I have a simple playbook to search an Endpoint and output the result to the incident note. Is there an easy way to send the same output to email? I have the Outlook Email App installed and trying to get an idea of what needs to be done to send the output via email. I already configured the Outlook app to point to a mail relay doesn't require authentication.
***Here is the output_to_notes script****
import json
import re
# Load data retrieved from HX Find Host functions
results = playbook.functions.results.find_host_result
# Convert data to JSON serialized format
data = json.dumps(results)
# Check if there are any entries
if results and 'content' in results and 'data' in results['content'] and 'entries' in results['content']['data'] and len(results['content']['data']['entries']) > 0:
# Get field values
entry = results['content']['data']['entries'][0]
hostname_value = entry.get('hostname')
domain_value = entry.get('domain')
agent_version_value = entry.get('agent_version')
primary_ip_address_value = entry.get('primary_ip_address')
primary_mac_value = entry.get('primary_mac')
last_audit_timestamp_value = entry.get('last_audit_timestamp')
last_poll_timestamp_value = entry.get('last_poll_timestamp')
initial_agent_checkin_value = entry.get('initial_agent_checkin')
product_name_value = entry['os'].get('product_name')
alerts_value = str(entry['stats'].get('alerts'))
total_value = results['content']['data']['total']
# Write field data value to Incident Note
if total_value != 0:
incident.addNote(helper.createPlainText("Hostname: " + str(hostname_value) + '\n' +
"Domain: " + str(domain_value) + '\n' +
"Agent Version: " + str(agent_version_value) + '\n' +
"Primary IP: " + str(primary_ip_address_value) + '\n' +
"Primary MAC: " + str(primary_mac_value) + '\n' +
"OS: " + str(product_name_value) + '\n' +
"Last Audit Timestamps: " + str(last_audit_timestamp_value) + '\n' +
"Last Poll Timestamp: " + str(last_poll_timestamp_value) + '\n' +
"Initial Agent Check-in: " + str(initial_agent_checkin_value) + '\n' +
"Number of Alerts: " + str(alerts_value)))
else:
incident.addNote(helper.createPlainText("Not Found"))
else:
incident.addNote(helper.createPlainText("No Trellix Endpoint Found from search: " + artifact.value))
------------------------------
Raymond Tam
------------------------------