Replying to an Email using a Playbook

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Replying to an Email using a Playbook

L2 Linker

Hi All,


I need to automate customer follow ups using XSOAR. My requirements are as below.


  • Listen to emails and create incidents for each sent email - EWS V2 is being used for this
  • Once the initial mail is sent XSOAR will follow up with the customer sending replies to the initial email
  • If customer replies, XSOAR will notify the analyst.

I'm stuck on the last two steps, I was thinking of using email communication content pack. But that seems to require manual reply from the incident, not fully automated.


Very grateful if someone has insight into this.





L3 Networker

Does the email reply from XSOAR need to be strictly a reply to the original email?


If not, using an (email) data collection task for this the simplest and easiest way to achieve this.



Thank you for the response, I already have few data collection tasks. But here what I need to take away is following up in emails as a reply according to the SLA. As an example if I have an email saying 



Incident on XXX.


XSOAR will send a reply to that email in 3 days 







Incident XXX


If someone reply to that Analyst will take over the Ticket. Until then Dbot will handle replies.




OK, so for this it sounds like you'll want to use pieces out of the Email Communication pack.


When using the SendEmailReply automation (instead of just send-mail), this includes a thread ID in the message. The PreprocessEmail script from the same pack is configured as a Pre-Process Rule will then look for this thread ID on new incoming emails and where it finds one, match it with an existing incident and update that incident with the new information.


In your case, it sounds like instead of (or as well as) updating the incident, you want to change the owner of the original incident or  notify an analyst or something similar. You'd need to extend the PreprocessEmail script for this extra part.


Whereas in the default Email Communications pack use case the SendEmailReply command would be executed by an analyst using a layout/button, you'll want to run SendEmailReply from the playbook automatically.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!