Reposting my comment because it did not get posted for some reason. (Following up with support on that)
----------------------------Is it possible to pass a file as a parameter to the Shell Command function?I see in the documentation that you can at least pass TEXT, but I would like to pass an attachment or certain types of artifacts that allow you to attach files to the artifacts.I also saw in the doc that when using Shell Command and Volatility, the example showed calling memdump on disk, but in my case, I want to pass incident attachments\artifacts.Purpose: I would like to pass .msg or .eml files to the function, that would then get parsed by a shell command (tool or python script) setup on the circuits box that can extract the full email header. Currently, the Utilities: Email Parser function only parses\adds artifacts from the header and adds the email body to Notes. My end goal is to get the full email header visible in Notes, so if there is a better idea than using a Shell command, please recommend. I'm also looking into dev'ing a Function or Custom Action to do this. I'm a bit new to the platform and I'm just exploring my options at this point basically.
Thanks for the feedback Bruce.
Manually ordering a full header doesn't really seem like an option, as there are so many header fields that I may not be able to account for. There are some that are constants of course like To, From, Received, etc, but there are others we would be missing.I know "parsed_email.headers" works (I tested the functionality outside of the script), its just not working how im using it in the existing script?Again, still looking for some guidance\assistance on how to bring in that full header in an ordered way\not an unordered dictionary result.