getting ERROR while fetching username from the email header

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

getting ERROR while fetching username from the email header

L2 Linker

Hi,

 

I am using this below-attached snapshot configuration to get the username from the email header. while running the playbook , it's capturing the output in the context data but also giving the ERROR:

 

Execution paused, waiting for manual input #364: Get User DisplayName Missing argument value for script Set at Task Get User DisplayName (#364) - stopping Phishing playbook .

 

Can anyone for this?

7 REPLIES 7

L4 Transporter

Hi @Asmita.Asmita ,

 

I think you forgot to add the screenshot. Could you please add it?

email_Headers_ error.jpg

L4 Transporter

Hi @Asmita.Asmita ,

 

Can you share the value of that field by obfuscating the username? I believe the delimiter should be @ instead of <. It worked for me when I use the @ but I got the same error with < as it does not exist in that field

gyldz_0-1691492578780.png

 

Hi @gyldz ,

 

Thanks. I made the changes as you suggested but still facing the same issue.

Missing argument value for script Set at Task Get User DisplayName (#365) - stopping playbook Phishing Handling execution)

AsmitaAsmita_0-1691550441348.png

 

L4 Transporter

Hi @Asmita.Asmita ,

 

Can you also paste the value for the Email.HeadersMap.to. You can obfuscate the username part. It would help to see the structure of the context.

Hi @gyldz ,

 

will this snapshot works for you?

AsmitaAsmita_0-1691632097749.png

Workflow of the Playbook:

 

1. Acknowledge Incident is Received
2. Get Reporter AD Account Info
a. Check Is input is valid
If NO, Playbook Complete
-If YES,  Then check Is the source from Valid Email ID(abc123@XYZ.com)
i. If Yes, Then Parse mail sample(.eml and .msg)
ii. Quering from AD to get the user information(User Email address, User DisplayName.
iii. Then Complete the Playbook.
 
 
ELSE,   AD Query to User Info by ad-search (Active Directory Query v2) using FILTER: (&(objectcategory=User)(mail=${inputs.emailAddress}))
 
i. {Extract from mail Header instead}
Get User Mail Address & Get User DisplayName(error: Missing argument value for script Set at Task Get User DisplayName (#365) - stopping playbook Phishing Handling execution
 
ii. Start User Info Enrichment(This step is completely not working)
Get User Email Address & Get User DisplayName & Get User Manger & Get User Office Location & Get User Site Location, Get User Last Password Reset Date

L5 Sessionator

Hi @Asmita.Asmita, I think regex might help you better. Screenshot below, showing different transformers used in sequence. You do not need to use all, just stop where the data meets your exact requirements. Text after the arrow shows data output. 

 

Screenshot 2023-08-11 at 8.10.54 am.png

 

Please note that the ParseEmailFileV2 command generates other keys that might contain the information you require. You might find a better format under ${Email.To}

  • 1589 Views
  • 7 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!