From d2b0e123683e9ae2c2e688a361fca72f6c8ad71c Mon Sep 17 00:00:00 2001 From: splunk-soar-connectors-admin Date: Mon, 18 Jul 2022 09:48:07 -0700 Subject: [PATCH 1/4] Adding workflow file for release review --- .github/workflows/review-release.yml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 .github/workflows/review-release.yml diff --git a/.github/workflows/review-release.yml b/.github/workflows/review-release.yml new file mode 100644 index 0000000..6f3bf31 --- /dev/null +++ b/.github/workflows/review-release.yml @@ -0,0 +1,22 @@ +name: Review Release +concurrency: + group: app-release + cancel-in-progress: true +permissions: + contents: read + id-token: write + statuses: write +on: + workflow_dispatch: + inputs: + task_token: + description: 'StepFunction task token' + required: true + +jobs: + review: + uses: 'phantomcyber/dev-cicd-tools/.github/workflows/review-release.yml@main' + with: + task_token: ${{ inputs.task_token }} + secrets: + resume_release_role_arn: ${{ secrets.RESUME_RELEASE_ROLE_ARN }} From ca8243ec773bcd2d26f8e1418ff1f7c00c6ac1d8 Mon Sep 17 00:00:00 2001 From: splunk-soar-connectors-admin Date: Thu, 21 Jul 2022 19:59:56 -0700 Subject: [PATCH 2/4] 'stop maintaining and delete release_notes.html' --- release_notes/release_notes.html | 115 ------------------------------- 1 file changed, 115 deletions(-) delete mode 100644 release_notes/release_notes.html diff --git a/release_notes/release_notes.html b/release_notes/release_notes.html deleted file mode 100644 index f230a1a..0000000 --- a/release_notes/release_notes.html +++ /dev/null @@ -1,115 +0,0 @@ -MS Graph for Office 365 Release Notes - Published by Splunk June 28, 2022 -

-Version 2.6.0 - Released June 28, 2022 - -Version 2.5.3 - Released April 29, 2022 - -Version 2.5.0 - Released April 19, 2022 - -Version 2.4.14 - Released February 11, 2022 - -Version 2.4.9 - Released January 20, 2022 - -Version 2.4.4 - Released November 16, 2021 - -Version 2.3.6 - Released October 19, 2021 - -Version 2.3.3 - Released October 08, 2021 - -Version 2.2.7 - Released June 1, 2021 - -Version 2.2.4 - Released March 25, 2021 - -Version 2.1.3 - Released Feburary 19, 2021 - -Version 2.0.10 - Released September 15, 2020 - -Version 1.0.26 - Released October 23, 2019 - -Version 1.0.20 - Released January 11, 2019 - -Version 1.0.15 - Released March 16, 2018 - -Version 1.0.13 - Released February 08, 2018 - -Version 1.0.11 - Released December 21, 2017 - From 3911e89cf7c988692cd051f9427ae1772cea6b75 Mon Sep 17 00:00:00 2001 From: Alan Shaikh Date: Fri, 12 Aug 2022 10:21:27 +0100 Subject: [PATCH 3/4] msgraphforoffice365: Feature - get email eventMessage support (#23) * Adding the 'delete event' action * Adding support for eventMessage in 'get email' action * Bug fix on endpoint url if both download attachments is selected and item is an eventMessage * Modified delete event action behaviour, update in get_email action and minor changes * Updated app version and removed duplicate wheel file * Bug fix for PAPP-25674 * Minor Updates * Adding download email parameter to 'get email' action * MSGForOffice365: Made minor modification in get email action * Data path changes and modified token related scenarios * Pre-commit and linting changes * MSGforOffice365: Bug fix for PAPP-26970 no name eml file issue * Documentation changes * Updated release notes * Review comment changes Co-authored-by: dhwanis-crest Co-authored-by: dhwanis-crest <72184556+dhwanis-crest@users.noreply.github.com> --- .pre-commit-config.yaml | 2 +- LICENSE | 2 +- office365.json | 1138 +++++++++++++++++++++++++++++------ office365_connector.py | 116 +++- office365_consts.py | 20 +- office365_get_email.html | 13 + office365_list_events.html | 13 + readme.html | 19 +- release_notes/unreleased.md | 5 + 9 files changed, 1110 insertions(+), 218 deletions(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index ef8aeeb..7bb7ad5 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -5,7 +5,7 @@ repos: - id: org-hook - id: package-app-dependencies - repo: https://github.com/Yelp/detect-secrets - rev: v1.2.0 + rev: v1.3.0 hooks: - id: detect-secrets args: ['--no-verify', '--exclude-files', '^office365.json$'] diff --git a/LICENSE b/LICENSE index 6af04d8..9a2c915 100644 --- a/LICENSE +++ b/LICENSE @@ -198,4 +198,4 @@ distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and - limitations under the License. \ No newline at end of file + limitations under the License. diff --git a/office365.json b/office365.json index 1e1726a..7dff1c2 100644 --- a/office365.json +++ b/office365.json @@ -15,13 +15,13 @@ } ], "license": "Copyright (c) 2017-2022 Splunk Inc.", - "app_version": "2.6.0", + "app_version": "2.7.0", "utctime_updated": "2022-02-04T01:20:46.000000Z", "package_name": "phantom_msgraphoffice365", "main_module": "office365_connector.py", - "min_phantom_version": "5.2.0", + "min_phantom_version": "5.3.0", "latest_tested_versions": [ - "Cloud 24 June, 2022" + "Cloud 3 August, 2022" ], "app_wizard_version": "1.0.0", "python_version": "3", @@ -73,12 +73,12 @@ "order": 7 }, "email_address": { - "description": "User Email Mailbox (On Poll)", + "description": "Email Address of the User (On Poll)", "data_type": "string", "order": 8 }, "folder": { - "description": "Mailbox folder name/folder path or the internal o365 folder ID to ingest (On Poll)", + "description": "Mailbox folder name/folder path or the internal office365 folder ID to ingest (On Poll)", "data_type": "string", "order": 9 }, @@ -149,6 +149,18 @@ "latest first" ], "default": "oldest first" + }, + "retry_count": { + "description": "Maximum attempts to retry the API call (Default: 3)", + "data_type": "numeric", + "default": 3, + "order": 21 + }, + "retry_wait_time": { + "description": "Delay in seconds between retries (Default: 60)", + "data_type": "numeric", + "default": 60, + "order": 22 } }, "actions": [ @@ -264,7 +276,7 @@ "data_path": "action_result.data.*.@odata.context", "data_type": "string", "example_values": [ - "https://graph.microsoft.com/v1.0/$metadata#users('eeb3645f-df19-47a1-8e8c-fcd234cb5f6f')/mailboxSettings/automaticRepliesSetting" + "https://test.abc.com/v1.0/$metadata#users('eeb3645f-df19-47a1-8e8c-fcd234cb5f6f')/mailboxSettings/automaticRepliesSetting" ], "contains": [ "url" @@ -414,8 +426,7 @@ "data_path": "action_result.parameter.filter", "data_type": "string", "example_values": [ - "$filter=subject eq 'Test2'", - "$orderby=organizer/emailAddress/name desc" + "$filter=subject eq 'Test2'" ] }, { @@ -444,7 +455,7 @@ "email" ], "example_values": [ - "test@testdomain.onmicrosoft.com" + "test@testdomain.abc.com" ] }, { @@ -475,7 +486,7 @@ "data_path": "action_result.data.*.attendees.*.emailAddress.address", "data_type": "string", "example_values": [ - "H-test@testdomain.onmicrosoft.com" + "H-test@testdomain.abc.com" ], "contains": [ "email" @@ -513,7 +524,7 @@ "data_path": "action_result.data.*.body.content", "data_type": "string", "example_values": [ - "\r\n\r\n\r\n\r\n
 
\r\n\r\n\r\n" + "\r\n\r\n\r\n\r\n
 
