliantpolicies:
    - User Soft Remediation
  - arguments:
    - description: The item IDs to delete.
      name: item-ids
      required: true
    - defaultValue: soft
      description: Deletion type. Can be "trash", "soft", or "hard".
      name: delete-type
      required: true
    - description: The mailbox on which to run the command.
      name: target-mailbox
    description: Delete items from mailbox.
    name: ews-delete-items
    outputs:
    - contextPath: EWS.Items.itemId
      description: The deleted item ID.
      type: string
    - contextPath: EWS.Items.messageId
      description: The deleted message ID.
      type: string
    - contextPath: EWS.Items.action
      description: The deletion action. Can be 'trash-deleted', 'soft-deleted', or 'hard-deleted'.
      type: string
    compliantpolicies:
    - User Soft Remediation
  - arguments:
    - description: 'The search query string. For more information about the query syntax, see the Microsoft documentation: https://msdn.microsoft.com/en-us/library/ee693615.aspx'
      name: query
    - description: The folder path in which to search. If empty, searches all folders in the mailbox.
      name: folder-path
    - defaultValue: '50'
      description: Maximum number of results to return. The default is 50.
      name: limit
    - description: The mailbox on which to apply the search.
      name: target-mailbox
    - auto: PREDEFINED
      description: Whether the folder is a public folder. Can be "True" or "False".
      name: is-public
      predefined:
      - 'True'
      - 'False'
    - description: The message ID of the email. This will be ignored if a query argument is provided.
      name: message-id
    - defaultValue: all
      description: A comma-separated list of fields to retrieve.
      isArray: true
      name: selected-fields
      predefined:
      - ''
      auto: PREDEFINED
    description: Searches for items in the specified mailbox. Specific permissions are needed for this operation to search in a target mailbox other than the default.
    name: ews-search-mailbox
    outputs:
    - contextPath: EWS.Items.itemId
      description: The email item ID.
      type: string
    - contextPath: EWS.Items.hasAttachments
      description: Whether the email has attachments.
      type: boolean
    - contextPath: EWS.Items.datetimeReceived
      description: Received time of the email.
      type: date
    - contextPath: EWS.Items.datetimeSent
      description: Sent time of the email.
      type: date
    - contextPath: EWS.Items.headers
      description: Email headers (list).
      type: Unknown
    - contextPath: EWS.Items.sender
      description: Sender email address of the email.
      type: string
    - contextPath: EWS.Items.subject
      description: Subject of the email.
      type: string
    - contextPath: EWS.Items.textBody
      description: Body of the email (as text).
      type: string
    - contextPath: EWS.Items.size
      description: Email size.
      type: number
    - contextPath: EWS.Items.toRecipients
      description: List of email recipients addresses.
      type: Unknown
    - contextPath: EWS.Items.receivedBy
      description: Received by address of the email.
      type: Unknown
    - contextPath: EWS.Items.messageId
      description: Email message ID.
      type: string
    - contextPath: EWS.Items.body
      description: Body of the email (as HTML).
      type: string
    - contextPath: EWS.Items.FileAttachments.attachmentId
      description: Attachment ID of the file attachment.
      type: unknown
    - contextPath: EWS.Items.ItemAttachments.attachmentId
      description: Attachment ID of the item attachment.
      type: unknown
    - contextPath: EWS.Items.FileAttachments.attachmentName
      description: Attachment name of the file attachment.
      type: unknown
    - contextPath: EWS.Items.ItemAttachments.attachmentName
      description: Attachment name of the item attachment.
      type: unknown
    - contextPath: EWS.Items.isRead
      description: The read status of the email.
      type: String
  - arguments:
    - description: The mailbox for which to retrieve the contacts.
      name: target-mailbox
    - defaultValue: '50'
      description: Maximum number of results to return. The default is 50.
      name: limit
    description: Retrieves contacts for a specified mailbox.
