IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Email Parsing Script Regex and whitelisting issues

    Posted 09/25/19 09:43 AM
    Hi Team,

    I am getting wrong artifact type of artifacts that is parsed the by the email script v2.0.0, it takes the "Mailto" parameter from the email, and create an artifact of type URL , not mail recipient.
    In addition I have tried the domain whitelisting following the example in the guide but it fails.

    ------------------------------
    UAEX Exchange
    ------------------------------


  • 2.  RE: Email Parsing Script Regex and whitelisting issues

    Posted 09/26/19 10:19 AM


    Hi UAEX,
    The Regex searches for href. If your email is in text/html and I suspect it is and you look at the email file in a text editor you'll see your signature is stored as <a href="mialto:x@y.com"/>. The script is a sample and a starting point so we wouldn't see this as a major issue and you can adapt the sample to meet your needs.

    I'm curious on the whitelist issue you're seeing. I'll need more info to investigate that one. Can you provide reproduction steps?

    Regards,

    Paddy Divilly

    ------------------------------
    PATRICK DIVILLY
    ------------------------------



Related Content