\r\n\r\n\r\n" ] }, { @@ -531,7 +542,7 @@ "data_path": "action_result.data.*.calendar@odata.associationLink", "data_type": "string", "example_values": [ - "https://graph.microsoft.com/v1.0/users('ggfe645f-df19-47a1-8e8c-fcd234cb5f6f')/calendars('AQMkAGYxNGJmOWQyLTlhMjctNGRiOS1iODU0LTA1ZWE3ZmQ3NDU3MQBGAAADeDDJKaEf4EihMWU6SZgKbAcA07XhOkNngkCkqoNfY_k-jQAAAgEGAAAA07XhOkNngkCkqoNfY_k-jQAAAhTzBBAA')/$ref" + "https://test.abc.com/v1.0/users('ggfe645f-df19-47a1-8e8c-fcd234cb5f6f')/calendars('AQMkAGYxNGJmOWQyLTlhMjctNGRiOS1iODU0LTA1ZWE3ZmQ3NDU3MQBGAAADeDDJKaEf4EihMWU6SZgKbAcA07XhOkNngkCkqoNfY_k-jQAAAgEGAAAA07XhOkNngkCkqoNfY_k-jQAAAhTzBBAA')/$ref" ], "contains": [ "url" @@ -541,7 +552,7 @@ "data_path": "action_result.data.*.calendar@odata.navigationLink", "data_type": "string", "example_values": [ - "https://graph.microsoft.com/v1.0/users('ffb3645f-df20-47a1-8e9c-fcd234cb5f6f')/calendars('AQMkAGYxNGJmOWQyLTlhMjctNGRiOS1iODU0LTA1ZWE3ZmQ3NDU3MQBGAAADeDDJKaEf4EihMWU6SZgKbAcA07XhOkNngkCkqoNfY_k-jQAAAgEGAAAA07XhOkNngkCkqoNfY_k-jQAAAhTzABBB')" + "https://test.abc.com/v1.0/users('ffb3645f-df20-47a1-8e9c-fcd234cb5f6f')/calendars('AQMkAGYxNGJmOWQyLTlhMjctNGRiOS1iODU0LTA1ZWE3ZmQ3NDU3MQBGAAADeDDJKaEf4EihMWU6SZgKbAcA07XhOkNngkCkqoNfY_k-jQAAAgEGAAAA07XhOkNngkCkqoNfY_k-jQAAAhTzABBB')" ], "contains": [ "url" @@ -607,6 +618,9 @@ { "data_path": "action_result.data.*.id", "data_type": "string", + "contains": [ + "msgoffice365 event id" + ], "example_values": [ "AAMkAGFmNTRhODA4LWIxMjQtNDJjYy05NDM2LWQ5MzY1MGFhMTkzYwBGAAAAAADRlY7ewL4xToKRDciQog5UBwBvUzMoUJx2S4nbgxzZWx2PAAAAAAENAABvUzMoUJx2S4nbgxzZWx2PAAEB90vfAAA=" ] @@ -876,7 +890,7 @@ "email" ], "example_values": [ - "test@testdomain.onmicrosoft.com" + "test@testdomain.abc.com" ] }, { @@ -1131,7 +1145,7 @@ "email" ], "example_values": [ - "test@testdomain.onmicrosoft.com" + "test@testdomain.abc.com" ] }, { @@ -1159,7 +1173,7 @@ "data_path": "action_result.data.*.userPrincipalName", "data_type": "string", "example_values": [ - "test@testdomain.onmicrosoft.com" + "test@testdomain.abc.com" ], "contains": [ "msgoffice365 user principal name", @@ -1319,7 +1333,7 @@ "data_path": "action_result.data.*.mail", "data_type": "string", "example_values": [ - "Test-test-site@testdomain.onmicrosoft.com" + "Test-test-site@testdomain.abc.com" ], "contains": [ "email" @@ -1386,7 +1400,7 @@ "data_path": "action_result.data.*.proxyAddresses", "data_type": "string", "example_values": [ - "SMTP:test-h@testdomain.onmicrosoft.com" + "SMTP:test-h@testdomain.abc.com" ] }, { @@ -1519,13 +1533,10 @@ ] }, { - "data_path": "action_result.parameter.group_id", + "data_path": "action_result.parameter.filter", "data_type": "string", - "contains": [ - "msgoffice365 group id" - ], "example_values": [ - "11907d21-7631-4ea7-97b2-1328d1c5b901" + "displayName eq 'Group Name'" ] }, { @@ -1537,10 +1548,13 @@ ] }, { - "data_path": "action_result.parameter.filter", + "data_path": "action_result.parameter.group_id", "data_type": "string", + "contains": [ + "msgoffice365 group id" + ], "example_values": [ - "displayName eq 'Group Name'" + "11907d21-7631-4ea7-97b2-1328d1c5b901" ] }, { @@ -1550,6 +1564,13 @@ 20 ] }, + { + "data_path": "action_result.data.*.@odata.type", + "data_type": "string", + "example_values": [ + "#test.abc.user" + ] + }, { "data_path": "action_result.data.*.businessPhones", "data_type": "string", @@ -1598,14 +1619,7 @@ "email" ], "example_values": [ - "test@testdomain.onmicrosoft.com" - ] - }, - { - "data_path": "action_result.data.*.@odata.type", - "data_type": "string", - "example_values": [ - "#microsoft.graph.user" + "test@testdomain.abc.com" ] }, { @@ -1633,7 +1647,7 @@ "data_path": "action_result.data.*.userPrincipalName", "data_type": "string", "example_values": [ - "test@testdomain.onmicrosoft.com" + "test@testdomain.abc.com" ], "contains": [ "msgoffice365 user principal name", @@ -1732,7 +1746,7 @@ "data_path": "action_result.parameter.user_id", "data_type": "string", "example_values": [ - "test@testdomain.onmicrosoft.com" + "test@testdomain.abc.com" ], "contains": [ "msgoffice365 user id", @@ -1917,7 +1931,7 @@ "column_name": "Email", "column_order": 0, "example_values": [ - "test@testdomain.onmicrosoft.com" + "test@testdomain.abc.com" ] }, { @@ -1956,7 +1970,7 @@ "data_path": "action_result.data.*.@odata.context", "data_type": "string", "example_values": [ - "https://graph.microsoft.com/v1.0/$metadata#message" + "https://test.abc.com/v1.0/$metadata#message" ], "contains": [ "url" @@ -1973,7 +1987,7 @@ "data_path": "action_result.data.*.@odata.type", "data_type": "string", "example_values": [ - "#microsoft.graph.message" + "#test.abc.message" ] }, { @@ -1983,7 +1997,7 @@ "email" ], "example_values": [ - "test@testdomain.onmicrosoft.com" + "test@testdomain.abc.com" ] }, { @@ -2025,7 +2039,7 @@ "email" ], "example_values": [ - "test@testdomain.onmicrosoft.com" + "test@testdomain.abc.com" ] }, { @@ -2074,7 +2088,7 @@ "data_path": "action_result.data.*.from.emailAddress.address", "data_type": "string", "example_values": [ - "test@testdomain.onmicrosoft.com" + "test@testdomain.abc.com" ], "contains": [ "email" @@ -2125,7 +2139,7 @@ "data_path": "action_result.data.*.internetMessageId", "data_type": "string", "example_values": [ - "" + "" ], "contains": [ "msgoffice365 internet message id" @@ -2197,7 +2211,7 @@ "data_path": "action_result.data.*.sender.emailAddress.address", "data_type": "string", "example_values": [ - "test@testdomain.onmicrosoft.com" + "test@testdomain.abc.com" ], "contains": [ "email" @@ -2231,7 +2245,7 @@ "data_path": "action_result.data.*.toRecipients.*.emailAddress.address", "data_type": "string", "example_values": [ - "Test@testdomain.onmicrosoft.com" + "Test@testdomain.abc.com" ], "contains": [ "email" @@ -2353,7 +2367,7 @@ "column_name": "Email", "column_order": 0, "example_values": [ - "test@testdomain.onmicrosoft.com" + "test@testdomain.abc.com" ] }, { @@ -2392,7 +2406,7 @@ "data_path": "action_result.data.*.@odata.context", "data_type": "string", "example_values": [ - "https://graph.microsoft.com/v1.0/$metadata#message" + "https://test.abc.com/v1.0/$metadata#message" ], "contains": [ "url" @@ -2409,7 +2423,7 @@ "data_path": "action_result.data.*.@odata.type", "data_type": "string", "example_values": [ - "#microsoft.graph.message" + "#test.abc.message" ] }, { @@ -2419,7 +2433,7 @@ "email" ], "example_values": [ - "test@testdomain.onmicrosoft.com" + "test@testdomain.abc.com" ] }, { @@ -2461,7 +2475,7 @@ "email" ], "example_values": [ - "test@testdomain.onmicrosoft.com" + "test@testdomain.abc.com" ] }, { @@ -2510,7 +2524,7 @@ "data_path": "action_result.data.*.from.emailAddress.address", "data_type": "string", "example_values": [ - "test@testdomain.onmicrosoft.com" + "test@testdomain.abc.com" ], "contains": [ "email" @@ -2561,7 +2575,7 @@ "data_path": "action_result.data.*.internetMessageId", "data_type": "string", "example_values": [ - "" + "" ], "column_name": "Internet Message ID", "column_order": 3, @@ -2633,7 +2647,7 @@ "data_path": "action_result.data.*.sender.emailAddress.address", "data_type": "string", "example_values": [ - "test@testdomain.onmicrosoft.com" + "test@testdomain.abc.com" ], "contains": [ "email" @@ -2667,7 +2681,7 @@ "data_path": "action_result.data.*.toRecipients.