From a6dcb052bca7fb1b4f46fd882907c8bf5b58ef54 Mon Sep 17 00:00:00 2001 From: Guy Lichtman <1395797+glicht@users.noreply.github.com> Date: Thu, 7 Jan 2021 10:39:34 +0200 Subject: [PATCH 1/3] Update email ask user readme --- .../Scripts/script-EmailAskUser_README.md | 51 ++++++++++++++++++- 1 file changed, 50 insertions(+), 1 deletion(-) diff --git a/Packs/CommonScripts/Scripts/script-EmailAskUser_README.md b/Packs/CommonScripts/Scripts/script-EmailAskUser_README.md index 09c5050e7bd..5b02089e234 100644 --- a/Packs/CommonScripts/Scripts/script-EmailAskUser_README.md +++ b/Packs/CommonScripts/Scripts/script-EmailAskUser_README.md @@ -1,5 +1,54 @@ Asks a user a question via email and process the reply directly into the investigation. +## Setup + +Demisto can use email responses within the system, e.g. when an external user's approval is required. To do this, you will create an email template with multiple choice options (e.g. Reply "Yes" if you approve and "No" if you do not). + +**Before starting you will need to configure an integration capable for sending and receiving emails. Such as: Mail Listener v2 and Mail Sender (New), GMail, EWS O365, Microsoft Graph Mail Single User.** + +The user who receives the mail will respond accordingly and when an answer is received, it will trigger a task to handle the response. +This is a two step task. The first, is to send an email asking the user for information. The second step, is to receive the answer and trigger a process of handling it in Demisto. + +The outgoing email contains a token that will be used when the user responds to the email. According to the token, the response will be directed to the relevant incident. + +### Step 1 - Sending an email +Add the EmailAskUser script and set as follows: +* Email – the email address the message is sent to. +* Message – The email message. +* Option 1 – The first option to choose from. +* Option 2 – The second option to choose from. +* Subject - The email subject. +* Task – The ID of the task in the playbook, to trigger when a reply is received. The task ID is found when you look at the task and as represented as # on the task. The task ID is located in the lower-left corner of the task. You can also use a task *tag* (see Example below). + +### Step 2 - A conditional task +Add a conditional task to receive the reply from the email. This task is triggered when a reply from the email is received according to its task ID that is set as the Task parameter in the EmailAskUser script (see above). + +Add condition options, such as: +* Condition 1 – Yes +* Condition 2 – No + +Then add Case Yes and set the input as Option 1 and Case No and set the input as Option 2. + +## Example +An example arrangement for EmailAskUser task is as below: + +![image](https://user-images.githubusercontent.com/54623333/99517136-efc5b480-2986-11eb-879c-a0a88923c4b9.png) + + +There needs to be a manual conditional task *after* the EmailAskUser Task - It is this task that is referenced as "task" in the EmailAskUser parameters. + +It is good practice to tag the wait task as shown: + +![image](https://user-images.githubusercontent.com/54623333/99517219-0409b180-2987-11eb-9aa4-7e96b2a12238.png) + + +The tag you choose (in this case "Await") can be used in lieu of the task id in the task field of the EmailAskUser Task: + + +![image](https://user-images.githubusercontent.com/54623333/99517256-0f5cdd00-2987-11eb-8a1f-1dc41d166b42.png) + + + ## Script Data --- @@ -39,6 +88,6 @@ There are no outputs for this script. ## Prerequisites --- -Requires an instance of one of the email integrations: Gmail, MS Graph Mail, EWS, POP3, or Mail Sender. +Requires an instance of one of the available email integrations. From 6aaa413c08831e8727e1a4b58efcd11f4fe18d26 Mon Sep 17 00:00:00 2001 From: Guy Lichtman <1395797+glicht@users.noreply.github.com> Date: Thu, 7 Jan 2021 13:08:32 +0200 Subject: [PATCH 2/3] Update Packs/CommonScripts/Scripts/script-EmailAskUser_README.md Co-authored-by: Anar Azadaliyev --- Packs/CommonScripts/Scripts/script-EmailAskUser_README.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/Packs/CommonScripts/Scripts/script-EmailAskUser_README.md b/Packs/CommonScripts/Scripts/script-EmailAskUser_README.md index 5b02089e234..897b2aa8c0e 100644 --- a/Packs/CommonScripts/Scripts/script-EmailAskUser_README.md +++ b/Packs/CommonScripts/Scripts/script-EmailAskUser_README.md @@ -2,7 +2,7 @@ Asks a user a question via email and process the reply directly into the investi ## Setup -Demisto can use email responses within the system, e.g. when an external user's approval is required. To do this, you will create an email template with multiple choice options (e.g. Reply "Yes" if you approve and "No" if you do not). +XSOAR can use email responses within the system, e.g. when an external user's approval is required. To do this, you will create an email template with multiple choice options (e.g. Reply "Yes" if you approve and "No" if you do not). **Before starting you will need to configure an integration capable for sending and receiving emails. Such as: Mail Listener v2 and Mail Sender (New), GMail, EWS O365, Microsoft Graph Mail Single User.** @@ -90,4 +90,3 @@ There are no outputs for this script. --- Requires an instance of one of the available email integrations. - From 0bb177930a1ff910fc25ff2ce90cae8a18160476 Mon Sep 17 00:00:00 2001 From: Guy Lichtman <1395797+glicht@users.noreply.github.com> Date: Thu, 7 Jan 2021 13:10:09 +0200 Subject: [PATCH 3/3] fix mdx --- Packs/CommonScripts/Scripts/script-EmailAskUser_README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Packs/CommonScripts/Scripts/script-EmailAskUser_README.md b/Packs/CommonScripts/Scripts/script-EmailAskUser_README.md index 897b2aa8c0e..21dc15bbe07 100644 --- a/Packs/CommonScripts/Scripts/script-EmailAskUser_README.md +++ b/Packs/CommonScripts/Scripts/script-EmailAskUser_README.md @@ -2,7 +2,7 @@ Asks a user a question via email and process the reply directly into the investi ## Setup -XSOAR can use email responses within the system, e.g. when an external user's approval is required. To do this, you will create an email template with multiple choice options (e.g. Reply "Yes" if you approve and "No" if you do not). +Cortex XSOAR can use email responses within the system, e.g. when an external user's approval is required. To do this, you will create an email template with multiple choice options (e.g. Reply "Yes" if you approve and "No" if you do not). **Before starting you will need to configure an integration capable for sending and receiving emails. Such as: Mail Listener v2 and Mail Sender (New), GMail, EWS O365, Microsoft Graph Mail Single User.** @@ -18,7 +18,7 @@ Add the EmailAskUser script and set as follows: * Option 1 – The first option to choose from. * Option 2 – The second option to choose from. * Subject - The email subject. -* Task – The ID of the task in the playbook, to trigger when a reply is received. The task ID is found when you look at the task and as represented as # on the task. The task ID is located in the lower-left corner of the task. You can also use a task *tag* (see Example below). +* Task – The ID of the task in the playbook, to trigger when a reply is received. The task ID is found when you look at the task and as represented as `#` on the task. The task ID is located in the lower-left corner of the task. You can also use a task *tag* (see Example below). ### Step 2 - A conditional task Add a conditional task to receive the reply from the email. This task is triggered when a reply from the email is received according to its task ID that is set as the Task parameter in the EmailAskUser script (see above).