IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Inbound Email Connections with O365 mailbox

    Posted 2 days ago

    Has anyone successfully configured "Inbound Email Connections" using an O365 mailbox with any of the supported protocols?

    If so, could you please share a sample configuration? I've reviewed all three protocol options, but not able to identify a suitable solution so far:

    • Exchange Protocol: This appears to use EWS, which is not enabled in our environment. Additionally, Microsoft is planning to retire EWS soon, so this doesn't seem like a viable long-term solution.

    • IMAP Protocol: IMAP is not allowed in our organization, so this option is not applicable.

    • OAuth Protocol: This seems like the most promising option, but I'm unclear how  it works and which endpoint should be used for configuration.



    ------------------------------
    Raymond Tam
    ------------------------------


  • 2.  RE: Inbound Email Connections with O365 mailbox

    Posted yesterday

    I think the first thing to say is we use the EWS API for O365 regardless of the authentication protocol used.

    We understand its due to be removed by Microsoft in October 2026 and will replace it with MS-Graph before then.

    However if its already disabled in your env, then not sure what options we have.

    As regards OAuth, have you reviewed the doc section here ? (We support both secrets and certs)

    https://www.ibm.com/docs/en/sqsp/51.0.0?topic=administrator-changed-in-51020-configuring-inbound-email-connection



    ------------------------------
    Martin Feeney
    Product Manager, IBM Security QRadar SOAR
    martin.feeney@ie.ibm.com
    ------------------------------

    Original Message


  • 3.  RE: Inbound Email Connections with O365 mailbox

    Posted 22 hours ago
    Thanks for explaining the OAuth still needs to use the EWS API Endpoint.  Good to hear that there is a plan to support MS-Graph.

    In my current situation, it doesn't sound like the Inbound email is a feasible option.  Hope the MS-Graph option will be available soon.

    Meanwhile, I will look into other ways as a trigger for the SOAR incident creation.

    If anyone in the forum has any creative ideas or workaround, please share.


    Thanks,
    Ray



    Original Message


Related Content