*.emailAddress.address", "data_type": "string", "example_values": [ - "Test@testdomain.onmicrosoft.com" + "Test@testdomain.abc.com" ], "contains": [ "email" @@ -2772,7 +2786,7 @@ "column_name": "Email", "column_order": 1, "example_values": [ - "test@testdomain.onmicrosoft.com" + "test@testdomain.abc.com" ] }, { @@ -2825,6 +2839,121 @@ }, "versions": "EQ(*)" }, + { + "action": "delete event", + "identifier": "delete_event", + "description": "Delete an event from user calendar", + "type": "generic", + "read_only": false, + "parameters": { + "id": { + "description": "Event ID to delete", + "data_type": "string", + "required": true, + "primary": true, + "contains": [ + "msgoffice365 event id" + ], + "order": 0 + }, + "email_address": { + "description": "Email address of the mailbox owner", + "data_type": "string", + "required": true, + "primary": true, + "contains": [ + "email" + ], + "order": 1 + }, + "send_decline_response": { + "description": "Send decline response to the organizer", + "data_type": "boolean", + "default": true, + "order": 2 + } + }, + "output": [ + { + "data_path": "action_result.status", + "data_type": "string", + "column_name": "Status", + "column_order": 2, + "example_values": [ + "success", + "failed" + ] + }, + { + "data_path": "action_result.parameter.email_address", + "data_type": "string", + "contains": [ + "email" + ], + "column_name": "Email", + "column_order": 1, + "example_values": [ + "test@testdomain.abc.com" + ] + }, + { + "data_path": "action_result.parameter.id", + "data_type": "string", + "contains": [ + "msgoffice365 event id" + ], + "column_name": "Event ID", + "column_order": 0, + "example_values": [ + "TestAGFmNTRhODA4LWIxMjQtNDJjYy05NDM2LWQ5MzY1MGFhMTkzYwBGAAAAAADRlY7ewL4xToKRDciQog5UBwBvUzMoUJx2S4nbgxzZWx2PAAAAAAEMAABvUzMoUJx2S4nbgxzZWx2PAAEIbt7NAAA=" + ] + }, + { + "data_path": "action_result.parameter.send_decline_response", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data", + "data_type": "string" + }, + { + "data_path": "action_result.summary", + "data_type": "string" + }, + { + "data_path": "action_result.message", + "data_type": "string", + "example_values": [ + "Successfully deleted email" + ] + }, + { + "data_path": "summary.total_objects", + "data_type": "numeric", + "example_values": [ + 1 + ] + }, + { + "data_path": "summary.total_objects_successful", + "data_type": "numeric", + "example_values": [ + 1 + ] + } + ], + "render": { + "width": 12, + "title": "Delete email", + "type": "table", + "height": 5 + }, + "versions": "EQ(*)" + }, { "action": "get email", "identifier": "get_email", @@ -2862,6 +2991,11 @@ "description": "Extract email headers", "data_type": "boolean", "order": 3 + }, + "download_email": { + "description": "Download email to vault", + "data_type": "boolean", + "order": 4 } }, "output": [ @@ -2881,6 +3015,14 @@ false ] }, + { + "data_path": "action_result.parameter.download_email", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, { "data_path": "action_result.parameter.email_address", "data_type": "string", @@ -2888,7 +3030,7 @@ "email" ], "example_values": [ - "test@onmicrosoft.com" + "test@abc.com" ] }, { @@ -2913,7 +3055,7 @@ "data_path": "action_result.data.*.@odata.context", "data_type": "string", "example_values": [ - "https://graph.microsoft.com/v1.0/$metadata#users('test%40onmicrosoft.com')/messages/$entity" + "https://abc.test.com/v1.0/$metadata#users('test%40abc.com')/messages/$entity" ], "contains": [ "url" @@ -2923,10 +3065,20 @@ "data_path": "action_result.data.*.@odata.etag", "data_type": "string", "example_values": [ - "W/\"CQAAABYAAABBKXVvwEWISZupmqX4mJS3AAFLoCsS\"", - "W/\"CQAAABYAAABBKXVvwEWISZupmqX4mJS3AAO8DBJl\"" + "W/\"CQAAABYAAABBKXVvwEWISZupmqX4mJS3AAFLoCsS\"" + ] + }, + { + "data_path": "action_result.data.*.@odata.type", + "data_type": "string", + "example_values": [ + "#test.abc.eventMessage" ] }, + { + "data_path": "action_result.data.*.allowNewTimeProposals", + "data_type": "string" + }, { "data_path": "action_result.data.*.attachments.*.@odata.mediaContentType", "data_type": "string", @@ -2938,14 +3090,14 @@ "data_path": "action_result.data.*.attachments.*.@odata.type", "data_type": "string", "example_values": [ - "#microsoft.graph.fileAttachment" + "#test.abc.fileAttachment" ] }, { "data_path": "action_result.data.*.attachments.*.attachmentType", "data_type": "string", "example_values": [ - "#microsoft.graph.fileAttachment" + "#test.abc.fileAttachment" ] }, { @@ -2988,7 +3140,7 @@ "data_path": "action_result.data.*.attachments.*.itemType", "data_type": "string", "example_values": [ - "#microsoft.graph.message" + "#test.abc.message" ] }, { @@ -3019,7 +3171,8 @@ "719dbf72d7c0bc89d7e34306c08a0b66191902b9" ], "contains": [ - "sha1" + "sha1", + "vault id" ] }, { @@ -3029,7 +3182,7 @@ "email" ], "example_values": [ - "test@testdomain.onmicrosoft.com" + "test@testdomain.abc.com" ] }, { @@ -3043,29 +3196,29 @@ "data_path": "action_result.data.*.body.content", "data_type": "string", "example_values": [ - "Have a good time with these.\r\n", - "\r\n

HTML heading

HTML body." + "Have a good time with these.\r\n" ] }, { "data_path": "action_result.data.*.body.contentType", "data_type": "string", "example_values": [ - "text", - "html" + "text" ] }, { "data_path": "action_result.data.*.bodyPreview", "data_type": "string", "example_values": [ - "Have a good time with these.", - "HTML heading\r\nHTML body." + "Have a good time with these." ] }, { "data_path": "action_result.data.*.categories", - "data_type": "string" + "data_type": "string", + "example_values": [ + "Green category" + ] }, { "data_path": "action_result.data.*.ccRecipients.email", @@ -3074,7 +3227,7 @@ "email" ], "example_values": [ - "test@testdomain.onmicrosoft.com" + "test@testdomain.abc.com" ] }, { @@ -3088,16 +3241,14 @@ "data_path": "action_result.data.*.changeKey", "data_type": "string", "example_values": [ - "CQAAABYAAABBKXVvwEWISZupmqX4mJS3AAFLoCsS", - "CQAAABYAAABBKXVvwEWISZupmqX4mJS3AAO8DBJl" + "CQAAABYAAABBKXVvwEWISZupmqX4mJS3AAFLoCsS" ] }, { "data_path": "action_result.data.*.conversationId", "data_type": "string", "example_values": [ - "AAQkADU3NDk3MzJlLTY3MDQtNDE2Ny1iZDk1LTc4YjEwYzhmZDc5YQAQAEU43FQ-fk5LmOxKoTpmHfw=", - "AAQkADU3NDk3MzJlLTY3MDQtNDE2Ny1iZDk1LTc4YjEwYzhmZDc5YQAQAE0u8cumTkhHhJdGoa0RzX0=" + "AAQkADU3NDk3MzJlLTY3MDQtNDE2Ny1iZDk1LTc4YjEwYzhmZDc5YQAQAEU43FQ-fk5LmOxKoTpmHfw=" ] }, { @@ -3111,39 +3262,32 @@ "data_path": "action_result.data.*.createdDateTime", "data_type": "string", "example_values": [ - "2017-10-26T01:31:43Z", - "2020-06-18T09:11:31Z" + "2017-10-26T01:31:43Z" ] }, { - "data_path": "action_result.data.*.flag.flagStatus", + "data_path": "action_result.data.*.endDateTime.dateTime", "data_type": "string", "example_values": [ - "notFlagged" + "2022-07-26T09:30:00.0000000" ] }, { - "data_path": "action_result.data.*.from.emailAddress.address", + "data_path": "action_result.data.*.endDateTime.timeZone", "data_type": "string", "example_values": [ - "test@testdomain.onmicrosoft.com" - ], - "contains": [ - "email" + "UTC" ] }, { - "data_path": "action_result.data.*.from.emailAddress.name", + "data_path": "action_result.data.*.event.@odata.etag", "data_type": "string", "example_values": [ - "Test Name" - ], - "contains": [ - "email" + "W/\"CQAAABYAAABBKXVvwEWISZupmqX4mJS3AAFLoCsS\"" ] }, { - "data_path": "action_result.data.