Replying to an Email using a Playbook

[vidurasupun]

Hi All,

I need to automate customer follow ups using XSOAR. My requirements are as below.

• Listen to emails and create incidents for each sent email - EWS V2 is being used for this
• Once the initial mail is sent XSOAR will follow up with the customer sending replies to the initial email
• If customer replies, XSOAR will notify the analyst.

I'm stuck on the last two steps, I was thinking of using email communication content pack. But that seems to require manual reply from the incident, not fully automated.

Very grateful if someone has insight into this.

Regards,

Vidura

[chrking]

Does the email reply from XSOAR need to be strictly a reply to the original email?

If not, using an (email) data collection task for this the simplest and easiest way to achieve this.

[vidurasupun]

Hi, 

Thank you for the response, I already have few data collection tasks. But here what I need to take away is following up in emails as a reply according to the SLA. As an example if I have an email saying 

HI,

Incident on XXX.

XSOAR will send a reply to that email in 3 days 

Hi,

Reminder.

------

Hi,

Incident XXX

If someone reply to that Analyst will take over the Ticket. Until then Dbot will handle replies.

Regards,

Vidura

[chrking · Accepted solution]

OK, so for this it sounds like you'll want to use pieces out of the Email Communication pack.

When using the SendEmailReply automation (instead of just send-mail), this includes a thread ID in the message. The PreprocessEmail script from the same pack is configured as a Pre-Process Rule will then look for this thread ID on new incoming emails and where it finds one, match it with an existing incident and update that incident with the new information.

In your case, it sounds like instead of (or as well as) updating the incident, you want to change the owner of the original incident or  notify an analyst or something similar. You'd need to extend the PreprocessEmail script for this extra part.

Whereas in the default Email Communications pack use case the SendEmailReply command would be executed by an analyst using a layout/button, you'll want to run SendEmailReply from the playbook automatically.