Send Email

LAST UPDATED: FEB 27, 2024

Sends out a system email with email recipients, subject and body.

Implementation	System
Command Category	System Utility
Tags	COMMUNICATION EMAIL

Inputs

Parameter Name	Required/Optional	Description	Sample Data
To Addresses	Optional	The email addresses of recipients, separated by “,”.	`user01@example.com, user02@example.com`
Subject	Optional	Introductory line that contains a brief summary of the email's contents.	`This is a test email`
Email Body	Optional	The main content of the email.	`<p>Hi,</p><p>This is a test email</p><p> </p><p>regards</p>`
Reply Mode	Optional	The mode to determine if this email requires a response or approval.	`Require Approval`
Reply Due Time	Optional	The duration of time (in minutes) to wait for a reply.	`100`
CC	Optional	cc, separated by “,”.	`lling@d3security.com`
BCC	Optional	bcc.	`mmeng@d3security.com`
File Source	Optional	Incident Attachment: Manually uploaded file from Incident Workspace \| Playbook File: Output from another Task \| Artifact File: Ingested Artifact in an Event	`IR Attachment`
File Id	Optional	Choose file path according to file source.	`1`

Output

Key Fields

Important key-value pairs extracted from Raw Data.

SAMPLE DATA

JSON

{
  "SentTime": "2020-05-27 20:16:01 UTC",
  "DueTime": "2020-05-27 21:56:01 UTC",
  "ReplyMode": "RequireApproval",
  "SentCount": 2,
  "State": "Sent",
  "ToAddresses": [
      "user01@example.com",
      "user02@example.com"
  ]
}

Return Data

The returned result of this command. If some required parameters are not defined, this returned data could be empty. The returned result can be passed down directly to a subsequent command in playbooks.

SAMPLE DATA

JSON

Succeed

Context Data

The response data from the utility command.

SAMPLE DATA

JSON

{
    "sentTime": "2020-05-27 20:08:14 UTC",
    "dueTime": "2020-05-27 21:48:14 UTC",
    "replyMode": "RequireApproval",
    "sent_count": 2,
    "state": "Sent",
    "to": [
        {
            "email": "user01@example.com",
            "sent": true,
            "error": ""
        },
        {
            "email": "user02@example.com",
            "sent": true,
            "error": ""
        }
    ]
}

Remote Command API

The D3 command API allows you to send requests to D3 SOAR to execute this utility command via REST API.

Request

POST

CODE

https:/{base_url}/{api_namespace}/api/Command/SendEmail

Headers

Please refer to the page Webhook Configuration Guide - Authentication Method: API Keys for more details.

Request Body

JSON

{
  "Username": "<Username here>",
  "Site": "<Site here>",
  "CommandParams": {
    "To Addresses": "<To Addresses here>",
    "Subject": "<Subject here>",
    "Email Body": "<Email Body here>",
    "Reply Mode": "<Reply Mode here>",
    "Reply Due Time": "<Reply Due Time here>",
    "CC": "<CC here>",
    "BCC": "<BCC here>",
    "File Source": "<File Source here>",
    "File Id": "<File Id here>"
  }
}

Body Parameters

Parameter Name	Type	Required/Optional	Description
Username	`String`	Required	The username of your D3 SOAR account.
Site	`String`	Required	The D3 SOAR site to run the remote command.
To Addresses	`Text`	Optional	The email addresses of recipients, separated by “,”.
Subject	`Text`	Optional	Introductory line that contains a brief summary of the email's contents.
Email Body	`Text`	Optional	The main content of the email.
Reply Mode	`Text`	Optional	The mode to determine if this email requires a response or approval.
Reply Due Time	`Number`	Optional	The duration of time (in minutes) to wait for a reply.
CC	`Text`	Optional	cc, separated by “,”.
BCC	`Text`	Optional	bcc.
File Source	`Text`	Optional	Incident Attachment: Manually uploaded file from Incident Workspace \| Playbook File: Output from another Task \| Artifact File: Ingested Artifact in an Event
File Id	`Text Array`	Optional	Choose file path according to file source.

Sample Request

SAMPLE DATA

JSON

{
  "Username": "Admin",
  "Site": "Security Operations",
  "CommandParams": {
    "To Addresses": "user01@example.com, user02@example.com",
    "Subject": "This is a test email",
    "Email Body": "
        Hi,
        
        This is a test email
        
        regards
        
        ",
    "Reply Mode": "Require Approval",
    "Reply Due Time": 100,
    "CC": "lling@d3security.com",
    "BCC": "mmeng@d3security.com",
    "File Source": "IR Attachment",
    "File Id": 1
  }
}

Response

Response Fields

Field Name	Type	Description
error	`Text`	The error message if the API request has failed.
keyFields	`JSON Array`	The key fields from the API request.
returnData	`Text`	The return data from the API request.
contextData	`JSON Object`	The context data from the API request.

Sample Response

JSON

{
    "error": "",
    "keyFields": {
      "SentTime": "2020-05-27 20:16:01 UTC",
      "DueTime": "2020-05-27 21:56:01 UTC",
      "ReplyMode": "RequireApproval",
      "SentCount": 2,
      "State": "Sent",
      "ToAddresses": [
          "user01@example.com",
          "user02@example.com"
      ]
    },
    "returnData": "Succeed",
    "contextData": {
      "sentTime": "2020-05-27 20:08:14 UTC",
      "dueTime": "2020-05-27 21:48:14 UTC",
      "replyMode": "RequireApproval",
      "sent_count": 2,
      "state": "Sent",
      "to": [
          {
              "email": "user01@example.com",
              "sent": true,
              "error": ""
          },
          {
              "email": "user02@example.com",
              "sent": true,
              "error": ""
          }
      ]
    }
}