*.hasAttachments", + "data_path": "action_result.data.*.event.allowNewTimeProposals", "data_type": "boolean", "example_values": [ true, @@ -3151,162 +3295,596 @@ ] }, { - "data_path": "action_result.data.*.id", + "data_path": "action_result.data.*.event.attendees.*.emailAddress.address", "data_type": "string", "example_values": [ - "AQMkADU3NDk3MzJlLTY3MDQtNDE2Ny1iZDk1LTc4YjEwYzhmZDc5YQBGAAADyW3X5P7Hb0_MMHKonvdoWQcAQSl1b8BFiEmbqZql_JiUtwAAAgEMAAAAQSl1b8BFiEmbqZql_JiUtwABS2DpfAAAAA==" + "test@testdomain.abc.com" ], "contains": [ - "msgoffice365 message id" + "email" ] }, { - "data_path": "action_result.data.*.importance", + "data_path": "action_result.data.*.event.attendees.*.emailAddress.name", "data_type": "string", "example_values": [ - "normal" + "Test Name" ] }, { - "data_path": "action_result.data.*.inferenceClassification", + "data_path": "action_result.data.*.event.attendees.*.status.response", "data_type": "string", "example_values": [ - "focused", - "other" + "none" ] }, { - "data_path": "action_result.data.*.internetMessageHeaders.Accept-Language", + "data_path": "action_result.data.*.event.attendees.*.status.time", "data_type": "string", "example_values": [ - "en-US" + "0001-01-01T00:00:00Z" ] }, { - "data_path": "action_result.data.*.internetMessageHeaders.Authentication-Results", + "data_path": "action_result.data.*.event.attendees.*.type", "data_type": "string", "example_values": [ - "spf=pass (sender IP is 209.85.210.171) smtp.mailfrom=testdomain.com; .onmicrosoft.com; dkim=pass (signature was verified) header.d=testdomain.com.20150623.gappssmtp.com;.onmicrosoft.com; dmarc=pass action=none header.from=testdomain.com;compauth=pass reason=100" + "required" ] }, { - "data_path": "action_result.data.*.internetMessageHeaders.Content-Language", + "data_path": "action_result.data.*.event.body.content", "data_type": "string", "example_values": [ - "en-US" + "plain text?\r\n" ] }, { - "data_path": "action_result.data.*.internetMessageHeaders.Content-Transfer-Encoding", + "data_path": "action_result.data.*.event.body.contentType", "data_type": "string", "example_values": [ - "binary" + "text" ] }, { - "data_path": "action_result.data.*.internetMessageHeaders.Content-Type", + "data_path": "action_result.data.*.event.bodyPreview", "data_type": "string", "example_values": [ - "multipart/related" + "plain text?" ] }, { - "data_path": "action_result.data.*.internetMessageHeaders.DKIM-Signature", + "data_path": "action_result.data.*.event.calendar@odata.associationLink", "data_type": "string", "example_values": [ - "v=1; a=rsa-sha256; c=relaxed/relaxed; d=testdomain.com.20150623.gappssmtp.com; s=20150623; h=message-id:date:mime-version:from:to:subject; bh=tlTaRbacq4aWozhUPvcWg8i8flbpYQGZNs27nncn83I=; b=avAAeJ8jF08K4oIBhxTirRmyB+SXHwdU0zdxv7eqs/zWaWWcgmT0007KP560TTgo5u oD4nb6TvKxpRyWW4QwmkbuMIwHsMvehd2l1gispV3AawyGJjpmN7ErVYfLtIkz2Tap3V YxmluV+SqeyyxTU8pFAEZ7+2C2lOb1DO5TC7xCMv+dyzevSscJdbeN0dFkG+C93zCqkg w2fxubx2HDD7b/U6m2wXllYhH608wKJ/qYzyvQyqxYqNiQOtPRg2gw4sZ2UgN3+UQyVq 8ubO39ZuqakJpzEzYMw10d6E7SQhvHDJH7mFwhBlzhvOpb2gLJDN8n8dJaZo05BozQqq MsvA==" + "https://test.abc.com/v1.0/users('test@user.abc.com')/calendars('AQMkAGYxNGJmOWQyLTlhMjctNGRiOS1iODU0LTA1ZWE3ZmQ3NDU3MQAuAAADeDDJKaEf4EihMWU6SZgKbAEA07XhOkNngkCkqoNfY_k-jQAAAgENAAAA')/$ref" + ], + "contains": [ + "url" ] }, { - "data_path": "action_result.data.*.internetMessageHeaders.Date", + "data_path": "action_result.data.*.event.calendar@odata.navigationLink", "data_type": "string", "example_values": [ - "Thu, 18 Jun 2020 02:11:26 -0700" + "https://test.abc.com/v1.0/users('test@user.abc.com')/calendars('AQMkAGYxNGJmOWQyLTlhMjctNGRiOS1iODU0LTA1ZWE3ZmQ3NDU3MQAuAAADeDDJKaEf4EihMWU6SZgKbAEA07XhOkNngkCkqoNfY_k-jQAAAgENAAAA')" + ], + "contains": [ + "url" ] }, { - "data_path": "action_result.data.*.internetMessageHeaders.From", + "data_path": "action_result.data.*.event.changeKey", "data_type": "string", "example_values": [ - "\"Test\" " + "CQAAABYAAABBKXVvwEWISZupmqX4mJS3AAFQwHj9" ] }, { - "data_path": "action_result.data.*.internetMessageHeaders.In-Reply-To", + "data_path": "action_result.data.*.event.createdDateTime", "data_type": "string", "example_values": [ - "" + "0001-01-01T00:00:00Z" ] }, { - "data_path": "action_result.data.*.internetMessageHeaders.MIME-Version", + "data_path": "action_result.data.*.event.end.dateTime", "data_type": "string", "example_values": [ - "1.0" + "0001-01-01T00:00:00.0000000" ] }, { - "data_path": "action_result.data.*.internetMessageHeaders.Message-ID", + "data_path": "action_result.data.*.event.end.timeZone", "data_type": "string", "example_values": [ - "<5eeb2fbe.1c69fb81.22b4b.676a@mx.google.com>" + "UTC" ] }, { - "data_path": "action_result.data.*.internetMessageHeaders.Received", - "data_type": "string", + "data_path": "action_result.data.*.event.hasAttachments", + "data_type": "boolean", "example_values": [ - "from localhost.localdomain (host-240.splunk.com. [204.107.141.240]) by smtp.gmail.com with UTF8SMTPSA id ng12sm1923252pjb.15.2020.06.18.02.11.26 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 18 Jun 2020 02:11:26 -0700 (PDT)" + true, + false ] }, { - "data_path": "action_result.data.*.internetMessageHeaders.Received-SPF", - "data_type": "string", + "data_path": "action_result.data.*.event.hideAttendees", + "data_type": "boolean", "example_values": [ - "Pass (protection.outlook.com: domain of testdomain.com designates 209.85.210.171 as permitted sender) receiver=protection.outlook.com; client-ip=209.85.210.171; helo=mail-pf1-f171.google.com;" + true, + false ] }, { - "data_path": "action_result.data.*.internetMessageHeaders.References", + "data_path": "action_result.data.*.event.iCalUId", "data_type": "string", "example_values": [ - "" + "040000008200E00074C5B7101A82E0080000000074AC2CF9CF5ED8010000000000000000100000005B5B104FC55A6E44BC5C6A093AB7F07C" ] }, { - "data_path": "action_result.data.*.internetMessageHeaders.Return-Path", + "data_path": "action_result.data.*.event.id", "data_type": "string", "example_values": [ - "notifications@testdomain.com" + "AAMkAGYwYmE5NmQ0LWVhOGItNGFhMy05OWNlLTE5MzhjMTE5YWYyMQBGAAAAAACkbmmUA5U5RZwZvvg8zew_BwDWyBbuDx-uTKpJ-DXRPByGAAAA1bxhAAAr0tXr3dtaS5qYgFGhi6QjAAQiOoS2AAA=" ], "contains": [ - "email" + "msgoffice365 event id" ] }, { - "data_path": "action_result.data.*.internetMessageHeaders.Subject", + "data_path": "action_result.data.*.event.importance", "data_type": "string", "example_values": [ - "Fw: Email having different attachments" + "normal" ] }, { - "data_path": "action_result.data.*.internetMessageHeaders.Thread-Index", - "data_type": "string", + "data_path": "action_result.data.*.event.isAllDay", + "data_type": "boolean", "example_values": [ - "AQDEZLqyXR4k4Sc6skyFCMPITcMsbKpGS7At" + false, + true ] }, { - "data_path": "action_result.data.*.internetMessageHeaders.Thread-Topic", - "data_type": "string", + "data_path": "action_result.data.*.event.isCancelled", + "data_type": "boolean", "example_values": [ - "Email having different attachments" + true, + false ] }, { - "data_path": "action_result.data.*.internetMessageHeaders.To", - "data_type": "string", + "data_path": "action_result.data.