Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update email ask user readme #10774

Merged
merged 4 commits into from
Jan 7, 2021
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
52 changes: 50 additions & 2 deletions Packs/CommonScripts/Scripts/script-EmailAskUser_README.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,54 @@
Asks a user a question via email and process the reply directly into the investigation.

## Setup

Cortex XSOAR can use email responses within the system, e.g. when an external user's approval is required. To do this, you will create an email template with multiple choice options (e.g. Reply "Yes" if you approve and "No" if you do not).

**Before starting you will need to configure an integration capable for sending and receiving emails. Such as: Mail Listener v2 and Mail Sender (New), GMail, EWS O365, Microsoft Graph Mail Single User.**

The user who receives the mail will respond accordingly and when an answer is received, it will trigger a task to handle the response.
This is a two step task. The first, is to send an email asking the user for information. The second step, is to receive the answer and trigger a process of handling it in Demisto.

The outgoing email contains a token that will be used when the user responds to the email. According to the token, the response will be directed to the relevant incident.

### Step 1 - Sending an email
Add the EmailAskUser script and set as follows:
* Email – the email address the message is sent to.
* Message – The email message.
* Option 1 – The first option to choose from.
* Option 2 – The second option to choose from.
* Subject - The email subject.
* Task – The ID of the task in the playbook, to trigger when a reply is received. The task ID is found when you look at the task and as represented as `#<number>` on the task. The task ID is located in the lower-left corner of the task. You can also use a task *tag* (see Example below).

### Step 2 - A conditional task
Add a conditional task to receive the reply from the email. This task is triggered when a reply from the email is received according to its task ID that is set as the Task parameter in the EmailAskUser script (see above).

Add condition options, such as:
* Condition 1 – Yes
* Condition 2 – No

Then add Case Yes and set the input as Option 1 and Case No and set the input as Option 2.

## Example
An example arrangement for EmailAskUser task is as below:

![image](https://user-images.githubusercontent.com/54623333/99517136-efc5b480-2986-11eb-879c-a0a88923c4b9.png)


There needs to be a manual conditional task *after* the EmailAskUser Task - It is this task that is referenced as "task" in the EmailAskUser parameters.

It is good practice to tag the wait task as shown:

![image](https://user-images.githubusercontent.com/54623333/99517219-0409b180-2987-11eb-9aa4-7e96b2a12238.png)


The tag you choose (in this case "Await") can be used in lieu of the task id in the task field of the EmailAskUser Task:


![image](https://user-images.githubusercontent.com/54623333/99517256-0f5cdd00-2987-11eb-8a1f-1dc41d166b42.png)



## Script Data
---

Expand Down Expand Up @@ -39,6 +88,5 @@ There are no outputs for this script.

## Prerequisites
---
Requires an instance of one of the email integrations: Gmail, MS Graph Mail, EWS, POP3, or Mail Sender.

Requires an instance of one of the available email integrations.