    name: ews-get-contacts
    outputs:
    - contextPath: Account.Email.EwsContacts.displayName
      description: The contact name.
      type: Unknown
    - contextPath: Account.Email.EwsContacts.lastModifiedTime
      description: The time that the contact was last modified.
      type: Unknown
    - contextPath: Account.Email.EwsContacts.emailAddresses
      description: Phone numbers of the contact.
      type: Unknown
    - contextPath: Account.Email.EwsContacts.physicalAddresses
      description: Physical addresses of the contact.
      type: Unknown
    - contextPath: Account.Email.EwsContacts.phoneNumbers.phoneNumber
      description: Email addresses of the contact.
      type: Unknown
  - arguments:
    - description: The mailbox for which to get the out-of-office status.
      name: target-mailbox
      required: true
    description: Retrieves the out-of-office status for a specified mailbox.
    name: ews-get-out-of-office
    outputs:
    - contextPath: Account.Email.OutOfOffice.state
      description: 'Out-of-office state. Result can be: Enabled, Scheduled, Disabled.'
      type: Unknown
    - contextPath: Account.Email.OutOfOffice.externalAudience
      description: Out-of-office external audience. Can be "None", "Known", or "All".
      type: Unknown
    - contextPath: Account.Email.OutOfOffice.start
      description: Out-of-office start date.
      type: Unknown
    - contextPath: Account.Email.OutOfOffice.end
      description: Out-of-office end date.
      type: Unknown
    - contextPath: Account.Email.OutOfOffice.internalReply
      description: Out-of-office internal reply.
      type: Unknown
    - contextPath: Account.Email.OutOfOffice.externalReply
      description: Out-of-office external reply.
      type: Unknown
    - contextPath: Account.Email.OutOfOffice.mailbox
      description: Out-of-office mailbox.
      type: Unknown
  - arguments:
    - description: A comma-separated list of message IDs. Run the py-ews-delete-items command to retrieve the message IDs.
      name: message-ids
      required: true
    - defaultValue: Inbox
      description: The folder path to recover the messages to.
      name: target-folder-path
      required: true
    - description: The mailbox in which the messages found. If empty, will use the default mailbox. If you specify a different mailbox, you might need impersonation rights to the mailbox.
      name: target-mailbox
    - auto: PREDEFINED
      description: Whether the target folder is a Public Folder. Can be "True" or "False".
      name: is-public
      predefined:
      - 'True'
      - 'False'
    description: Recovers messages that were soft-deleted.
    name: ews-recover-messages
    outputs:
    - contextPath: EWS.Items.itemId
      description: The item ID of the recovered item.
      type: Unknown
    - contextPath: EWS.Items.messageId
      description: The message ID of the recovered item.
      type: Unknown
    - contextPath: EWS.Items.action
      description: The action taken on the item. The value will be 'recovered'.
      type: Unknown
  - arguments:
    - description: The name of the new folder.
      name: new-folder-name
      required: true
    - defaultValue: Inbox
      description: Path to locate the new folder. Exchange folder ID is also supported.
      name: folder-path
      required: true
    - description: The mailbox in which to create the folder.
      name: target-mailbox
    description: Creates a new folder in a specified mailbox.
    name: ews-create-folder
  - arguments:
    - description: The item ID to mark as junk.
      name: item-id
      required: true
    - auto: PREDEFINED
      defaultValue: 'yes'
      description: Whether to move the item from the original folder to the junk folder. Can be "yes" or "no". The default is "yes".
      name: move-items
      predefined:
      - 'yes'
      - 'no'
    - description: If empty, will use the default mailbox. If you specify a different mailbox, you might need impersonation rights to the mailbox.
      name: target-mailbox
    description: 'Marks an item as junk. This is commonly used to block an email address (meaning all future emails from this sender will be sent to the junk folder). For more information, see the Microsoft documentation: https://msdn.microsoft.com/en-us/library/office/dn481311(v=exchg.150).aspx.'