*.event.isDraft", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.event.isOnlineMeeting", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.event.isOrganizer", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.event.isReminderOn", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.event.lastModifiedDateTime", + "data_type": "string", + "example_values": [ + "0001-01-01T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.event.location.displayName", + "data_type": "string", + "example_values": [ + "Test" + ] + }, + { + "data_path": "action_result.data.*.event.location.locationType", + "data_type": "string", + "example_values": [ + "default" + ] + }, + { + "data_path": "action_result.data.*.event.location.uniqueIdType", + "data_type": "string", + "example_values": [ + "unknown" + ] + }, + { + "data_path": "action_result.data.*.event.occurrenceId", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.event.onlineMeeting.joinUrl", + "data_type": "string", + "example_values": [ + "https://test.abc.com/l/meetup-join/19%3ameeting_ZjViMTdlNjEtZjYxNi00N2QyLWJmOWYtMGU5MjVjMDM3ZTZl%40thread.v2/0?context=%7b%22Tid%22%3a%22a417c578-c7ee-480d-a225-d48057e74df5%22%2c%22Oid%22%3a%22e4c722ac-3b83-478d-8f52-c388885dc30f%22%7d" + ], + "contains": [ + "url" + ] + }, + { + "data_path": "action_result.data.*.event.onlineMeetingProvider", + "data_type": "string", + "example_values": [ + "teamsForBusiness" + ] + }, + { + "data_path": "action_result.data.*.event.onlineMeetingUrl", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.event.organizer.emailAddress.address", + "data_type": "string", + "example_values": [ + "test@testdomain.abc.com" + ], + "contains": [ + "email" + ] + }, + { + "data_path": "action_result.data.*.event.organizer.emailAddress.name", + "data_type": "string", + "example_values": [ + "Test Name" + ] + }, + { + "data_path": "action_result.data.*.event.originalEndTimeZone", + "data_type": "string", + "example_values": [ + "UTC" + ] + }, + { + "data_path": "action_result.data.*.event.originalStartTimeZone", + "data_type": "string", + "example_values": [ + "UTC" + ] + }, + { + "data_path": "action_result.data.*.event.recurrence", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.event.reminderMinutesBeforeStart", + "data_type": "numeric", + "example_values": [ + 0 + ] + }, + { + "data_path": "action_result.data.*.event.responseRequested", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.event.responseStatus.response", + "data_type": "string", + "example_values": [ + "accepted" + ] + }, + { + "data_path": "action_result.data.*.event.responseStatus.time", + "data_type": "string", + "example_values": [ + "0001-01-01T00:00:00Z" + ] + }, + { + "data_path": "action_result.data.*.event.sensitivity", + "data_type": "string", + "example_values": [ + "normal" + ] + }, + { + "data_path": "action_result.data.*.event.seriesMasterId", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.event.showAs", + "data_type": "string", + "example_values": [ + "tentative" + ] + }, + { + "data_path": "action_result.data.*.event.start.dateTime", + "data_type": "string", + "example_values": [ + "0001-01-01T00:00:00.0000000" + ] + }, + { + "data_path": "action_result.data.*.event.start.timeZone", + "data_type": "string", + "example_values": [ + "UTC" + ] + }, + { + "data_path": "action_result.data.*.event.subject", + "data_type": "string", + "example_values": [ + "Just wanted to say hello" + ] + }, + { + "data_path": "action_result.data.*.event.transactionId", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.event.type", + "data_type": "string", + "example_values": [ + "singleInstance" + ] + }, + { + "data_path": "action_result.data.*.event.webLink", + "data_type": "string", + "example_values": [ + "https://test.abc.com/owa?itemid=AAMkAGYwYmE5NmQ0LWVhOGItNGFhMy05OWNlLTE5MzhjMTE5YWYyMQBGAAAAAACkbmmUA5U5RZwZvvg8zew%2BBwDWyBbuDx%2FuTKpJ%2FDXRPByGAAAA1bxhAAAr0tXr3dtaS5qYgFGhi6QjAAQiOoS2AAA%3D&exvsurl=1&path=/calendar/item" + ], + "contains": [ + "url" + ] + }, + { + "data_path": "action_result.data.*.flag.flagStatus", + "data_type": "string", + "example_values": [ + "notFlagged" + ] + }, + { + "data_path": "action_result.data.*.from.emailAddress.address", + "data_type": "string", + "example_values": [ + "test@testdomain.abc.com" + ], + "contains": [ + "email" + ] + }, + { + "data_path": "action_result.data.*.from.emailAddress.name", + "data_type": "string", + "example_values": [ + "Test Name" + ], + "contains": [ + "email" + ] + }, + { + "data_path": "action_result.data.*.hasAttachments", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.id", + "data_type": "string", + "example_values": [ + "AQMkADU3NDk3MzJlLTY3MDQtNDE2Ny1iZDk1LTc4YjEwYzhmZDc5YQBGAAADyW3X5P7Hb0_MMHKonvdoWQcAQSl1b8BFiEmbqZql_JiUtwAAAgEMAAAAQSl1b8BFiEmbqZql_JiUtwABS2DpfAAAAA==" + ], + "contains": [ + "msgoffice365 message id" + ] + }, + { + "data_path": "action_result.data.*.importance", + "data_type": "string", + "example_values": [ + "normal" + ] + }, + { + "data_path": "action_result.data.*.inferenceClassification", + "data_type": "string", + "example_values": [ + "focused" + ] + }, + { + "data_path": "action_result.data.*.internetMessageHeaders.ARC-Authentication-Results", + "data_type": "string", + "example_values": [ + "i=1; mx.test.com 1; spf=pass smtp.mailfrom=user.test.com; dmarc=pass action=none header.from=user.abc.com; dkim=pass header.d=test.abc.com; arc=none" + ] + }, + { + "data_path": "action_result.data.*.internetMessageHeaders.ARC-Message-Signature", + "data_type": "string", + "example_values": [ + "i=1; a=rsa-sha256; c=relaxed/relaxed; d=test.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=3fZ/7Rn8nzby4BCiwxGpfUUiHgfvSZ6MOHtHg1Hmixs=; b=f7VAkSO/T2NJuxMrJNBzeow/t2iTVZfAkVaZGgtAoYq3Wb9cUDEfAtTE4RmzSqLEqP2iXxLK7JsRfV2uqsbGinp3ZuRnHSqMoRzO0XCN8KjE/Z9hUyUmq05clk2rB3TqCcKK6ipy1+N+4mvCFFb6O+bN/9TGhPos1dY0X0sy33sow9oeND6nm8HvtIzp/hG0xKduPnEHwQiCCwRTmdAtbAzMWmnEyyodRQg/PCgjAPKPpeFELZ+pr/bbEkySxLCu/xY1qhoa8JMIrh1EUFHyFyscTDc580YNnowNqAR//iO8DRGaTG1Znv4MI7mlcmM/vopKYAa6zNPXb2LHDqwKBQ==" + ] + }, + { + "data_path": "action_result.data.*.internetMessageHeaders.ARC-Seal", + "data_type": "string", + "example_values": [ + "i=1; a=rsa-sha256; s=arcselector9901; d=test.com; cv=none; b=GIfa87IhNn+v4Mdn75nJpk9WjELaP8fw9+C+Ey0QFktfU60rPvtJDc5qJS5mN/g6COFa2inOEc4S+Cm3R1BLcBgqkCZR/niPjMp/A2tEHs9OeY75S+T8d5OsfmFcD2jC5/59Dc8EAEKw3UnYKxCC4CKWPFCXrE+Cu3jLEtt04Izr1rXTTQacfCjwYN4OsKI9lHyn6JRDlePR2RZKztMcnt/hcOJz6cwFe+MAUgg0qjKB8p+27o2hQKu+LlQDg8nMRQ6jHkD8DylOclHe2nVKmEhNXi67PTeoqTfZe4+YgSOrnJOUdlra5q/EoWN0FnM9Zt0+0K42ncYSWcC0NpsbqQ==" + ] + }, + { + "data_path": "action_result.data.*.internetMessageHeaders.Accept-Language", + "data_type": "string", + "example_values": [ + "en-US" + ] + }, + { + "data_path": "action_result.data.*.internetMessageHeaders.Authentication-Results", + "data_type": "string", + "example_values": [ + "spf=pass (sender IP is 209.85.210.171) smtp.mailfrom=testdomain.com; .abc.com; dkim=pass (signature was verified) header.d=testdomain.com.20150623.gappssmtp.com;.abc.com; dmarc=pass action=none header.from=testdomain.com;compauth=pass reason=100" + ] + }, + { + "data_path": "action_result.data.