Check Email Authenticity
LAST UPDATED: NOV 5, 2024
Checks email authenticity based on raw email data.
Implementation | System |
Command Category | Cyber Utility |
Tags | ARTIFACT EMAIL |
Inputs
Parameter Name | Required/Optional | Description | Sample Data |
---|---|---|---|
Raw Email Data | Required | Raw data of an email |
TEXT
|
Output
Remote Command API
The D3 command API allows you to send requests to D3 SOAR to execute this utility command via REST API.
Request
POST
https:/{base_url}/{api_namespace}/api/Command/EmailAuthenticityCheck
Headers
Please refer to the page Webhook Configuration Guide - Authentication Method: API Keys for more details.
Request Body
{
"Username": <Username here>,
"Site": <Site here>,
"CommandParams": {
"Raw Email Data": <Raw Email Data here>
}
}
Body Parameters
Parameter Name | Type | Required/Optional | Description |
---|---|---|---|
Username |
| Required | The username of your D3 SOAR account. |
Site |
| Required | The D3 SOAR site to run the remote command. |
Raw Email Data |
| Required | The raw data of an email. |
Sample Request
SAMPLE DATA
{
"Username": "Admin",
"Site": "Security Operations",
"CommandParams": {
"Raw Email Data": "MIME-Version: 1.0\r\nReceived: from user01@example.com 2603:10b6:a03:1a0::47 by 2002:a19:4845:0:0:0:0:0 with HTTP; Thu, 28 May 2020 12:19:28 -0700 (PDT)\r\nFrom: user01 \r\nDate: Thu, 28 May 2020 12:19:28 -0700\r\nMessage-ID: \r\nSubject: Test Send Email\r\nTo: user09 \r\nContent-Type: multipart/alternative; boundary=\"0000000000001d2c8705a6ba354a\"\r\n\r\nHello everyone,\r\nThis is a test email"
}
}
Response
Response Fields
Field Name | Type | Description |
---|---|---|
error |
| The error message if the API request has failed. |
keyFields |
| The key fields from the API request. |
returnData |
| The return data from the API request. |
contextData |
| The context data from the API request. |
Sample Response
{
"error": "",
"keyFields": {
"Dkim": "Unknown",
"Dmarc": "Unknown",
"Spf": "Unknown"
},
"returnData": "Succeed",
"contextData": {
"spf": {
"Type": "spf",
"Validation-Result": "Unknown",
"Sender-IP": "Unknown",
"Reason": "Unknown"
},
"dkim": {
"Type": "dkim",
"Validation-Result": "Unknown",
"Signing-Domain": "Unknown",
"Reason": "Unknown"
},
"dmarc": {
"Type": "dmarc",
"Validation-Result": "Unknown",
"Tags": "Unknown",
"Signing-Domain": "Unknown"
}
}
}