IBM QRadar SOAR

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Use whitelist in Utilities:Email Parse workflow

    Posted 10/24/19 03:07 PM
    I am wondering if anyone has integrated a similar whitelist feature in the Email Parsing workflow/function as the Inbound Email Script? I have some IP's and URL's that I am whitelisting with the email script just fine, but if an email comes in as an .eml attachment it is parsed differently with the Email Parsing function and I am trying to make them a little more consistent.

    ------------------------------
    Ryan Terry
    ------------------------------


  • 2.  RE: Use whitelist in Utilities:Email Parse workflow

    Posted 10/29/19 05:55 AM
    Hi Ryan,

    Given the Email Parsing workflow adds the Artifacts in the post-processing script, you could update that script to contain your whitelist and only add if they do not appear in the list...

    ------------------------------
    Shane Curtin
    Integrations Engineer - IBM Resilient
    ------------------------------



Related Content