    name: ews-mark-item-as-junk
  - arguments:
    - description: The mailbox on which to apply the command.
      name: target-mailbox
    description: Retrieves information for folders for a specified mailbox. Only folders with read permissions will be returned. Your visual folders on the mailbox, such as "Inbox", are under the folder "Top of Information Store".
    name: ews-find-folders
    outputs:
    - contextPath: EWS.Folders.name
      description: Folder name.
      type: string
    - contextPath: EWS.Folders.id
      description: Folder ID.
      type: string
    - contextPath: EWS.Folders.totalCount
      description: Number of items in the folder.
      type: Unknown
    - contextPath: EWS.Folders.unreadCount
      description: Number of unread items in the folder.
      type: number
    - contextPath: EWS.Folders.changeKey
      description: Folder change key.
      type: number
    - contextPath: EWS.Folders.childrenFolderCount
      description: Number of sub-folders.
      type: number
  - arguments:
    - description: The folder path from which to get the items.
      name: folder-path
      required: true
    - defaultValue: '50'
      description: Maximum number of items to return. The default is 50.
      name: limit
    - description: The mailbox on which to apply the command.
      name: target-mailbox
    - auto: PREDEFINED
      description: Whether the folder is a public folder. Can be "True" or "False". The default is "False".
      name: is-public
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      defaultValue: 'no'
      description: If the email item contains another email as an attachment (EML or MSG file), whether to retrieve the EML/MSG file attachment. Can be "yes" or "no". The default is "no".
      name: get-internal-item
      predefined:
      - 'yes'
      - 'no'
    description: Retrieves items from a specified folder in a mailbox. The items are order by the item created time, most recent is first.
    name: ews-get-items-from-folder
    outputs:
    - contextPath: EWS.Items.itemId
      description: The item ID of the email.
      type: string
    - contextPath: EWS.Items.hasAttachments
      description: Whether the email has attachments.
      type: boolean
    - contextPath: EWS.Items.datetimeReceived
      description: Received time of the email.
      type: date
    - contextPath: EWS.Items.datetimeSent
      description: Sent time of the email.
      type: date
    - contextPath: EWS.Items.headers
      description: Email headers (list).
      type: Unknown
    - contextPath: EWS.Items.sender
      description: Sender mail address of the email.
      type: string
    - contextPath: EWS.Items.subject
      description: Subject of the email.
      type: string
    - contextPath: EWS.Items.textBody
      description: Body of the email (as text).
      type: string
    - contextPath: EWS.Items.size
      description: Email size.
      type: number
    - contextPath: EWS.Items.toRecipients
      description: Email recipients addresses (list).
      type: Unknown
    - contextPath: EWS.Items.receivedBy
      description: Received by address of the email.
      type: Unknown
    - contextPath: EWS.Items.messageId
      description: Email message ID.
      type: string
    - contextPath: EWS.Items.body
      description: Body of the email (as HTML).
      type: string
    - contextPath: EWS.Items.FileAttachments.attachmentId
      description: Attachment ID of file attachment.
      type: unknown
    - contextPath: EWS.Items.ItemAttachments.attachmentId
      description: Attachment ID of the item attachment.
      type: unknown
    - contextPath: EWS.Items.FileAttachments.attachmentName
      description: Attachment name of the file attachment.
      type: unknown
    - contextPath: EWS.Items.ItemAttachments.attachmentName
      description: Attachment name of the item attachment.
      type: unknown
    - contextPath: EWS.Items.isRead
      description: The read status of the email.
      type: String
    - contextPath: EWS.Items.categories
      description: The categories of the email.
      type: unknown
  - arguments:
    - description: A comma-separated list of item IDs.
      isArray: true
      name: item-ids
      required: true
    - description: The mailbox on which to run the command.
      name: target-mailbox
    description: Retrieves items by item ID.
    name: ews-get-items
    outputs:
    - contextPath: EWS.Items.itemId
      description: The email item ID.
