topic Re: XSOAR Delete Messages using Graph API in Cortex XSOAR Discussions

XSOAR Delete Messages using Graph API

DennisO — Fri, 28 Apr 2023 15:57:04 GMT

I know EWS and O365 are current options for the Delete messages playbook however does anyone know it the Graph API is going to be added as an option? Due to certain restrictions I am being forced down the Graph API route for the preferred integration.

Re: XSOAR Delete Messages using Graph API

amontminy — Fri, 28 Apr 2023 17:03:56 GMT

I took a look at the marketplace and it looks like we have a few Graph API specific integrations. The O365 Outlook Mail (Using Graph API) has a mail-delete command and there is an even more generic Microsoft Graph API integration which allows you to send custom Graph API requests.

Re: XSOAR Delete Messages using Graph API

DennisO — Fri, 28 Apr 2023 17:18:09 GMT

Thanks,

I do see that as well I am just wondering if an option for the Graph API's is going to be available for the default phishing playbook. Currently when going down the malicious route for e-mail removal the only options you have (related to Microsoft) are the O365 or EWS routes both of which are able to be integrated with XSOAR but nothing for GraphMail.

Re: XSOAR Delete Messages using Graph API

amontminy — Fri, 28 Apr 2023 17:57:57 GMT

I took a quick look and didn't see anything regarding integrating it into the phishing playbook. I would recommend submitting a feature request so our product team knows it is something you are interested in. You may also be able to copy the default phishing playbook and add in another branch for the Graph API. I believe a lot of the logic will be the same as with O365 and EWS.

Re: XSOAR Delete Messages using Graph API

chrking — Mon, 01 May 2023 01:30:05 GMT

When you say "Graph Mail", are you referring to "Microsoft Graph Mail Single User" ?

Microsoft Graph Mail Single User authenticates as a single, non-admin user for the purposes of sending/receiving email. In contrast with the other integrations, it is specifically intended to be used in situations where XSOAR cannot or should not be granted admin-level privileges over the mail system.

The "Search and Delete" functionality in the phishing playbook requires admin-level privileges to search / delete from other user's mailboxes, and so it is inherently incompatible with the design goals of this integration.

Re: XSOAR Delete Messages using Graph API

amontminy — Mon, 01 May 2023 17:47:19 GMT

I think the O365 Outlook Mail (Using Graph API) might work for multiple mailboxes. I took a quick look here and there is a msgraph-mail-delete-email command which takes user and message IDs as arguments.

Re: XSOAR Delete Messages using Graph API

chrking — Tue, 02 May 2023 00:09:13 GMT

Yeah, if they need the multi-mailbox delete functionality then "O365 Outlook Mail (Using Graph API)" is definitely one way to do this. I had assumed that wasn't possible for DennisO since the original post mentioned "O365" as being something they couldn't do, but if that was a misunderstanding on my part then they should definitely check it out.

Re: XSOAR Delete Messages using Graph API

DennisO — Tue, 02 May 2023 10:56:35 GMT

Multi Mailbox solution is what I am after and it appears that creating my own Playbook for the Graph API is what I am going to do for this resolution. Thanks for all the input.