IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Inbound Email Connections with O365 mailbox

    Posted Tue July 29, 2025 05:42 PM

    Has anyone successfully configured "Inbound Email Connections" using an O365 mailbox with any of the supported protocols?

    If so, could you please share a sample configuration? I've reviewed all three protocol options, but not able to identify a suitable solution so far:

    • Exchange Protocol: This appears to use EWS, which is not enabled in our environment. Additionally, Microsoft is planning to retire EWS soon, so this doesn't seem like a viable long-term solution.

    • IMAP Protocol: IMAP is not allowed in our organization, so this option is not applicable.

    • OAuth Protocol: This seems like the most promising option, but I'm unclear how  it works and which endpoint should be used for configuration.



    ------------------------------
    Raymond Tam
    ------------------------------


  • 2.  RE: Inbound Email Connections with O365 mailbox

    Posted Wed July 30, 2025 04:01 AM

    I think the first thing to say is we use the EWS API for O365 regardless of the authentication protocol used.

    We understand its due to be removed by Microsoft in October 2026 and will replace it with MS-Graph before then.

    However if its already disabled in your env, then not sure what options we have.

    As regards OAuth, have you reviewed the doc section here ? (We support both secrets and certs)

    https://www.ibm.com/docs/en/sqsp/51.0.0?topic=administrator-changed-in-51020-configuring-inbound-email-connection



    ------------------------------
    Martin Feeney
    Product Manager, IBM Security QRadar SOAR
    martin.feeney@ie.ibm.com
    ------------------------------



  • 3.  RE: Inbound Email Connections with O365 mailbox

    Posted Wed July 30, 2025 11:21 AM
    Thanks for explaining the OAuth still needs to use the EWS API Endpoint.  Good to hear that there is a plan to support MS-Graph.

    In my current situation, it doesn't sound like the Inbound email is a feasible option.  Hope the MS-Graph option will be available soon.

    Meanwhile, I will look into other ways as a trigger for the SOAR incident creation.

    If anyone in the forum has any creative ideas or workaround, please share.


    Thanks,
    Ray





  • 4.  RE: Inbound Email Connections with O365 mailbox

    Posted 23 hours ago

    HI,

    I don't know if this could be of any help but if you work in a Microsoft Windows based environment, you could use Power Automate to replace the SOAR inbox.

    With Power Automate, you could trigger a Powershell or probably also a Python script when an email is received and meets certain condition like who the sender was or keywords in the subject.

    You would have to adapt your current email script but that's one way you could it.  I thnik :-)

    HTH



    ------------------------------
    Pierre Dufresne
    ------------------------------



  • 5.  RE: Inbound Email Connections with O365 mailbox

    Posted 20 hours ago
    Yes, Power Automate is a good suggestion to look into.  I only have a little experience with this but I think the logic makes sense.

    When an email comes in that meets the condition, I can have a script to make an API call to create a SOAR ticket.

    -Ray