getting ERROR while fetching username from the email header

[Asmita.Asmita]

Hi,

I am using this below-attached snapshot configuration to get the username from the email header. while running the playbook , it's capturing the output in the context data but also giving the ERROR:

Execution paused, waiting for manual input #364: Get User DisplayName Missing argument value for script Set at Task Get User DisplayName (#364) - stopping Phishing playbook .

Can anyone for this?

[gyldz]

Hi @Asmita.Asmita ,

I think you forgot to add the screenshot. Could you please add it?

[Asmita.Asmita]

[gyldz]

Hi @Asmita.Asmita ,

Can you share the value of that field by obfuscating the username? I believe the delimiter should be @ instead of <. It worked for me when I use the @ but I got the same error with < as it does not exist in that field

[Asmita.Asmita]

Hi @gyldz ,

Thanks. I made the changes as you suggested but still facing the same issue.

(Execution paused, waiting for manual input

#365: Get User DisplayName

Missing argument value for script Set at Task Get User DisplayName (#365) - stopping playbook Phishing Handling execution)

[gyldz]

Hi @Asmita.Asmita ,

Can you also paste the value for the Email.HeadersMap.to. You can obfuscate the username part. It would help to see the structure of the context.

[Asmita.Asmita]

Hi @gyldz ,

will this snapshot works for you?

Workflow of the Playbook:

1. Acknowledge Incident is Received

2. Get Reporter AD Account Info

a. Check Is input is valid

If NO, Playbook Complete

-If YES,  Then check Is the source from Valid Email ID(abc123@XYZ.com)

i. If Yes, Then Parse mail sample(.eml and .msg)

ii. Quering from AD to get the user information(User Email address, User DisplayName.

iii. Then Complete the Playbook.

ELSE,   AD Query to User Info by ad-search (Active Directory Query v2) using FILTER: (&(objectcategory=User)(mail=${inputs.emailAddress}))

i. {Extract from mail Header instead}

Get User Mail Address & Get User DisplayName(error: Missing argument value for script Set at Task Get User DisplayName (#365) - stopping playbook Phishing Handling execution

ii. Start User Info Enrichment(This step is completely not working)

Get User Email Address & Get User DisplayName & Get User Manger & Get User Office Location & Get User Site Location, Get User Last Password Reset Date

[jfernandes1]

Hi @Asmita.Asmita, I think regex might help you better. Screenshot below, showing different transformers used in sequence. You do not need to use all, just stop where the data meets your exact requirements. Text after the arrow shows data output. 

Please note that the ParseEmailFileV2 command generates other keys that might contain the information you require. You might find a better format under ${Email.To}