*.internetMessageHeaders.Authentication-Results-Original", + "data_type": "string", + "example_values": [ + "dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=test.abc.com;" + ] + }, + { + "data_path": "action_result.data.*.internetMessageHeaders.Content-Language", + "data_type": "string", + "example_values": [ + "en-US" + ] + }, + { + "data_path": "action_result.data.*.internetMessageHeaders.Content-Transfer-Encoding", + "data_type": "string", + "example_values": [ + "binary" + ] + }, + { + "data_path": "action_result.data.*.internetMessageHeaders.Content-Type", + "data_type": "string", + "example_values": [ + "multipart/related" + ] + }, + { + "data_path": "action_result.data.*.internetMessageHeaders.DKIM-Signature", + "data_type": "string", + "example_values": [ + "v=1; a=rsa-sha256; c=relaxed/relaxed; d=testdomain.com.20150623.gappssmtp.com; s=20150623; h=message-id:date:mime-version:from:to:subject; bh=tlTaRbacq4aWozhUPvcWg8i8flbpYQGZNs27nncn83I=; b=avAAeJ8jF08K4oIBhxTirRmyB+SXHwdU0zdxv7eqs/zWaWWcgmT0007KP560TTgo5u oD4nb6TvKxpRyWW4QwmkbuMIwHsMvehd2l1gispV3AawyGJjpmN7ErVYfLtIkz2Tap3V YxmluV+SqeyyxTU8pFAEZ7+2C2lOb1DO5TC7xCMv+dyzevSscJdbeN0dFkG+C93zCqkg w2fxubx2HDD7b/U6m2wXllYhH608wKJ/qYzyvQyqxYqNiQOtPRg2gw4sZ2UgN3+UQyVq 8ubO39ZuqakJpzEzYMw10d6E7SQhvHDJH7mFwhBlzhvOpb2gLJDN8n8dJaZo05BozQqq MsvA==" + ] + }, + { + "data_path": "action_result.data.*.internetMessageHeaders.Date", + "data_type": "string", + "example_values": [ + "Thu, 18 Jun 2020 02:11:26 -0700" + ] + }, + { + "data_path": "action_result.data.*.internetMessageHeaders.From", + "data_type": "string", + "example_values": [ + "\"Test\" " + ] + }, + { + "data_path": "action_result.data.*.internetMessageHeaders.In-Reply-To", + "data_type": "string", + "example_values": [ + "" + ] + }, + { + "data_path": "action_result.data.*.internetMessageHeaders.MIME-Version", + "data_type": "string", + "example_values": [ + "1.0" + ] + }, + { + "data_path": "action_result.data.*.internetMessageHeaders.Message-ID", + "data_type": "string", + "example_values": [ + "<5eeb2fbe.1c69fb81.22b4b.676a@mx.test.com>" + ] + }, + { + "data_path": "action_result.data.*.internetMessageHeaders.Received", + "data_type": "string", + "example_values": [ + "from localhost.localdomain (host-240.test.com. [204.107.141.240]) by test.abc.com with UTF8SMTPSA id ng12sm1923252pjb.15.2020.06.18.02.11.26 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 18 Jun 2020 02:11:26 -0700 (PDT)" + ] + }, + { + "data_path": "action_result.data.*.internetMessageHeaders.Received-SPF", + "data_type": "string", + "example_values": [ + "Pass (protection.test.com: domain of testdomain.com designates 209.85.210.171 as permitted sender) receiver=protection.test.com; client-ip=209.85.210.171; helo=mail-pf1-f171.test.com;" + ] + }, + { + "data_path": "action_result.data.*.internetMessageHeaders.References", + "data_type": "string", + "example_values": [ + "" + ] + }, + { + "data_path": "action_result.data.*.internetMessageHeaders.Return-Path", + "data_type": "string", + "example_values": [ + "notifications@testdomain.com" + ], + "contains": [ + "email" + ] + }, + { + "data_path": "action_result.data.*.internetMessageHeaders.Subject", + "data_type": "string", + "example_values": [ + "Fw: Email having different attachments" + ] + }, + { + "data_path": "action_result.data.*.internetMessageHeaders.Thread-Index", + "data_type": "string", + "example_values": [ + "AQDEZLqyXR4k4Sc6skyFCMPITcMsbKpGS7At" + ] + }, + { + "data_path": "action_result.data.*.internetMessageHeaders.Thread-Topic", + "data_type": "string", + "example_values": [ + "Email having different attachments" + ] + }, + { + "data_path": "action_result.data.*.internetMessageHeaders.To", + "data_type": "string", "example_values": [ "\"Test\" " ] @@ -3329,7 +3907,14 @@ "data_path": "action_result.data.*.internetMessageHeaders.X-Forefront-Antispam-Report", "data_type": "string", "example_values": [ - "CIP:209.85.210.171;CTRY:US;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:SFE;H:mail-pf1-f171.google.com;PTR:mail-pf1-f171.google.com;CAT:NONE;SFTY:;SFS:;DIR:INB;SFP:;" + "CIP:209.85.210.171;CTRY:US;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:SFE;H:mail-pf1-f171.test.com;PTR:mail-pf1-f171.test.com;CAT:NONE;SFTY:;SFS:;DIR:INB;SFP:;" + ] + }, + { + "data_path": "action_result.data.*.internetMessageHeaders.X-Forefront-Antispam-Report-Untrusted", + "data_type": "string", + "example_values": [ + "CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BYAPR18MB2408.namprd18.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230016)(136003)(396003)(346002)(39830400003)(376002)(366004)(186003)(83380400001)(64756008)(76116006)(66946007)(71200400001)(8676002)(66476007)(66446008)(66556008)(6916009)(55016003)(91956017)(9686003)(41300700001)(6506007)(7696005)(26005)(2906002)(33656002)(38070700005)(86362001)(38100700002)(3480700007)(122000001)(5660300002)(4744005)(316002)(296002)(166002)(478600001)(8936002)(52536014);DIR:OUT;SFP:1102;" ] }, { @@ -3360,6 +3945,20 @@ "VSM9HTzub/OH3NCwWNKQqkkzjnhdw5kXsgd9WM0SRgZ0qRdPg5D9/o3LA7lf8ziXc5k0mm9M5mHvFoYePXNXs/MGhGdBGxa/qUQ+FVHA2mDgfPkamJCEZxz//OX/uruTDo+zF4p9D1dQJpnIpx1M75OhuvrHX/BxWWzyAh78DXfF214YHdyFBCYepwl56CS7+fSGQL/r3p+OvWIBnIkISC+HJljSro2k47pPPAkspMhoUkb+zklyENFjez+JcEHYlih2FiNeUO8kb9b7qvlm3zPK98HLspzDh4BojpQ6Ff330iy7nfIK726tCMByxjOdnEQSB9Ua2sbE5gxSeeWL8MB5DHcQSSsXg+sR8w4gXrXLO3meE0lNQKRoAv2b1U0Q+yM0QBqeQWlymZG21bKeuH4gtAFQvfXNjoCtIbBQK1n7ZnL7fI21FJZRcMcKEneus6gLYUqD4PdLEq9FEGbfgiLmVYeUAL2A0Q/gectvL1OVudtHVR5gFMJKt65F1OtS04CPulfLLFSl1F4AzpjjtBSyQcK9R7bOsjoHxQXPMd9fMCzMSIq5f551pO0klKqWY7l11Un2Noj6CA7EtXiD1bTv8JmYQEKR+0HTZagNd+79GeTvKjxTvt9MkyO8k3aqWyNqT331ITnVICtksN1TVMCp8GVeDudNMr2PLSW0alOduR5unuEgTWrqHoaTGOovQx0PVjudNlpZ80ANK9hqaC/ZhLLOtNpJ3fZnjs06PzrPLGhE/IeccY1n8sYDvGm1QA9TN6JaaGPl1Pj6ecy16k0XuF/PKGHTL0M4LCpxSS6T87oFFH1zHkKtmbJp3aAI4bt3ihbQmwFb29JyMgL7ZOy+zrIwXGILh1KQGWQQv1uXXnAuqQy29HeFXs6D2hDHxHlBk5ZQ+vgRtsvRvGnq58vJ3CapjntfL3pOINUj1avLyAZxjasBWMTwaZs9JQ4ZIMekzkIk05lh9XfDSeULk2yKaH8YSCC6ENUHxSWa6pPHJfOdp9kXwOtlp09/VTTAikKy862k9ybN4bRWZB45B9Pv5scna8IX3rthIXUih8c=" ] }, + { + "data_path": "action_result.data.*.internetMessageHeaders.X-MS-Exchange-AntiSpam-MessageData-Original-0", + "data_type": "string", + "example_values": [ + "SC/7FB9jcHrfqMtL+8C1Sp2MBDl48qjRn/ZzFJk8+2yWs9kmQwzxXC8TA3HuU0EMts58S8uTyFbx12+qQUJ45/B5QFEfP5j1o7B5kj1Q0C9S+LAg6YptTwxi29Ei1T4mf+CpfzIeA73NzXB7pWjnmycYYlL3TAn0xJATthWspUZ+g4jZoDzNSIdAZWqoc1j4+dHA6WR+U9zZi0vODxRmplSWq2FeO8uMKqD43StpvYk6chxcaGGc5+rNRxP6RLF7OLirJ0MQ1FfZNRdNfUKBvGAF2r6HLp62apGZg0d5gJ5M7zg/1V4ygWW19cuGXyAr5b9bow1MPIOBfrDrMS3CBk2F9DfATTZ/oFwOv/hCUVs2MkWSdr/upJfPt0xoAYtXk1UjxKpV/nHgTTfQy/ijlxEsYn/HY9O6tfqvn/BRvehvPjjoouvxcZteyP1glEcajum7Op67/kV9p4Wv+U+A+31/kyrb3Tjt4GJGpTIBfLi/VjIiHUDFrpAcBz3rFqxyfKQcCqDsOMjD5CrxBj3ow7uMlQiaQoU0Dxwc4eDggbe9Af/F3YqZuvqpj2H0U0hm7+7j56WjFxewVKHLJBwkCXG6a8UdEmKBtA685mUbfpICdYaoLatC4LYOMeqsx6CeEr75vyfdqTdKOZrBKkhTluMbR0s1pvh0kID7B+HL/LKqFSnpgQidfIugk5FUSh42vsBUjrxq6LWYDSHWwYweeuZi/6vVgKQl1XS5X7JUhwNxZSzSF76pNeCIq6KGlCmfIrAnAAhfd0a0xMGy/gOJiqM8JcWjnCMA25UrRL2XrMLC4mnLpi71rATOU62rcgNyczpKI74uHEQAGtQBHfoJjuAqK1JNAK5+j1kIT9gr1F0CC2iJ+68DOI+dveK2lkGqyNYx+eKeTjJSKO4bfzQiM0oBg9eIwqtU3Wn+sSQEg74MzrMjEfaorXh7X+LdO4DwA7dNyEurnYEgmjvjJoNbcxgjhbLSkTe3LFAX7iUia79VIqgD80bxgwoCWyKiSiCKARb/krBWOCOOuF1I6v6azxPHpwsQxC6AvFlOWW7BXsFY9NcCeGvV7l+9ZnLuRjdbjrgdk1b7PRv6aaRzmVk1I3KPBCPvFasP2XhNJXGgYmv7hxiyOci1Eoq4QcXEfr9VsrOEkcl0z4HI8yHx354Lc7Peck8XFvGCe9ElyhxmEtu/ySFQ3BOakjPikOOIA4XlUj3GsUk8qfwnePHVPBnKKm0jtaqjK6tA8uZyKG8jTNgICFZ9wKmsijFMPXVY2lt5zuPnw1V31D//IYjdXpcU1cMfXgZ06vld4anBSEv3WL3zCZaIJsRhxkB7ixumw4h5yieKNJFIVhbV6Ty4Yog9JFmQbAbRfKh1b8ltoym804+hOH8n7oWVqSbtzuylg7DPCIVOcWdUNraXYgmgtXDM6vq0SsDK1j2diz4ywM2BlBSsnCyAdt1NN5gZyMfOufZ3a8SKdwTaRH3bFh6BmfLEZ8NgYbeJQX7GrVbBU5kHT9+k2g3Klchapmqv8mzl0uKvX1av2hW6ce5xo+owa9Qk/Gza4j4o74bVl8tJ/iYClX4kpHY6kek/TOA/Sxj/IvWb1QZvpgmj0LNNCrLdrLUiTDG3lodE9j+Lr8qhmgL8S78=" + ] + }, + { + "data_path": "action_result.data.