id: Get Original Email - Microsoft Graph Mail
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Get Original Email - Microsoft Graph Mail
description: |-
  This playbook retrieves the original email using the Microsoft Graph Mail integration.
  Note: You must have the necessary permissions in the Microsoft Graph Mail integration as described in the [message-get API](https://docs.microsoft.com/en-us/graph/api/message-get) and the [user-list-messages API](https://docs.microsoft.com/en-us/graph/api/user-list-messages)
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 5607d1c6-85b0-4181-8b10-bb3a5b113c6f
    type: start
    task:
      id: 5607d1c6-85b0-4181-8b10-bb3a5b113c6f
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "10"
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -20,
          "y": 160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "2":
    id: "2"
    taskid: d2eca123-db35-4b27-88d8-a8b77ffd6784
    type: title
    task:
      id: d2eca123-db35-4b27-88d8-a8b77ffd6784
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -20,
          "y": 1590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "10":
    id: "10"
    taskid: 0db04b60-0358-4214-851a-42598fa48cd3
    type: condition
    task:
      id: 0db04b60-0358-4214-851a-42598fa48cd3
      version: -1
      name: Is Microsoft Graph Mail enabled?
      description: Returns 'yes' if an integration brand is available.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "14"
    scriptarguments:
      brandname:
        simple: MicrosoftGraphMail
    results:
    - brandInstances
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -20,
          "y": 310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "11":
    id: "11"
    taskid: 8e468b02-e02c-4aeb-804c-0b73dfa0b1c8
    type: regular
    task:
      id: 8e468b02-e02c-4aeb-804c-0b73dfa0b1c8
      version: -1
      name: Search for messages by encoded MessageID
      description: Gets the properties of returned emails. Typically shows partial results. Use the "page_size" and "pages_to_pull" arguments to get all results.
      script: MicrosoftGraphMail|||msgraph-mail-list-emails
      type: regular
      iscommand: true
      brand: MicrosoftGraphMail
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      odata:
        simple: $filter=internetMessageId eq '${EncodedMessageID}'
      pages_to_pull:
        complex:
          root: inputs.PagesToPull
      user_id:
        complex:
          root: inputs.UserID
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -20,
          "y": 905
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "12":
    id: "12"
    taskid: 2775b599-4846-4049-8c4e-1e2e660f27c5
    type: condition
    task:
      id: 2775b599-4846-4049-8c4e-1e2e660f27c5
      version: -1
      name: Was a matching email found?
      description: Verifies that an email object with a message ID that matches the InReplyTo ID of the forwarded email was found.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "Yes":
      - "13"
    separatecontext: false
    conditions:
    - label: "Yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: MSGraphMail
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: MSGraphMail.InternetMessageID
                      iscontext: true
                    right:
                      value:
                        simple: inputs.MessageID
                      iscontext: true
                - - operator: isEqualString
                    left:
                      value:
                        simple: MSGraphMail.UserID
                      iscontext: true
                    right:
                      value:
                        simple: inputs.UserID
                      iscontext: true
                accessor: InternetMessageID
            iscontext: true
          right:
            value: {}
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -20,
          "y": 1090
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "13":
    id: "13"
    taskid: e2653b70-6db7-4385-8281-0c31a7b5c91c
    type: regular
    task:
      id: e2653b70-6db7-4385-8281-0c31a7b5c91c
      version: -1
      name: Get original email
      description: Retrieves an email message by message ID and uploads the content as an EML file.
      script: MicrosoftGraphMail|||msgraph-mail-get-email-as-eml
      type: regular
      iscommand: true
      brand: MicrosoftGraphMail
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      message_id:
        complex:
          root: MSGraphMail
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: MSGraphMail.InternetMessageID
                iscontext: true
              right:
                value:
                  simple: inputs.MessageID
                iscontext: true
          - - operator: isEqualString
              left:
                value:
                  simple: MSGraphMail.UserID
                iscontext: true
              right:
                value:
                  simple: inputs.UserID
                iscontext: true
          accessor: ID
          transformers:
          - operator: StripChars
            args:
              chars:
                value:
                  simple: <>
          - operator: uniq
      user_id:
        complex:
          root: inputs.UserID
    reputationcalc: 2
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -20,
          "y": 1310
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "14":
    id: "14"
    taskid: 43134294-3804-4b55-8591-9845b146370f
    type: condition
    task:
      id: 43134294-3804-4b55-8591-9845b146370f
      version: -1
      name: Verify required inputs
      description: Verifies that the required input values exist for retrieving the original email.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "15"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.UserID
            iscontext: true
          right:
            value: {}
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.MessageID
            iscontext: true
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -20,
          "y": 510
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  "15":
    id: "15"
    taskid: 062e413e-5f77-48bf-8f26-fffdaf91b333
    type: regular
    task:
      id: 062e413e-5f77-48bf-8f26-fffdaf91b333
      version: -1
      name: Set EncodedMessageID
      description: Since the MessageID may contain special characters, it should be URL encoded in order to use it in the next task.
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      key:
        simple: EncodedMessageID
      value:
        complex:
          root: inputs.MessageID
          transformers:
          - operator: URLEncode
    separatecontext: false
    continueonerrortype: ""
    view: |-
      {
        "position": {
          "x": -20,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
system: true
view: |-
  {
    "linkLabelsPosition": {
      "10_14_yes": 0.57,
      "10_2_#default#": 0.31,
      "12_13_Yes": 0.58,
      "12_2_#default#": 0.78,
      "14_2_#default#": 0.37
    },
    "paper": {
      "dimensions": {
        "height": 1495,
        "width": 380,
        "x": -20,
        "y": 160
      }
    }
  }
inputs:
- key: UserID
  value: {}
  required: false
  description: The email address of the reporting user.
  playbookInputQuery:
- key: MessageID
  value: {}
  required: false
  description: The InReplyTo header in the forwarded email.
  playbookInputQuery:
- key: PagesToPull
  value:
    simple: "10"
  required: false
  description: The number of pages of emails to return (maximum is 10 emails per page).
  playbookInputQuery:
outputs:
- contextPath: File
  description: The original email as an EML file.
  type: string
tests:
- Get Original Email - Microsoft Graph Mail - test
fromversion: 6.0.0
supportedModules:
- agentix
- xsiam