Example script for email parsing

New incidents need an owner, which is an individual who is identified by the email address or a group name. In the provided script, the value is left blank. To edit the script to add a user as the owner, locate and edit line 8 of the script. For example, add L1@businessname.com as follows:

# The new incident owner - email address of a user or name of a group and cannot be blank.
# Change this value to reflect who will be the owner of the incident before running the script.
newIncidentOwner = "L1@businessname.com"

The two categories of IP allowlist entry are CIDR (Classless Inter-Domain Routing) and IPRange. For example, in IPV4, IBM® owns the 9 class A network. You can choose to also allowlist an IP range, such as 12.0.0.1 - 12.5.5.5. To add these criteria to the allowlist, add the following to ipV4Allowlist.

  "9.0.0.0/8",
  "12.0.0.1-12.5.5.5"

If you choose to allowlist an explicit IP address, such as 13.13.13.13, specify it as follows.

"13.13.13.13"

IP v6 allowlists operate the same. For example, you can add "aaaa::/16" to allowlist a V6 CIDR. The following example shows how to add these changes to the IPV4 and IPV6 allowlists.

 # Allowlist for IP V4 addresses 
 ipV4AllowList = AllowList([
   "9.0.0.0/8",
   "12.0.0.1-12.5.5.5",
   "13.13.13.13"
 ])

 # Allowlist for IP V6 addresses
 ipV6AllowList = AllowList([
   "aaaa::/16"
 ])

The domain allowlist applies to URLs found in the body of the email. If an allowlisted domain is discovered in a potential URL artifact, it is not added to the incident. Domains can be added explicitly, such as mail.businessname.com, or by using a wildcard, such as *.otherbusinessname.com. First, locate the following line.

# Domain allowlist
domainAllowList = AllowList([
  #"*.ibm.com"
])

# Domain allowlist
domainAllowList = AllowList([
  "mail.businessname.com",
  "*.otherbusinessname.com"
])

A solution: Add the following Python 3 script to the SOAR Platform.

import re

def addArtifact(regex, artifactType, description):
    """This method adds new artifacts to the incident derived from matches of the the regular expression  parameter within the email body contents.
    Parameter "regex" - a regular expression to match against the email body contents.  Parameter "artifactType" - the type of the artifact(s).
    Parameter "description" - the description of the artifact(s).  """
    # Using a set to enforce uniqueness
    dataList = set(re.findall(regex, emailmessage.body.content))
    if dataList is not None and len(dataList) > 0:
        map(lambda theArtifact: incident.addArtifact(
            artifactType, theArtifact, description), dataList)
###
# Mainline starts here
###
# Add "Phishing" as an incident type for the associated incident
incident.incident_type_ids.append("Phishing")
# Add the email sender information to the incident as the recipient of the phishing attempt
reportingUserInfo = emailmessage.sender.address
if emailmessage.sender.name is not None:
    reportingUserInfo = "{0} <{1}>".format(emailmessage.sender.name, emailmessage.sender.address)
    incident.addArtifact("Email Recipient", reportingUserInfo,
                         "Recipient of suspicious email")
# Extract email sender information on the assumption that a fishing email is being forwarded
if not emailmessage.body.content is None:
    addArtifact(r"From: (.*)\n", "Email Sender", "Suspicious email sender")
    addArtifact(r"Reply-To: (.*)\n", "Email Sender",
                "Suspicious email sender (Reply-To)")

It is important to run the phishing-specific script after the common script because the common script causes the incident variable to be set, and the phishing-specific script expects it to be done. You can use one of the following methods.

• The phishing-specific script runs as the second script of a multi-script rule that first runs the standard script.
• The phishing-specific script runs in a separate rule that runs afterward.

If you implement the solution in one script, add the Phishing incident type to the incident at a point in the script when the incident object exists. For example, the following command occurs after the incident is created or found.

incident.incident_type_ids.append("Phishing")

A solution.

1. Create an incident custom field for the campaign identifier, which must be of type Text.
2. Copy the sample parsing script into a new script.
3. Modify the new script to create a value for the campaign identifier. You can do it by selecting some text from the content of the email messages or selecting from a hardcoded list of campaign identifiers if certain criteria are met.
4. To associate the email message with an existing incident, search for incidents whose campaign identifier field is the same as the campaign identifier value for the email message. It would replace the search based on email message subject.
5. If no suitable incident is found, create a new incident and set its campaign identifier field to be the campaign identifier value.
6. Modify the rules so that the new script runs instead of the sample script.