      type: string
    - contextPath: EWS.Items.hasAttachments
      description: Whether the email has attachments.
      type: boolean
    - contextPath: EWS.Items.datetimeReceived
      description: Received time of the email.
      type: date
    - contextPath: EWS.Items.datetimeSent
      description: Sent time of the email.
      type: date
    - contextPath: EWS.Items.headers
      description: Email headers (list).
      type: Unknown
    - contextPath: EWS.Items.sender
      description: Sender mail address of the email.
      type: string
    - contextPath: EWS.Items.subject
      description: Subject of the email.
      type: string
    - contextPath: EWS.Items.textBody
      description: Body of the email (as text).
      type: string
    - contextPath: EWS.Items.size
      description: Email size.
      type: number
    - contextPath: EWS.Items.toRecipients
      description: Email recipients addresses (list).
      type: Unknown
    - contextPath: EWS.Items.receivedBy
      description: Received by address of the email.
      type: Unknown
    - contextPath: EWS.Items.messageId
      description: Email message ID.
      type: string
    - contextPath: EWS.Items.body
      description: Body of the email (as HTML).
      type: string
    - contextPath: EWS.Items.FileAttachments.attachmentId
      description: Attachment ID of the file attachment.
      type: unknown
    - contextPath: EWS.Items.ItemAttachments.attachmentId
      description: Attachment ID of the item attachment.
      type: unknown
    - contextPath: EWS.Items.FileAttachments.attachmentName
      description: Attachment name of the file attachment.
      type: unknown
    - contextPath: EWS.Items.ItemAttachments.attachmentName
      description: Attachment name of the item attachment.
      type: unknown
    - contextPath: EWS.Items.isRead
      description: The read status of the email.
      type: String
    - contextPath: Email.CC
      description: Email addresses CC'ed to the email.
      type: String
    - contextPath: Email.BCC
      description: Email addresses BCC'ed to the email.
      type: String
    - contextPath: Email.To
      description: The recipient of the email.
      type: String
    - contextPath: Email.From
      description: The sender of the email.
      type: String
    - contextPath: Email.Subject
      description: The subject of the email.
      type: String
    - contextPath: Email.Text
      description: The plain-text version of the email.
      type: String
    - contextPath: Email.HTML
      description: The HTML version of the email.
      type: String
    - contextPath: Email.HeadersMap
      description: The headers of the email.
      type: String
    - contextPath: EWS.Items.categories
      description: The categories of the email.
      type: unknown
  - arguments:
    - description: The item ID to move.
      name: item-id
      required: true
    - description: The folder in the destination mailbox to which to move the item. You can specify a complex path, for example, "Inbox\Phishing".
      name: destination-folder-path
      required: true
    - description: The mailbox to which to move the item.
      name: destination-mailbox
      required: true
    - description: The mailbox from which to move the item (conventionally called the "target-mailbox", the target mailbox on which to run the command).
      name: source-mailbox
    - auto: PREDEFINED
      description: Whether the destination folder is a Public Folder. Can be "True" or "False". Default is "False".
      name: is-public
      predefined:
      - 'True'
      - 'False'
    description: Moves an item from one mailbox to different mailbox.
    name: ews-move-item-between-mailboxes
    outputs:
    - contextPath: EWS.Items.movedToMailbox
      description: The mailbox wo which the item was moved.
      type: string
    - contextPath: EWS.Items.movedToFolder
      description: The folder to which the item was moved.
      type: string
    - contextPath: EWS.Items.action
      description: The action taken on the item. The value will be "moved".
      type: string
    compliantpolicies:
    - User Soft Remediation
  - arguments:
    - description: The mailbox on which to run the search.
      name: target-mailbox
    - default: true
      defaultValue: AllItems
      description: The path of the folder to retrieve. If empty, will retrieve the folder "AllItems".
      name: folder-path
    - auto: PREDEFINED
      description: Whether the folder is a Public Folder. Default is "False".
