topic Re: getting ERROR while fetching username from the email header in Cortex XSOAR Discussions

getting ERROR while fetching username from the email header

Asmita.Asmita — Mon, 07 Aug 2023 10:05:57 GMT

Hi,

I am using this below-attached snapshot configuration to get the username from the email header. while running the playbook , it's capturing the output in the context data but also giving the ERROR:

Execution paused, waiting for manual input #364: Get User DisplayName Missing argument value for script Set at Task Get User DisplayName (#364) - stopping Phishing playbook .

Can anyone for this?

Re: getting ERROR while fetching username from the email header

gyldz — Mon, 07 Aug 2023 12:35:51 GMT

Hi @Asmita.Asmita ,

I think you forgot to add the screenshot. Could you please add it?

Re: getting ERROR while fetching username from the email header

Asmita.Asmita — Tue, 08 Aug 2023 00:58:21 GMT

Re: getting ERROR while fetching username from the email header

gyldz — Tue, 08 Aug 2023 11:03:20 GMT

Hi @Asmita.Asmita ,

Can you share the value of that field by obfuscating the username? I believe the delimiter should be @ instead of <. It worked for me when I use the @ but I got the same error with < as it does not exist in that field

Re: getting ERROR while fetching username from the email header

Asmita.Asmita — Wed, 09 Aug 2023 03:16:17 GMT

Hi @gyldz ,

Thanks. I made the changes as you suggested but still facing the same issue.

(Execution paused, waiting for manual input

#365: Get User DisplayName

Missing argument value for script Set at Task Get User DisplayName (#365) - stopping playbook Phishing Handling execution)

Re: getting ERROR while fetching username from the email header

gyldz — Wed, 09 Aug 2023 07:30:04 GMT

Hi @Asmita.Asmita ,

Can you also paste the value for the Email.HeadersMap.to. You can obfuscate the username part. It would help to see the structure of the context.

Re: getting ERROR while fetching username from the email header

Asmita.Asmita — Thu, 10 Aug 2023 02:37:18 GMT

Hi @gyldz ,

will this snapshot works for you?

Workflow of the Playbook:

1. Acknowledge Incident is Received

2. Get Reporter AD Account Info

a. Check Is input is valid

If NO, Playbook Complete

-If YES, Then check Is the source from Valid Email ID(abc123@XYZ.com)

i. If Yes, Then Parse mail sample(.eml and .msg)

ii. Quering from AD to get the user information(User Email address, User DisplayName.

iii. Then Complete the Playbook.

ELSE, AD Query to User Info by ad-search (Active Directory Query v2) using FILTER: (&(objectcategory=User)(mail=${inputs.emailAddress}))

i. {Extract from mail Header instead}

Get User Mail Address & Get User DisplayName(error: Missing argument value for script Set at Task Get User DisplayName (#365) - stopping playbook Phishing Handling execution

ii. Start User Info Enrichment(This step is completely not working)

Get User Email Address & Get User DisplayName & Get User Manger & Get User Office Location & Get User Site Location, Get User Last Password Reset Date

Re: getting ERROR while fetching username from the email header

jfernandes1 — Thu, 10 Aug 2023 22:22:56 GMT

Hi @Asmita.Asmita, I think regex might help you better. Screenshot below, showing different transformers used in sequence. You do not need to use all, just stop where the data meets your exact requirements. Text after the arrow shows data output.

Please note that the ParseEmailFileV2 command generates other keys that might contain the information you require. You might find a better format under ${Email.To}