IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

Email Parsing Script Regex and whitelisting issues

  • 1.  Email Parsing Script Regex and whitelisting issues

    Posted Wed September 25, 2019 09:43 AM
    Hi Team,

    I am getting wrong artifact type of artifacts that is parsed the by the email script v2.0.0, it takes the "Mailto" parameter from the email, and create an artifact of type URL , not mail recipient.
    In addition I have tried the domain whitelisting following the example in the guide but it fails.

    ------------------------------
    UAEX Exchange
    ------------------------------


  • 2.  RE: Email Parsing Script Regex and whitelisting issues

    Posted Thu September 26, 2019 10:19 AM


    Hi UAEX,
    The Regex searches for href. If your email is in text/html and I suspect it is and you look at the email file in a text editor you'll see your signature is stored as <a href="mialto:x@y.com"/>. The script is a sample and a starting point so we wouldn't see this as a major issue and you can adapt the sample to meet your needs.

    I'm curious on the whitelist issue you're seeing. I'll need more info to investigate that one. Can you provide reproduction steps?

    Regards,

    Paddy Divilly

    ------------------------------
    PATRICK DIVILLY
    ------------------------------

    Original Message


Related Content