*.internetMessageHeaders.X-MS-Exchange-AntiSpam-MessageData-Original-ChunkCount", + "data_type": "string", + "example_values": [ + "1" + ] + }, { "data_path": "action_result.data.*.internetMessageHeaders.X-MS-Exchange-CrossTenant-AuthAs", "data_type": "string", @@ -3493,6 +4092,13 @@ "15.20.3109.017" ] }, + { + "data_path": "action_result.data.*.internetMessageHeaders.X-MS-Exchange-Transport-CrossTenantHeadersPromoted", + "data_type": "string", + "example_values": [ + "DM6NAM11FT064.eop-nam11.prod.protection.outlook.com" + ] + }, { "data_path": "action_result.data.*.internetMessageHeaders.X-MS-Exchange-Transport-CrossTenantHeadersStamped", "data_type": "string", @@ -3500,6 +4106,13 @@ "BN6PR18MB1492" ] }, + { + "data_path": "action_result.data.*.internetMessageHeaders.X-MS-Exchange-Transport-CrossTenantHeadersStripped", + "data_type": "string", + "example_values": [ + "DM6NAM11FT064.eop-nam11.prod.protection.outlook.com" + ] + }, { "data_path": "action_result.data.*.internetMessageHeaders.X-MS-Exchange-Transport-EndToEndLatency", "data_type": "string", @@ -3521,6 +4134,13 @@ "4b1ef179-4fe7-4248-7ec0-08d81367956e" ] }, + { + "data_path": "action_result.data.*.internetMessageHeaders.X-MS-Office365-Filtering-Correlation-Id-Prvs", + "data_type": "string", + "example_values": [ + "0c3038e5-2c60-453b-188f-08da6ed1ea0c" + ] + }, { "data_path": "action_result.data.*.internetMessageHeaders.X-MS-Oob-TLC-OOBClassifiers", "data_type": "string", @@ -3570,6 +4190,20 @@ "La+CSxAnpzVJOXq7njrFPhIbsh0khleSwldy+W8NYDRsoyyPruPIiId4Avama7JyfzrxoExzhLk5pDn2lGPAJIpdcguiDSsDQg5T+iBCJgFeaEJXjhstECMi842/JGawB9WsiGw9Q/PpvjO5H/2fNLlQZVZW3AAQVZSsX3az4iOsv1Ggj4aYZRMKHmPAtniWOEtQD7zAEWC0jIZf613lWy3vxHfb/3+pV9X8zqPqazbyGy5Q14PICSNkKnvIw8rmeqJV8eSHhvR51Lchib6OIN4xOpLWxkSkBTt5B95RUPnpgPvgp2yLo0Q+EYRIabLDQ0kMsv+24+RnFmr9vo2gRNuFusw8iEPsVEQyhfgIWtBtsBpyvyykxcfa6lIdzQhixZH3Tlkdh1kb15wFS3Ooz3CjaWbY8jcUot5l1p08Ypsj6r7CpIo3xE6jE0x/EeUkDK3Fu/Ol0pOsJ1N5W4iJLdjqSQM3l/t9QWlcPhD8s6D7D7JM5OUHCeFEPr7sSL+P/5zTgBaeUvwtZrlQSH2GHc+5gPW8rkwlwJLJftVEid0gO2PUOrzItzME5PXYAcdx++sF3XC1YMPLet/jMpX8T7/z7+hxFxNyifgmGJ+DkNOec7yGkkcLBz6iCaHx7OrRGwDHIcdAtV85wCk3NEDDiKyHivQpwp/gY55W+wkLe7aqSHmFzm1rUSslx+DWz8w2EgSjJxOmf0JkoNKbTFl3FObkocR0lUUQUnETuoAXUqvpWGD5B69W9XXUM8c43ozz2oBZseheSAtkLil3tMIr/CMCMILPX/LdoErNtkmiFXCPqaLFSSeyO61oCMl6Ezndtwp22nwMPUg5ofG0kdqFuTW122umhy9C6h5BcREaLhWclSyqDoZPB9RvkRlI2kTRwuwbuFW3iOMzmVwxLIQH9K5JkxdMvC3hvNpjVgz7Q2ZnEF3xSNqeoWVQvkaIe8rQLUc8s+HMRUmSERGdfSuQJAx47g8PDs9s3rS/ThUSzIaljJPbUgXEnFg/G6h3I/yXLj2Nj2OG50snoI5jJmE4+69YmNwasdDZuYpnuQeFgu11HtsLniDthJdjEJyYC1utZNt9hgA+6JlLnm7Dxb43cSIiW8ev+3X+b2kREj2k/m8fSz7YgtoCB8AkuiVXRaH3EUiq8XCExbbWeynKRgwCZ6bzvfSiT3+cg+QQKPHFc/cgot56ta6X80tjhFodpTQNTE6V6C9QFHJ3JCVhsSzVifJAc8crI5hAcPbKFEIjinENcfpF/8reo2Yr1xFElhoX" ] }, + { + "data_path": "action_result.data.*.internetMessageHeaders.X-Microsoft-Antispam-Message-Info-Original", + "data_type": "string", + "example_values": [ + "MTrWp0GiNTxQrZWPlJ6veyKekVjJA0FKYcYQlNCKCrjhAtIn4oDZCbWPNm21Zr7mX+CXhspXNSQSEjpIERhcHIWABmuzCF/vnMr0xwLTzuh2T0si6wgTdha+BdCpnx/kvbN+TMK3rCmD9ro6qHf/v1dTbLKJUZ3Cwfl+LoqJLCkw+T8E7/De1QBlCJrKVGfSztXncKPdvPxC2Qjw/QoPmYp7oFbqW8uwNZX1q8HmAXfLzYPeOuLDE/h4s61EeZGvIY7nBMwm6DwKdTqfmQqy3+BTMfoTaN/82aHLgfBI8V0NbiPVvbKbUU8UOusHZM5H6pzOpZFOSsS7yWz1jpIvKK5CJtNUK5XkOCLxv06yzbWib2abzwEhoLUBHYhJGnwNaIznz/C7a6vZLPe1hNxyLBv0/SyYmt1m9v0vB3TSdSH2V+Ork2OK5nz/r1KcOScedjs14GZpifgjEXiIhK4eJlTkI8LE7HnqXr+82C39t13fqV8L8oRYjGiJJE9wpGJIhMa4PQYwgP0D2cQGrVwuVK2qP01TsSE+NWOXyB8hAYn11K/wCnq4TqtwRbptF9aiw0k45eDHfvB/sBARv37sajixtW4QuFQ3eYI9bVVfllmcpnKj5VUD1mdMAnkgpOCiQSEiSI6Tlo9cEycBulSc4fmocQoev7eUTFw43FDjmRpebuNF0lmm7OcvXgS8jBJSzkbLPrrsqTj1fluowoLjQTQsSPn/LK5LdOdCt7x70/BaweDCm9VdcGgh5Mqe0Qp4GxnBSpS61OCmDYZEkCL5W1A+M7Ah9mANYucdydHU9bLxJBcoi42VIDK6oYaKs3oobr0k1M/dk/pjDT65LuHwsA==" + ] + }, + { + "data_path": "action_result.data.*.internetMessageHeaders.X-Microsoft-Antispam-Untrusted", + "data_type": "string", + "example_values": [ + "BCL:0;" + ] + }, { "data_path": "action_result.data.*.internetMessageHeaders.X-Originating-IP", "data_type": "string", @@ -3591,17 +4225,60 @@ "test html" ] }, + { + "data_path": "action_result.data.*.internetMessageHeaders.x-ms-exchange-antispam-relay", + "data_type": "string", + "example_values": [ + "0" + ] + }, + { + "data_path": "action_result.data.*.internetMessageHeaders.x-ms-exchange-calendar-series-instance-id", + "data_type": "string", + "example_values": [ + "BAAAAIIA4AB0xbcQGoLgCAAAAAAhGy3GuqDYAQAAAAAAAAAAEAAAAMqUNBGdAN9NtAV6x5ZM9JU=" + ] + }, + { + "data_path": "action_result.data.*.internetMessageHeaders.x-ms-exchange-senderadcheck", + "data_type": "string", + "example_values": [ + "1" + ] + }, + { + "data_path": "action_result.data.*.internetMessageHeaders.x-ms-traffictypediagnostic", + "data_type": "string", + "example_values": [ + "BYAPR18MB2408:EE_MeetingMessage|BL1PR18MB4325:EE_MeetingMessage|DM6NAM11FT064:EE_|CH0PR11MB5427:EE_" + ] + }, { "data_path": "action_result.data.*.internetMessageId", "data_type": "string", "example_values": [ - "", - "<5eeb2fbe.1c69fb81.22b4b.676a@mx.google.com>" + "" ], "contains": [ "msgoffice365 internet message id" ] }, + { + "data_path": "action_result.data.*.isAllDay", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, + { + "data_path": "action_result.data.*.isDelegated", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, { "data_path": "action_result.data.*.isDeliveryReceiptRequested", "data_type": "boolean", @@ -3618,6 +4295,14 @@ false ] }, + { + "data_path": "action_result.data.*.isOutOfDate", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, { "data_path": "action_result.data.*.isRead", "data_type": "boolean", @@ -3638,8 +4323,21 @@ "data_path": "action_result.data.*.lastModifiedDateTime", "data_type": "string", "example_values": [ - "2017-10-26T01:31:43Z", - "2020-06-18T09:11:32Z" + "2017-10-26T01:31:43Z" + ] + }, + { + "data_path": "action_result.data.*.meetingMessageType", + "data_type": "string", + "example_values": [ + "meetingRequest" + ] + }, + { + "data_path": "action_result.data.*.meetingRequestType", + "data_type": "string", + "example_values": [ + "newMeetingRequest" ] }, { @@ -3652,23 +4350,74 @@ "AQMkADU3NDk3MzJlLTY3MDQtNDE2Ny1iZDk1LTc4YjEwYzhmZDc5YQAuAAADyW3X5P7Hb0_MMHKonvdoWQEAQSl1b8BFiEmbqZql_JiUtwAAAgEMAAAA" ] }, + { + "data_path": "action_result.data.*.previousEndDateTime", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.previousLocation", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.previousStartDateTime", + "data_type": "string" + }, + { + "data_path": "action_result.data.