id: Get Original Email - Gmail v2
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Get Original Email - Gmail v2
description: |
  This v2 playbook uses the reporter's email headers to retrieve the original email. This decreases the number of tasks to retrieve the original email. 
  Use this playbook to retrieve the original email using the Gmail integration, including headers and attachments.
  Note: You must have the necessary Google Apps Domain-Wide Delegation of Authority permissions in your Gmail service to execute global search.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: d8403573-b211-4d44-885c-a365045c61a2
    type: start
    task:
      id: d8403573-b211-4d44-885c-a365045c61a2
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 280,
          "y": 1540
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: 77fd3720-3d21-4ffb-8f78-e6b62e5a5eb6
    type: condition
    task:
      id: 77fd3720-3d21-4ffb-8f78-e6b62e5a5eb6
      version: -1
      name: Is Gmail enabled?
      description: Returns 'yes' if an integration brand is available. Otherwise returns 'no'.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "no":
      - "3"
      "yes":
      - "17"
    scriptarguments:
      brandname:
        simple: Gmail
    results:
    - brandInstances
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 280,
          "y": 1690
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "3":
    id: "3"
    taskid: 185c00fb-4375-4607-8b99-7538c88315bc
    type: title
    task:
      id: 185c00fb-4375-4607-8b99-7538c88315bc
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 280,
          "y": 2720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "4":
    id: "4"
    taskid: 8e8c940f-71fd-456e-8f11-fd6a450616c9
    type: regular
    task:
      id: 8e8c940f-71fd-456e-8f11-fd6a450616c9
      version: -1
      name: Retrieve the Original email from Gmail
      description: Searches for Gmail records of a specified Google user.
      script: Gmail|||gmail-search
      type: regular
      iscommand: true
      brand: Gmail
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      query:
        simple: Rfc822msgid:${inputs.MessageID}
      user-id:
        complex:
          root: inputs.UserID
    reputationcalc: 2
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 280,
          "y": 2100
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "5":
    id: "5"
    taskid: ea7b5d02-8ad9-435f-849b-d8aa29f18cdc
    type: condition
    task:
      id: ea7b5d02-8ad9-435f-849b-d8aa29f18cdc
      version: -1
      name: Was the original email retrieved?
      description: Verifies there is a Gmail email object in the context.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      "yes":
      - "15"
      - "13"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: Gmail
                accessor: ID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 510,
          "y": 2280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: 9384d956-2f69-4882-852d-6c86a0060ee3
    type: regular
    task:
      id: 9384d956-2f69-4882-852d-6c86a0060ee3
      version: -1
      name: Get attachments of the original email
      description: Retrieves the attachments of the original email from Gmail.
      script: Gmail|||gmail-get-attachments
      type: regular
      iscommand: true
      brand: Gmail
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      message-id:
        complex:
          root: Gmail
          accessor: ID
      user-id:
        complex:
          root: Gmail
          accessor: Mailbox
      user-key:
        complex:
          root: OriginalEmail
          accessor: Mailbox
    reputationcalc: 2
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 280,
          "y": 2450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 7d541973-de31-41bd-89ae-70c3869b01de
    type: regular
    task:
      id: 7d541973-de31-41bd-89ae-70c3869b01de
      version: -1
      name: Set output
      description: Sets the playbook outputs to context.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      key:
        simple: Email
      value:
        simple: '${Gmail={Subject: val[''Subject''], To: val[''To''], From: val[''From''], Text: val[''Body''], HTML: val[''Html''], Headers: val[''Headers''], CC: val[''CC''], BCC: val[''BCC'']}}'
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 737.5,
          "y": 2450
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "17":
    id: "17"
    taskid: 67c1298f-d944-4a7f-83db-45f260e9977d
    type: condition
    task:
      id: 67c1298f-d944-4a7f-83db-45f260e9977d
      version: -1
      name: Verify Playbook Inputs
      description: Verifies the playbook inputs.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "3"
      Inputs-Exist:
      - "4"
    separatecontext: false
    conditions:
    - label: Inputs-Exist
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.MessageID
            iscontext: true
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.UserID
            iscontext: true
    view: |-
      {
        "position": {
          "x": 280,
          "y": 1890
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1245,
        "width": 837.5,
        "x": 280,
        "y": 1540
      }
    }
  }
inputs:
- key: MessageID
  value: {}
  required: false
  description: The original email message ID to retrieve. Holds the value of the "Message-ID" header of the original email and not Gmail's internal ID of the message.
  playbookInputQuery:
- key: UserID
  value: {}
  required: false
  description: The email address of the authenticated user to fetch the original email for. For gmail, the authenticated user.
  playbookInputQuery:
outputs:
- contextPath: Email
  description: The email object
  type: string
- contextPath: Email.To
  description: The email recipient.
  type: string
- contextPath: Email.From
  description: The email sender.
  type: string
- contextPath: Email.CC
  description: The email CC address.
  type: string
- contextPath: Email.BCC
  description: The email BCC address.
  type: string
- contextPath: Email.HTML
  description: The HTML of the email.
  type: string
- contextPath: Email.Body
  description: The email text body.
  type: string
- contextPath: Email.Headers
  description: The email headers.
  type: string
- contextPath: Email.Subject
  description: The email subject.
  type: string
- contextPath: File
  description: The original attachments.
  type: string
tests:
- Get Original Email - Gmail v2 - test
fromversion: 6.0.0
supportedModules:
- agentix
- xsiam