IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Expand all | Collapse all

Parse Utilities: Email Parsing

  • 1.  Parse Utilities: Email Parsing

    Posted Wed October 09, 2024 01:06 PM

    Dear All,

    I am having a small hicup in one of the application and I am asking you help. I am recieving an email in SOAR wrote a script to parse it and add the (EML) file which contains attachments inside of it.

    I am using this function to parse that attachment and extract the MSG file from "Parse Utilities: Email Parsing (Attachmnet)" which is all well and good, however the artifact version of the same function return me with this error:

    "Raw email in unsupported format"

    When I am running it on the extract attachment as artifact on the MSG file. If I took the same file and uploaded it to the artifact section and ran the same playbook it works.

    Is there something I am missing it here?

    Thank you all.



    ------------------------------
    abd el rahman Hamed
    ------------------------------


  • 2.  RE: Parse Utilities: Email Parsing

    Posted Thu October 17, 2024 02:40 AM

    Hello friend :) , 

    I'm not sure I understand the problem exactly, can you clarify more or otherwise we can connect on a quick meeting.



    ------------------------------
    mohamad islam hamadieh
    ------------------------------