topic Re: Replying to an Email using a Playbook in Cortex XSOAR Discussions

Replying to an Email using a Playbook

vidurasupun — Wed, 21 Dec 2022 04:38:53 GMT

Hi All,

I need to automate customer follow ups using XSOAR. My requirements are as below.

Listen to emails and create incidents for each sent email - EWS V2 is being used for this
Once the initial mail is sent XSOAR will follow up with the customer sending replies to the initial email
If customer replies, XSOAR will notify the analyst.

I'm stuck on the last two steps, I was thinking of using email communication content pack. But that seems to require manual reply from the incident, not fully automated.

Very grateful if someone has insight into this.

Regards,

Vidura

Re: Replying to an Email using a Playbook

chrking — Wed, 21 Dec 2022 05:08:33 GMT

Does the email reply from XSOAR need to be strictly a reply to the original email?

If not, using an (email) data collection task for this the simplest and easiest way to achieve this.

Re: Replying to an Email using a Playbook

vidurasupun — Wed, 21 Dec 2022 09:31:42 GMT

Hi,

Thank you for the response, I already have few data collection tasks. But here what I need to take away is following up in emails as a reply according to the SLA. As an example if I have an email saying

HI,

Incident on XXX.

XSOAR will send a reply to that email in 3 days

Hi,

Reminder.

------

Hi,

Incident XXX

If someone reply to that Analyst will take over the Ticket. Until then Dbot will handle replies.

Regards,

Vidura

Re: Replying to an Email using a Playbook

chrking — Thu, 22 Dec 2022 05:51:28 GMT

OK, so for this it sounds like you'll want to use pieces out of the Email Communication pack.

When using the SendEmailReply automation (instead of just send-mail), this includes a thread ID in the message. The PreprocessEmail script from the same pack is configured as a Pre-Process Rule will then look for this thread ID on new incoming emails and where it finds one, match it with an existing incident and update that incident with the new information.

In your case, it sounds like instead of (or as well as) updating the incident, you want to change the owner of the original incident or notify an analyst or something similar. You'd need to extend the PreprocessEmail script for this extra part.

Whereas in the default Email Communications pack use case the SendEmailReply command would be executed by an analyst using a layout/button, you'll want to run SendEmailReply from the playbook automatically.