playbook-CheckEmailAuthenticity-test.yml

id: playbook-checkEmailAuthenticity-test
version: -1
name: playbook-checkEmailAuthenticity-test
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 8f3af618-18e3-454d-836f-2179ca55aed0
    type: start
    task:
      id: 8f3af618-18e3-454d-836f-2179ca55aed0
      version: -1
      name: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "1":
    id: "1"
    taskid: b58b4b73-e328-4e88-8f1e-58201c9f6aec
    type: regular
    task:
      id: b58b4b73-e328-4e88-8f1e-58201c9f6aec
      version: -1
      name: Bring email from server
      description: Sends http request. Returns the response as json.
      scriptName: http
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      body: {}
      filename: {}
      headers: {}
      insecure: {}
      method:
        simple: GET
      password: {}
      proxy: {}
      saveAsFile:
        simple: "yes"
      unsecure: {}
      url:
        simple: https://raw.githubusercontent.com/demisto/content/master/TestData/CheckEmailAuthenticity_test_mail.eml
      username: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "2":
    id: "2"
    taskid: 010d86e9-a3e6-45ae-8762-e7847d7f29d8
    type: regular
    task:
      id: 010d86e9-a3e6-45ae-8762-e7847d7f29d8
      version: -1
      name: Parse Email
      description: Parse an email from an eml or msg file and populate all relevant
        context data to investigate the email. Also extracts inner attachments and
        returns them to the war room. The incident labels themselves are preserved
        and not modified - only the "Label/x" context items that originated from the
        labels, and the best practice is to rely on these for the remainder of the
        playbook.
      scriptName: ParseEmailFiles
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      entryid:
        simple: ${File.EntryID}
      max_depth: {}
      parse_only_headers: {}
    results:
    - AttachmentName
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: 651f04dc-657a-45c9-8580-5bb531564f58
    type: regular
    task:
      id: 651f04dc-657a-45c9-8580-5bb531564f58
      version: -1
      name: Check Authenticity
      description: Checks Email authenticity based on its SPF, DMARC and DKIM
      scriptName: CheckEmailAuthenticity
      type: regular
      iscommand: false
      brand: ""
    scriptarguments:
      DKIM_override_fail: {}
      DKIM_override_neutral: {}
      DKIM_override_none: {}
      DKIM_override_pass: {}
      DKIM_override_permerror: {}
      DKIM_override_policy: {}
      DKIM_override_temperror: {}
      DMARC_override_fail: {}
      DMARC_override_none: {}
      DMARC_override_pass: {}
      DMARC_override_permerror: {}
      DMARC_override_temperror: {}
      SPF_override_fail: {}
      SPF_override_neutral: {}
      SPF_override_none: {}
      SPF_override_pass: {}
      SPF_override_permerror: {}
      SPF_override_softfail: {}
      SPF_override_temperror: {}
      headers:
        simple: ${Email.Headers}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 590,
        "width": 380,
        "x": 50,
        "y": 50
      }
    }
  }
inputs: []
outputs: []