      name: is-public
      predefined:
      - 'True'
      - 'False'
    description: Retrieves a single folder.
    name: ews-get-folder
    outputs:
    - contextPath: EWS.Folders.id
      description: Folder ID.
      type: string
    - contextPath: EWS.Folders.name
      description: Folder name.
      type: string
    - contextPath: EWS.Folders.changeKey
      description: Folder change key.
      type: string
    - contextPath: EWS.Folders.totalCount
      description: Total number of emails in the folder.
      type: number
    - contextPath: EWS.Folders.childrenFolderCount
      description: Number of sub-folders.
      type: number
    - contextPath: EWS.Folders.unreadCount
      description: Number of unread emails in the folder.
      type: number
  - arguments:
    - description: Email address of the group to expand.
      name: email-address
      required: true
    - auto: PREDEFINED
      defaultValue: 'False'
      description: Whether to enable recursive expansion. Can be "True" or "False". Default is "False".
      name: recursive-expansion
      predefined:
      - 'True'
      - 'False'
    description: Expands a distribution list to display all members. By default, expands only first layer of the distribution list. If recursive-expansion is "True", the command expands nested distribution lists and returns all members.
    name: ews-expand-group
  - arguments:
    - description: A comma-separated list of item IDs.
      isArray: true
      name: item-ids
      required: true
    - auto: PREDEFINED
      defaultValue: read
      description: How to mark the item. Can be "read" or "unread". Default is "read".
      name: operation
      predefined:
      - read
      - unread
    - description: The mailbox on which to run the command. If empty, the command will be applied on the default mailbox.
      name: target-mailbox
    description: Marks items as read or unread.
    name: ews-mark-items-as-read
    outputs:
    - contextPath: EWS.Items.action
      description: The action that was performed on item.
      type: String
    - contextPath: EWS.Items.itemId
      description: The ID of the item.
      type: String
    - contextPath: EWS.Items.messageId
      description: The message ID of the item.
      type: String
  - arguments:
    - description: The item ID of the item to upload as an EML file.
      name: item-id
      required: true
    - description: The mailbox in which this email was found. If empty, the default mailbox is used.
      name: target-mailbox
    description: Retrieves items by item ID and uploads its content as an EML file.
    name: ews-get-items-as-eml
    outputs:
    - contextPath: File.Size
      description: The size of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.SHA512
      description: The SHA512 hash of the file.
      type: String
    - contextPath: File.Name
      description: The name of the file.
      type: String
    - contextPath: File.SSDeep
      description: The SSDeep hash of the file.
      type: String
    - contextPath: File.EntryID
      description: EntryID of the file.
      type: String
    - contextPath: File.Info
      description: Information about the file.
      type: String
    - contextPath: File.Type
      description: The file type.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.Extension
      description: The extension of the file.
      type: String
  - arguments:
    - default: true
      description: Email addresses for the 'To' field. Supports comma-separated values.
      isArray: true
      name: to
    - description: Email addresses for the 'Cc' field. Supports comma-separated values.
      isArray: true
      name: cc
    - description: Email addresses for the 'Bcc' field. Supports comma-separated values.
      isArray: true
      name: bcc
    - description: The email subject.
      name: subject
    - description: The content (body) of the email (in plain text).
      name: body
    - description: The content (body) of the email (in HTML format).
      name: htmlBody
    - description: A comma-separated list of War Room entry IDs that contain the files to attach to the email.
      isArray: true
      name: attachIDs
    - description: A comma-separated list to rename file names of corresponding attachment IDs. For example, rename the first two files - attachNames=file_name1,file_name2. rename first and third file - attachNames=file_name1,,file_name3.
      isArray: true
      name: attachNames
    - description: A comma-separated list of CIDs to embed attachments inside the email itself.
