Extract Basic Information from Email File
LAST UPDATED: AUG 07, 2024
Extracts basic information such as Sender and Recipient from an email file specified by File ID
Implementation | System |
Command Category | Cyber Utility |
Tags | EMAIL CONDITION ARTIFACT |
Inputs
Parameter Name | Required/Optional | Description | Sample Data |
---|---|---|---|
File ID | Required | The File ID in Playbook | 238 |
Output
Remote Command API
The D3 command API allows you to send requests to D3 SOAR to execute this utility command via REST API.
Request
POST
https:/{base_url}/{api_namespace}/api/Command/ExtractBasicInfoFromEmailFile
Headers
Please refer to the page Webhook Configuration Guide - Authentication Method: API Keys for more details.
Request Body
{
"Username": <Username here>,
"Site": <Site here>,
"CommandParams": {
"File ID": <File ID here>
}
}
Body Parameters
Parameter Name | Type | Required/Optional | Description |
---|---|---|---|
Username |
| Required | The username of your D3 SOAR account. |
Site |
| Required | The D3 SOAR site to run the remote command. |
File ID |
| Required | The File ID in Playbook |
Sample Request
SAMPLE DATA
{
"Username": "Admin",
"Site": "Security Operations",
"CommandParams": {
"File ID": 238
}
}
Response
Response Fields
Field Name | Type | Description |
---|---|---|
error |
| The error message if the API request has failed. |
returnData |
| The return data from the API request. |
contextData |
| The context data from the API request. |
Sample Response
{
"error": "",
"returnData": "Succeed",
"contextData": {
"Size": 748,
"Sender": "\"Zhan\" <jzhan@d3security.com>",
"Recipient": "\"Zhan\" <jzhan@d3security.com>",
"CCRecipient": "",
"BCCRecipient": "",
"ReplyTo": "",
"Subject": "Welcome to use SOAR30",
"ReceivedTime": "12/30/1899 12:00:00 AM",
"SentTime": "2020-05-27T21:45:53",
"BodyPartCharset": "",
"BodyPartContentTransferEncoding": "7bit",
"HTMLBodyPartCharset": "UTF-8",
"TextBody": "Hi All,\r\n\r\nWelcome to use D3 SOAR30.\r\n\r\nThank you.\r\n\r\nD3 Security\r\n",
"HTMLBody": "<div dir=\"ltr\">Hi All,<div><br></div><div>Welcome to use D3 SOAR30.</div><div><br></div><div>Thank you.</div><div><br></div><div>D3 Security</div></div>\r\n",
"AttachmentsCount": "0",
"AttachmentsNames": "Welcome to use SOAR30.eml",
"EmailClientIp": []
}
}