Email Classification with Subject

[vidurasupun]

I'm currently using EWSv2 to listen to emails and have a classifier as well for fixed subjects. Is there a approach that I can use to take a part of an email subject to classify emails?

As an example:

Email Subject 1: Incident#1213131 

Email Subject 2: Incident#3234234

Should be classified in "Incidents" 

[nikoolayy1]

What about the scripts https://xsoar.pan.dev/docs/reference/playbooks/process-email---generic-v2 or https://xsoar.pan.dev/docs/reference/scripts/parse-email-files (use v2 https://xsoar.pan.dev/docs/reference/scripts/parse-email-files-v2 )? They use the eml files that you should get from EWSv2 .

By just playing around and testing this should be possible.

[chrking]

In your classifier, use a transformer to extract only the part of the email subject you want to classify based on.

In this example, I have a (randomly generated demo data) username which is always a first.last name pair. The regex extracts everything after the period, and the classification options you get show only the last name.

[vidurasupun]

Thank you for the reply, however EWS instance pulls emails as incidents already so I was looking something on the preprocessor/Classifier level.

[vidurasupun]

Thank you for your reply, this was something new that I learned but what if the scenario is I have multiple formats as an example.

Email Subject 1: Incident#1213131 

Email Subject 2: Incident#3234234

Should be classified in "Incidents" 

and

Email Subject: IOCs

Should be classified as "IOC"

[chrking · Accepted solution]

Regex is the cause of, and solution to, all problems ‌‌ You can still use this technique, you'll just need a slightly more complex transformer, like the attached sample.

In the end, if you need logic that's too advanced for regex you could write your own transformer in python to output the value you need given specific input. Transformers are just Automations with specific tags to make them show up in the right places.

StripChars is a nice, simple example of a transformer included in the Filters and Transformers pack that you could use for reference if you need to go this way.

[vidurasupun]

Thanks man, you are a genius 🙂