topic Re: Parse email attaachement using EWS V2 Extension in Cortex XSOAR Discussions

Parse email attaachement using EWS V2 Extension

adelbenjemaa — Tue, 14 Feb 2023 17:26:52 GMT

Hi all,
actually i am configuring an abuse email box that will receive all email that are suspected to be a phishing email,
actually when we send the suspected email as en EML attachement to the abuse email box that is alredy configured via EWS instance, we cannot find the orginial message parsed via mapping editor,
we only find the attachement file name like mentionned in the capture and the content of the eml file as a value for the 'mime_conent' key (not parsed) ,
so how we can make modification of the contextual data, to add the attachement email info (sender recepient , content etc .. ) to the json data

thanks,

Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.

Re: Parse email attaachement using EWS V2 Extension

chrking — Wed, 15 Feb 2023 01:58:55 GMT

There's a pre-built playbook, "Process Email - Generic v2" from the Phishing pack which has logic for this that might be useful for reference. In the end, that's basically a fancy wrapper for the ParseEmailFiles automation so if that playbook is too far away from what you need you could always use the automation directly.

Re: Parse email attaachement using EWS V2 Extension

adelbenjemaa — Wed, 15 Feb 2023 10:26:44 GMT

Hi Chrkin,
thanks for your feedback, actually i am testing this playbook, but i face a problem with Set commande, i face this error:

---- Error Message

DBot
February 15, 2023 11:23 AM
Scripts returned an error
#44: Set reported email origin (attached)
Command:
!Set key="ReportedEmailOrigin" value="Attached" stringify="false"
Reason
Error from Scripts is : Script failed to run: open /usr/local/demisto/res/_script_template.js: no such file or directory (2603)

----

i think that there is a misconfiguration or incompatibility with Set Commande,
i there any workaround?
i test the same commande in another playbook, but always i face the same problem,
you find the error in the screenshot

regards,

Re: Parse email attaachement using EWS V2 Extension

chrking — Thu, 16 Feb 2023 00:24:37 GMT

This looks like an issue with your installation, rather than anything wrong with the automation/playbook itself. I'd suggest checking out your /usr/local/demisto/res directory to make sure that it (and the referenced file) still exists, and that the demisto group has ownership of these files.

Re: Parse email attaachement using EWS V2 Extension

adelbenjemaa — Thu, 16 Feb 2023 14:39:33 GMT

Hi Chrking,
i already check it, the file does not exist, i will open a case, do you know this package "demisto" is it related to specific module that need to be reinstalled?
regards,

Re: Parse email attaachement using EWS V2 Extension

chrking — Fri, 17 Feb 2023 01:35:57 GMT

"demisto" is the previous name for XSOAR, before it was acquired by Palo Alto. It's still used in lots of places. The _script_template files are part of the base install and not any marketplace package AFAIK.