IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  JINJA Templates for Outbound email

    Posted Wed May 20, 2020 08:42 AM

    I installed the newest version of the outbound email app and finally have it running with no errors.  My question is where do the "Jinja Templates" get placed so they are read by the app?

    I have the circuit installed on my laptop for Dev purposes and just can't get these templates to be read at all.  Any help is greatly appreciated.

    Thanks,

    Brian



    ------------------------------
    Brian Coleman
    ------------------------------


  • 2.  RE: JINJA Templates for Outbound email

    Posted Thu May 21, 2020 08:38 AM

    Hi Brian, 
    Thank you for raising this in the community. 

    I downloaded the fn_outbound_email app version 1.0.9 to take a look at the code and have this info: 
    The outbound email app uses an app.config value called 'template_file' which is used to specify the location of your Jinja template. On the send email function there is conditional logic so that if a template path is provided and the 'mail_body_text' input is empty the app will open and read the file at the provided path. 

    There is then another conditional check and if the name of the file is not 'example_send_email.jinja' the value of the input 'mail_body_html' is replaced with the contents of the Jinja template. Finally the template is rendered with the provided incident_data and other function inputs. 

    There is an 'example_send_email.jinja' file located in the data folder of the integration which shows how the default email message is rendered. 

    Here is a snippet from the app showing the conditional logic for that app.config value : 

    if self.template_file_path and not mail_body_text:
                    with open(self.template_file_path, "r") as definition:
                        mail_body_html = definition.read()
                        log.info("Using custom jinja template instead of default, path: %s", self.template_file_path)
                        if definition.name.find("example_send_email.jinja") == -1:
                            jinja = False
                        else:
                            jinja = True


    I will chat with my team to see if we can promote the outbound email code to our public repo. 

    If this is what you're looking for could you 'Recommend' the answer so others can find this info in future. 
    Let me know if you have any other questions,
    Ryan 



    ------------------------------
    Ryan Gordon
    Security Software Engineer
    IBM
    ------------------------------



  • 3.  RE: JINJA Templates for Outbound email

    Posted Thu May 21, 2020 10:50 AM
    Thanks Ryan.  Any idea how i can get additional data beyond the incident level fields into the template?  I would like to add artifacts as well, maybe even data from a specific data table.

    ------------------------------
    Brian Coleman
    ------------------------------



  • 4.  RE: JINJA Templates for Outbound email

    Posted Thu May 21, 2020 11:22 AM
    You're welcome. To get additional data other than incident level fields a modification will be needed on the 
    SendSMTPEmail class which is in lib/smtp_mailer.py. 
    At the moment only 1 API call is made to gather the incident fields and 1 more call to get attachments but other types such as artifacts and data tables could be done in a similar way. 

    If your keen to get this data an API call can be made to this endpoint for artifact data: 
    /orgs/{org_id}/incidents/{inc_id}/artifacts

    And another to this endpoint for the data table that you want:
    /orgs/{org_id}/incidents/{inc_id}/table_data/{table_id}

    Alternatively if you prefer you could submit a feature request for these things as outbound email is a supported app


    ------------------------------
    Ryan Gordon
    Security Software Engineer
    IBM
    ------------------------------



  • 5.  RE: JINJA Templates for Outbound email

    Posted Tue October 20, 2020 09:30 AM

    Team - I am finally getting back to this and after i have installed the app, i don't see the folders for the Jinja templates.  My app config is:

    # The integration will use this template out of the box. If removed, it will default to the pre-processing script.
    template_file=jinja_templates/activity_summary.jinja

    Where exactly should that "jinja_templates" folder be located?  I am currently on a Windows circuit.

    Also, any other Jinja examples you can share?



    ------------------------------
    Brian Coleman
    ------------------------------



  • 6.  RE: JINJA Templates for Outbound email

    Posted Fri December 18, 2020 08:04 AM

    Ryan, any idea on this outbound email how to remove or comment out the addition of any attachments to the incident?  I have the script working properly, but then when i run it on an incident with attachments, all the attachments are on the outbound email.

    Any ideas?



    ------------------------------
    Brian Coleman
    ------------------------------



  • 7.  RE: JINJA Templates for Outbound email

    Posted Fri December 18, 2020 08:22 AM

    Disregard, found it.  Its in the send_email and smtp_mailer scripts.



    ------------------------------
    Brian Coleman
    ------------------------------