diff --git a/docs/platform-services/automation-service/app-central/integrations/imap.md b/docs/platform-services/automation-service/app-central/integrations/imap.md index 8fff8bcb23..144298c907 100644 --- a/docs/platform-services/automation-service/app-central/integrations/imap.md +++ b/docs/platform-services/automation-service/app-central/integrations/imap.md @@ -26,30 +26,33 @@ import IntegrationsAuth from '../../../../reuse/integrations-authentication.md'; -### Get JWT token +### Get Access Key and Access ID -1. Collect the JWT token which is required later: - 1. It can be found under the user **Profile**. - 1. Just copy it temporarily in a text editor.
imap -1. To configure the integration, log into the application, expand the configuration menu in the top right corner by hovering over the gear icon and click **Automation**.
imap -1. In the Automation section, on the left menu, click **Integrations**.
imap +[Create an access key](/docs/manage/security/access-keys/#create-an-access-key) and copy the resulting **Access ID** and **Access Key**. Store the ID and access key (temporally) into a text editor. + +:::note +The ID and key won't be available again once you close the confirmation screen. +::: + +1. To configure the integration, log into the application, expand the configuration menu in the top right corner by hovering over the gear icon and click **Automation**.
imap +1. In the Automation section, on the left menu, click **Integrations**.
imap 1. After the list of the integrations appears, search/look for the integration and click on the row. -1. The integration details will appear. Click on the **"+"** button to add new Resource.
imap +1. The integration details will appear. Click on the **"+"** button to add new Resource.
imap 1. Populate all the required fields (\*) and then click **Save**.
imap - * **IMAP Server**. For example: Imap.gmail.com, Outlook.office365.com, Imap.mail.yahoo.com - * **Mailbox Account**. Only required if the Username isn't already an email address (for example: Username: admin, Mailbox Account: admin@test.com). - * **Cloud SOAR User JWT Token**. Enter the previously copied token. + * **IMAP Server**. For example: `Imap.gmail.com`, `Outlook.office365.com`, `Imap.mail.yahoo.com` + * **Mailbox Account**. Only required if the Username isn't already an email address (for example: Username: `admin`, Mailbox Account: `admin@test.com`). + * **Access ID**. The access ID that you copied earlier. + * **Access Key**. The access key that you copied earlier. * **Email Fetch Type (Daemon)**. * **Unseen/Unread**. Only fetch the mails which are currently UNSEEN or UNREAD. * **Fetch From Latest CSOAR Mail**. Fetch all mails from the mail server which are not yet stored on Cloud SOAR. For the first time it will fetch UNSEEN mails for the second run/execution. Pre-Filtering options can be used to pre-filter emails in the mail server. Only pre-filtered emails are imported and analyzed by Cloud SOAR. - * Email Fetch Type and below other filters will be combined with **AND** operator. - - * Pre-filtered options: - * **From**. You can filter email using From or even you can use full Domain name. For example: sumologic.com, sales@sumologic.com. Based on the above example, only the mails coming from Sumo Logic domain or sales@sumologic.com will be fetched. This field accepts multiple values separated by comma. Multiple values will be combined with OR operator. - * **To**. Indicate the receiver of the mail, this filter works the same as From filter. This field accepts multiple values separated by comma. Multiple values will be combined with OR operator. - * **Subject**. Fetch mails based on Subject. This field accepts multiple values separated by comma. Multiple values will be combined with OR operator. - * **Text Body**. Based on text search inside the body even it will work for attachment name. This field accepts multiple values separated by comma. Multiple values will be combined with OR operator. - * **Header**. Header string to be searched based on the below filter. + + **Email Fetch Type** and other filters below will be combined with the **AND** operator. Pre-filtered options: + * **From**. You can filter email using From or you can use the full domain name. For example, `sumologic.com, sales@sumologic.com`. Based on this example, only the mails coming from Sumo Logic domain or `sales@sumologic.com` will be fetched. This field accepts multiple values separated by a comma. Multiple values will be combined with the OR operator. + * **To**. Indicate the receiver of the mail. This filter works the same as the From filter. This field accepts multiple values separated by a comma. Multiple values will be combined with the OR operator. + * **Subject**. Fetch emails based on the subject. This field accepts multiple values separated by a comma. Multiple values will be combined with the OR operator. + * **Text Body**. Fetch emails based on a text search inside the body. It also works for attachment names. This field accepts multiple values separated by a comma. Multiple values will be combined with the OR operator. + * **Header**. Header string to be searched based on the filter below. * **Header Field Name To Search in Header**. A list from which you can choose a header element where to search the provided value in the previous field. Pre-filtered options are also available to filter as **NOT** condition: @@ -60,46 +63,43 @@ import IntegrationsAuth from '../../../../reuse/integrations-authentication.md'; * **Not Header** * **Header Field Name To Search in Header** - Similarly to the other pre-filter, but the email elements matching the provided conditions will not be fetched. + Behaves similarly to the other pre-filter, but the email elements matching the provided conditions will not be fetched. As specified, all filters will be combined with **AND** operator.
imap -1. To make sure the resource is working, hover over the resource and then click the pencil icon that appears on the right.
imap -1. Click **TEST SAVED SETTINGS**.
imap -1. You should receive a successful notification in the bottom right corner.
imap +1. Click **TEST**.
imap +1. You should receive a successful notification in the bottom right corner.
imap -### Testing Incoming Mail Daemon +### Testing incoming mail daemon It is recommended to test this action before proceeding. -1. Click on the action name.
imap -1. Click on **TEST ACTION**.
imap -1. This test action will return some results based on configuration. Once you get the results then it means your IMAP configuration and Mail Daemon are working fine.
imap +1. Click the action name.
