IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
Expand all | Collapse all

unable to read headers which contais "-" via Utilities: Email Parse function

  • 1.  unable to read headers which contais "-" via Utilities: Email Parse function

    Posted 05/27/19 05:41 AM
    Monitor

    Dear Team,

    I am using Utilities: Email Parse function in the workflow, in the post processing I have to extract the x-env-sender header value and need to add it as an artifact but it gives me the error below.

    Below is my script line, I am just extracting the value of different headers, it works fine if the header name doesn't contain "-"

    e.g 
    from_addr = results.headers.from 
    it will work perfectly fine

    But if the header contains "-" in the name it always gives an error 
    Orig_Sender = results.headers.x-env-sender

    Below is the error. 
    ============Error============= 
    An error occurred while processing the action acknowledgement. Additional information: Post-processing script for Function 'Utilities: Email Parse' from Workflow 'Email Attachment Analysis' was unable to complete because: mismatched input ''x-env-sender'' expecting set null


    POST script
    ============

    import re
    # The output includes:
    # - headers, a dictionary of all the headers
    # - subject
    # - body_text and body_html (depending on how the email was formatted)
    # - an array of attachments
    # - timestamp

    subj = results.subject
    all_from = ", ".join(f.email for f in results.from)
    all_to = ", ".join(f.email for f in results.to)
    orig_date = results.headers.date
    email_date = results.datetime
    reply_to_add = "Reply-To: (.*)\n"
    headr = results.headers


    send_domain = all_from.split('@')[1]


    Orig_Sender = results.headers.x-env-sender

    # Write a note with the email body
    if results.body_html is not None:
    # richtext body
    content = u"<div><p>Subject: {}<br>From: {}<br>To: {}</p>{}</div>".format(subj, all_from, all_to, results.body_html)
    note = helper.createRichText(content)
    incident.addNote(note)
    else:
    # Plaintext body
    content = u"Subject: {}\nFrom: {}\nTo: {}\n{}".format(subj, all_from, all_to, Orig_Sender)
    note = helper.createPlainText(content)
    incident.addNote(note)


    incident.addArtifact("email_time", orig_date, "Email Time")
    incident.addArtifact("actual_sender", all_from, "Sender of the Suspecious Email")
    incident.addArtifact("actual_reciver", all_to, "Actual Reply to")
    incident.addArtifact("attached_mail_subject", subj, "Attached Email Subject")
    incident.addArtifact("sender_domain", send_domain, "Malacious Email Sender Domain")



    ------------------------------
    Zeeshan Ahmad
    ------------------------------


  • 2.  RE: unable to read headers which contais "-" via Utilities: Email Parse function

    Posted 05/29/19 05:38 AM
    Hi Zeeshan 

    Thank you for contacting the community forum. 

    Just from a glance, it seems your issue is that you can access headers which don't have `-` in the name but not ones that DO have `-`. This may be due to how you are accessing it. Could you try replacing : 
    Orig_Sender = results.headers.x-env-sender

    with 

    Orig_Sender = results.headers["x-env-sender"]
    and let me know if you see anything different ?

    ------------------------------
    Ryan Gordon
    Security Software Engineer
    IBM
    ------------------------------