commonfields:
  id: IdentifyAttachedEmail
  version: -1
name: IdentifyAttachedEmail
script: ''
type: python
subtype: python3
tags:
- phishing
- email
- Condition
comment: Identify whether the incident includes an email message attached as an eml or msg file and return the answer to playbook. Also saves the identified entry ID to context for use for later. Commonly used in automated playbooks that handle phishing reports sent to a special phishing mailbox set up by the security team.
enabled: true
args:
- name: entryid
  description: Specific entryid to check if it is an email attachment. If not specified will check all entries of the incident.
  isArray: true
outputs:
- contextPath: yes
  description: If incident contains an email attachment.
- contextPath: no
  description: If incident does not contain an email attachment.
- contextPath: reportedemailentryid
  description: The entry IDs of the email attachments found.
  type: String
system: true
scripttarget: 0
dependson: {}
timeout: 0s
tests:
- Process Email - Generic - Test - Incident Starter
- Phishing v2 - Test - Incident Starter
fromversion: 5.0.0
dockerimage: demisto/python3:3.12.13.10404775