imap +1. Click **TEST ACTION**.
imap +1. This test action returns results based on the configuration. Once you get the results, then your IMAP configuration and mail daemon are working correctly.
imap -### List Cloud SOAR Emails +### List Cloud SOAR emails You can use the List Cloud SOAR Emails action directly from the Mail Tools integration page: -1. Click on the action.
imap -1. Click on **TEST ACTION**.
imap +1. Click the action.
imap +1. Click **TEST ACTION**.
imap 1. After a moment you should receive the results.
imap -### Create Custom Fields - -Now you have to create two Custom Fields: one for Incident and the other for Triage. +### Create custom fields -We will need this custom Field in playbook and Incoming events automation Rule mapping. +Now you have to create two Custom Fields, one for Incident and the other for Triage. We will need this custom Field in playbook and incoming events automation rule mapping. Follow these steps: -1. Expand the configuration menu in the top right corner by hovering over the gear icon and click Settings. -2. On the left menu expand Customization options. -3. Then click on Fields. -4. Make sure the Triage section is selected. +1. Expand the configuration menu in the top right corner by hovering over the gear icon and click **Settings**. +2. On the left menu expand **Customization** options. +3. Then click on **Fields**. +4. Make sure the **Triage** section is selected. 5. Click on the button to add a new field. -6. Enter the name (for example: CSOAR Email ID). +6. Enter the name (for example: `CSOAR Email ID`). 7. Make sure the Visible option is selected. -8. Click CREATE. +8. Click **CREATE**. 9. Now you should see the new field in the table.
imap
imap 1. Repeat the same steps from 5 to 9 for the Incidents section.
imap @@ -108,11 +108,11 @@ Follow these steps: Once IMAP is configured you have the possibility to create an Incident associated with mail. 1. Create a new playbook or you can update the existing playbook. -1. Add Email To Incident action to the playbook. - Cloud SOAR Email ID: choose the ID that you created earlier (i.e. CSOAR Email ID from Incident fields).
imap
imap -1. Now let's expand the playbook by adding the ability to save attachments in the incident. Create a new node of type Action and set the fields as you can see in the following picture.
imap +1. Select the **Add Email To Incident** action for the node name. + For **Cloud SOAR Email ID** choose the ID that you created earlier (for example, **CSOAR Email ID** from **Incident** fields).
imap
imap +1. Now let's expand the playbook by adding the ability to save attachments in the incident. Create a new node of type action and set the fields as you can see in the following picture.
imap 1. Now we need a new node of type Condition.
imap -1. Finally add another Action as you can see.
imap +1. Finally add another action as you can see.
imap 1. Below you can see the final playbook.
imap 1. Another scenario that could be used with the IMAP mail daemon is to analyze an EML or MSG attachment that is contained in the mail without saving the attachment in the incident. Users can just extract the email with a given email ID. The following example demonstrates that in an incident: diff --git a/static/img/platform-services/automation-service/app-central/integrations/imap/imap-2.png b/static/img/platform-services/automation-service/app-central/integrations/imap/imap-2.png index be8de1e8f8..cffe9762bb 100644 Binary files a/static/img/platform-services/automation-service/app-central/integrations/imap/imap-2.png and b/static/img/platform-services/automation-service/app-central/integrations/imap/imap-2.png differ diff --git a/static/img/platform-services/automation-service/app-central/integrations/imap/imap-3.png b/static/img/platform-services/automation-service/app-central/integrations/imap/imap-3.png index 2b52917215..206c488139 100644 Binary files a/static/img/platform-services/automation-service/app-central/integrations/imap/imap-3.png and b/static/img/platform-services/automation-service/app-central/integrations/imap/imap-3.png differ diff --git a/static/img/platform-services/automation-service/app-central/integrations/imap/imap-4.png b/static/img/platform-services/automation-service/app-central/integrations/imap/imap-4.png index a75cda9109..f5a390a761 100644 Binary files a/static/img/platform-services/automation-service/app-central/integrations/imap/imap-4.png and b/static/img/platform-services/automation-service/app-central/integrations/imap/imap-4.png differ diff --git a/static/img/platform-services/automation-service/app-central/integrations/imap/imap-5.png b/static/img/platform-services/automation-service/app-central/integrations/imap/imap-5.png index aa4c922442..56c94c9b16 100644 Binary files a/static/img/platform-services/automation-service/app-central/integrations/imap/imap-5.png and b/static/img/platform-services/automation-service/app-central/integrations/imap/imap-5.png differ diff --git a/static/img/platform-services/automation-service/app-central/integrations/imap/imap-6.png b/static/img/platform-services/automation-service/app-central/integrations/imap/imap-6.png index 56a6f8ebbf..10e36177af 100644 Binary files a/static/img/platform-services/automation-service/app-central/integrations/imap/imap-6.png and b/static/img/platform-services/automation-service/app-central/integrations/imap/imap-6.png differ diff --git a/static/img/platform-services/automation-service/app-central/integrations/imap/imap-8.png b/static/img/platform-services/automation-service/app-central/integrations/imap/imap-8.png index 9d9259a9cd..cdd71eba27 100644 Binary files a/static/img/platform-services/automation-service/app-central/integrations/imap/imap-8.png and b/static/img/platform-services/automation-service/app-central/integrations/imap/imap-8.png differ diff --git a/static/img/platform-services/automation-service/app-central/integrations/imap/imap-9.png b/static/img/platform-services/automation-service/app-central/integrations/imap/imap-9.png index a6b9103b19..e70c8b16a4 100644 Binary files a/static/img/platform-services/automation-service/app-central/integrations/imap/imap-9.png and b/static/img/platform-services/automation-service/app-central/integrations/imap/imap-9.png differ