      isArray: true
      name: attachCIDs
    - description: A name for the attached file. You can pass multiple files in a comma-separated list, e.g., transientFile="t1.txt,temp.txt,t3.txt" transientFileContent="test 2,temporary file content,third file content" transientFileCID="t1.txt@xxx.yyy,t2.txt@xxx.zzz".
      isArray: true
      name: transientFile
    - description: Content for the attached file. You can pass multiple files in a comma-separated list, e.g., transientFile="t1.txt,temp.txt,t3.txt" transientFileContent="test 2,temporary file content,third file content" transientFileCID="t1.txt@xxx.yyy,t2.txt@xxx.zzz".
      isArray: true
      name: transientFileContent
    - description: CID for the attached file if it's inline. You can pass multiple files in a comma-separated list, e.g., transientFile="t1.txt,temp.txt,t3.txt" transientFileContent="test 2,temporary file content,third file content" transientFileCID="t1.txt@xxx.yyy,t2.txt@xxx.zzz".
      isArray: true
      name: transientFileCID
    - description: 'Replace {varname} variables with values from this argument. Expected values are in the form of a JSON document, such ase {"varname": {"value": "some value", "key": "context key"}}. Each var name can either be provided with the value or a context key from which to retrieve the value. Note that only context data is accessible for this argument, while incident fields are not.'
      name: templateParams
    - description: 'A comma-separated list of additional headers in the format: headerName=headerValue. For example: "headerName1=headerValue1,headerName2=headerValue2".'
      isArray: true
      name: additionalHeader
    - description: Raw email message. If provided, all other arguments will be ignored except "to", "cc", and "bcc".
      name: raw_message
    - description: The email address from which to reply.
      name: from
    - description: Email addresses that need to be used to reply to the message. Supports comma-separated values.
      isArray: true
      name: replyTo
    - auto: PREDEFINED
      defaultValue: Normal
      description: Sets the importance/Priority of the email. Default value is Normal.
      name: importance
      predefined:
      - High
      - Normal
      - Low
    - description: Whether to handle inline images in the HTML body. When set to 'True', inline images will be extracted from the HTML body and will be attached to the email as an inline attachment object.
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
      defaultValue: 'True'
      name: handle_inline_image
    description: Sends an email.
    name: send-mail
  - name: reply-mail
    arguments:
    - name: inReplyTo
      required: true
      description: ID of the item to reply to.
    - name: to
      required: true
      description: A comma-separated list of email addresses for the 'to' field.
      isArray: true
    - name: cc
      isArray: true
      description: A comma-separated list of email addresses for the 'cc' field.
    - name: bcc
      isArray: true
      description: A comma-separated list of email addresses for the 'bcc' field.
    - name: subject
      description: Subject for the email to be sent.
    - name: body
      description: The contents (body) of the email to be sent.
    - name: htmlBody
      description: HTML formatted content (body) of the email to be sent. This argument overrides the "body" argument.
    - name: renderBody
      description: 'Indicates whether to render the email body.'
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - name: attachIDs
      description: 'A comma-separated list of War Room entry IDs that contain files, and are used to attach files to the outgoing email. For example: attachIDs=15@8,19@8.'
      isArray: true
    - name: attachNames
      description: A comma-separated list of names of attachments to send. Should be the same number of elements as attachIDs.
      isArray: true
    - name: attachCIDs
      description: A comma-separated list of CIDs to embed attachments within the email itself.
      isArray: true
    - description: Whether to handle inline images in the HTML body. When set to 'True', inline images are extracted from the HTML body and attached to the email as an inline attachment object.
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
      defaultValue: 'True'
      name: handle_inline_image
    description: Replies to an email using EWS.
  - description: Run this command if for some reason you need to rerun the authentication process.
    name: ews-auth-reset
    arguments: []
  dockerimage: demisto/py3ews:5.6.0.10133006
  isfetch: true
  script: ''
  subtype: python3
  type: python
tests:
- EWS search-mailbox test
- EWS_O365_send_mail_test
- EWS_O365_test
fromversion: 5.0.0