Check with your sales engineer for guidance on using integrations. I linked mine above. I'm unsure when Resilient will update their version.
As for msg to eml, this is possible if you build a function to do this. We have this planned in our Resilient development roadmap, and will publish it when we do (unless Resilient devs beat us to the punch!).
These resources may be useful if you plan to do it youself, and are what we will use when the time comes:
Original Message:
Sent: Wed July 31, 2019 11:30 AM
From: Jérôme PAQUET
Subject: Email Header Validation output Change request
Hi team
How can I download and integrate this utility on my environment ? Where can I download it ?
Also, is it possible to add the support for .msg file ?
Thanks for your help.
------------------------------
Jérôme PAQUET
Original Message:
Sent: Thu July 18, 2019 08:50 AM
From: Shane Curtin
Subject: Email Header Validation output Change request
Hi Benoit,
We currently have a new version of fn_utilities under development and it will include updates to the Utilities: Email Parse function.
This function takes a .eml attachment and parses it.
Here is a sample output of the updated function:
results = { 'inputs': { 'incident_id': 2095, 'attachment_id': 8, 'utilities_parse_email_attachments': True }, 'metrics': { 'package': 'unknown', 'timestamp': '2019-07-17 16:38:18', 'package_version': 'unknown', 'host': 'xxx.ie.ibm.com', 'version': '1.0', 'execution_time_ms': 2132 }, 'success': True, 'content': { 'body': 'After reviewing your profile with our management, we are pleased to...', 'received': [{ 'from': 'info@example.com', 'by': 'exmaple.com Postfix', 'delay': 0, 'date_utc': '2017-11-16T05:48:58', 'hop': 1, 'date': 'Thu, 16 Nov 2017 13:48:58 +0800 SGT', 'with': 'ESMTPSA', 'id': '80EABD601B2' }, { 'from': 'example.com unknown x.x.x.x', 'by': 'secure1.example.com Postfix', 'delay': 78.0, 'date_utc': '2017-11-16T05:50:16', 'hop': 2, 'date': 'Thu, 16 Nov 2017 13:50:16 +0800 SGT', 'with': 'ESMTP', 'id': '4A2A41561A55' }, { 'from': '0.0.0.0', 'delay': 474.0, 'date_utc': '2017-11-16T05:58:10', 'hop': 3, 'date': 'Thu, 16 Nov 2017 05:58:10 +0000', 'by': 'removed' }], 'from': [ ['Monika Bakun', 'admin@example.com'] ], 'attachments': [{ 'binary': True, 'mail_content_type': 'application/msword', 'charset': None, 'filename': 'SKMBT_C201711xxxx.doc', 'content-id': '', 'content_transfer_encoding': 'base64', 'payload': 'e1xydGZIMigxMS0xMyksSHVhbm...' }], 'plain_body': '["After reviewing your profile with our management, we are pleased to..."]', 'content-type': 'multipart/mixed; boundary="===============1876313359=="', 'x-sf-rx-return-path': '<admin@example.com>', 'to_domains': ['ibm.com'], 'to': [ ['Recipients', 'joe.bloggs@ibm.com'] ], 'html_body': '["<HTML><head><meta charset=iso-8859-1\\"/></head><BODY><P>After reviewing your profile with our management, we are pleased to ...</BODY></HTML>"]', 'x-sf-helo-domain': 'secure1.example.com', 'x-sf-originating-ip': '0.0.0.0', 'date': '2017-11-16T05:49:54', 'timezone': '+0', 'mime-version': '1.0', 'has_defects': False, 'subject': 'Request For Quotation' }, 'reason': None, 'version': '1.0'}
Would the above help with your use case?
------------------------------
Shane Curtin
Integrations Engineer - IBM Resilient
Original Message:
Sent: Wed July 17, 2019 11:30 AM
From: BENOIT ROSTAGNI
Subject: Email Header Validation output Change request
Hi,
The current output « results » does not contain the necessary information for our usage. We would like to get from a similar or an upgraded function the following:
- Sender
- Receivers
- Ip sender
- Ip receiver
- Hostname sender
- Hostname receiver
- Reply-to
- Full Text Header to do further regexp check in other process ;
Could it be possible ?
The current Output is:
results = {
"dkim_verify": dkim_results,
"arc_verify": arc_results[0] == 'pass',
"dkim_message": dkim_message,
"arc_message": arc_results[2]
}
------------------------------
BENOIT ROSTAGNI - IBM Resilient
------------------------------