*.previousEndDateTime.dateTime", + "data_type": "string", + "example_values": [ + "2022-05-09T13:30:00.0000000" + ] + }, + { + "data_path": "action_result.data.*.previousEndDateTime.timeZone", + "data_type": "string", + "example_values": [ + "UTC" + ] + }, + { + "data_path": "action_result.data.*.previousStartDateTime.dateTime", + "data_type": "string", + "example_values": [ + "2022-05-09T13:00:00.0000000" + ] + }, + { + "data_path": "action_result.data.*.previousStartDateTime.timeZone", + "data_type": "string", + "example_values": [ + "UTC" + ] + }, { "data_path": "action_result.data.*.receivedDateTime", "data_type": "string", "example_values": [ - "2017-10-26T01:31:43Z", - "2020-06-18T09:11:31Z" + "2017-10-26T01:31:43Z" ] }, + { + "data_path": "action_result.data.*.recurrence", + "data_type": "string" + }, { "data_path": "action_result.data.*.replyTo", "data_type": "string" }, + { + "data_path": "action_result.data.*.responseRequested", + "data_type": "boolean", + "example_values": [ + true, + false + ] + }, { "data_path": "action_result.data.*.sender.emailAddress.address", "data_type": "string", "example_values": [ - "test@testdomain.onmicrosoft.com" + "test@testdomain.abc.com" ], "contains": [ "email" @@ -3688,16 +4437,28 @@ "data_path": "action_result.data.*.sentDateTime", "data_type": "string", "example_values": [ - "2017-10-26T01:31:35Z", - "2020-06-18T09:11:26Z" + "2017-10-26T01:31:35Z" + ] + }, + { + "data_path": "action_result.data.*.startDateTime.dateTime", + "data_type": "string", + "example_values": [ + "2022-07-26T09:00:00.0000000" + ] + }, + { + "data_path": "action_result.data.*.startDateTime.timeZone", + "data_type": "string", + "example_values": [ + "UTC" ] }, { "data_path": "action_result.data.*.subject", "data_type": "string", "example_values": [ - "more attachments", - "test html" + "more attachments" ], "contains": [ "msgoffice365 subject" @@ -3707,7 +4468,7 @@ "data_path": "action_result.data.*.toRecipients.*.emailAddress.address", "data_type": "string", "example_values": [ - "Test@testdomain.onmicrosoft.com" + "Test@testdomain.abc.com" ], "contains": [ "email" @@ -3720,6 +4481,20 @@ "Test Name" ] }, + { + "data_path": "action_result.data.*.type", + "data_type": "string", + "example_values": [ + "singleInstance" + ] + }, + { + "data_path": "action_result.data.*.vaultId", + "data_type": "string", + "example_values": [ + "ff89bab9ec1e063a0f100aa7b0ac5fbc7425ab22" + ] + }, { "data_path": "action_result.data.*.webLink", "data_type": "string", @@ -3832,7 +4607,7 @@ "data_path": "action_result.parameter.email_address", "data_type": "string", "example_values": [ - "user@onmicrosoft.com" + "user@abc.com" ], "contains": [ "email" @@ -3884,7 +4659,6 @@ "data_path": "action_result.parameter.properties_list", "data_type": "string", "example_values": [ - "subject", "subject,receivedDateTime" ] }, @@ -3892,8 +4666,7 @@ "data_path": "action_result.data.*.@odata.context", "data_type": "string", "example_values": [ - "https://graph.microsoft.com/v1.0/$metadata#users('user%40.onmicrosoft.com')/messages(internetMessageHeaders,body,uniqueBody,sender,subject)/$entity", - "https://graph.microsoft.com/v1.0/$metadata#users('user%40.onmicrosoft.com')/messages(internetMessageHeaders,body,uniqueBody,sender,subject,receivedDateTime)/$entity" + "https://test.abc.com/v1.0/$metadata#users('user%40.abc.com')/messages(internetMessageHeaders,body,uniqueBody,sender,subject)/$entity" ], "contains": [ "url" @@ -3938,7 +4711,7 @@ "data_path": "action_result.data.*.internetMessageHeaders.Authentication-Results", "data_type": "string", "example_values": [ - "spf=pass (sender IP is 209.85.210.171) smtp.mailfrom=testdomain.com; .onmicrosoft.com; dkim=pass (signature was verified) header.d=testdomain.com.20150623.gappssmtp.com;.onmicrosoft.com; dmarc=pass action=none header.from=testdomain.com;compauth=pass reason=100" + "spf=pass (sender IP is 209.85.210.171) smtp.mailfrom=testdomain.com; .abc.com; dkim=pass (signature was verified) header.d=testdomain.com.20150623.gappssmtp.com;.abc.com; dmarc=pass action=none header.from=testdomain.com;compauth=pass reason=100" ] }, { @@ -4001,21 +4774,21 @@ "data_path": "action_result.data.*.internetMessageHeaders.Message-ID", "data_type": "string", "example_values": [ - "<5eeb2fbe.1c69fb81.22b4b.676a@mx.google.com>" + "<5eeb2fbe.1c69fb81.22b4b.676a@mx.test.com>" ] }, { "data_path": "action_result.data.*.internetMessageHeaders.Received", "data_type": "string", "example_values": [ - "from localhost.localdomain (host-240.splunk.com. [204.107.141.240]) by smtp.gmail.com with UTF8SMTPSA id ng12sm1923252pjb.15.2020.06.18.02.11.26 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 18 Jun 2020 02:11:26 -0700 (PDT)" + "from localhost.localdomain (host-240.test.com. [204.107.141.240]) by tset.abc.com with UTF8SMTPSA id ng12sm1923252pjb.15.2020.06.18.02.11.26 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 18 Jun 2020 02:11:26 -0700 (PDT)" ] }, { "data_path": "action_result.data.*.internetMessageHeaders.Received-SPF", "data_type": "string", "example_values": [ - "Pass (protection.outlook.com: domain of testdomain.com designates 209.85.210.171 as permitted sender) receiver=protection.outlook.com; client-ip=209.85.210.171; helo=mail-pf1-f171.google.com;" + "Pass (protection.test.com: domain of testdomain.com designates 209.85.210.171 as permitted sender) receiver=protection.test.com; client-ip=209.85.210.171; helo=mail-pf1-f171.test.com;" ] }, { @@ -4081,7 +4854,7 @@ "data_path": "action_result.data.*.internetMessageHeaders.X-Forefront-Antispam-Report", "data_type": "string", "example_values": [ - "CIP:209.85.210.171;CTRY:US;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:SFE;H:mail-pf1-f171.google.com;PTR:mail-pf1-f171.google.com;CAT:NONE;SFTY:;SFS:;DIR:INB;SFP:;" + "CIP:209.85.210.171;CTRY:US;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:SFE;H:mail-pf1-f171.test.com;PTR:mail-pf1-f171.test.com;CAT:NONE;SFTY:;SFS:;DIR:INB;SFP:;" ] }, { @@ -4529,7 +5302,7 @@ "email" ], "example_values": [ - "test@testdomain.onmicrosoft.com" + "test@testdomain.abc.com" ] }, { @@ -4573,8 +5346,7 @@ "data_path": "action_result.parameter.query", "data_type": "string", "example_values": [ - "$filter=contains(subject,'Urgent')", - "$orderby=propertyName desc" + "$filter=contains(subject,'Urgent')" ] }, { @@ -4592,7 +5364,7 @@ "email" ], "example_values": [ - "test@testdomain.onmicrosoft.com" + "test@testdomain.abc.com" ] }, { @@ -4616,7 +5388,7 @@ "data_path": "action_result.data.*.@odata.type", "data_type": "string", "example_values": [ - "#microsoft.graph.eventMessageRequests" + "#test.abc.eventMessageRequests" ] }, { @@ -4644,7 +5416,7 @@ "email" ], "example_values": [ - "test@testdomain.onmicrosoft.com" + "test@testdomain.abc.com" ] }, { @@ -4700,7 +5472,7 @@ "email" ], "example_values": [ - "test@testdomain.onmicrosoft.com" + "test@testdomain.abc.com" ] }, { @@ -4763,7 +5535,7 @@ "data_path": "action_result.data.*.from.emailAddress.address", "data_type": "string", "example_values": [ - "test@testdomain.onmicrosoft.com" + "test@testdomain.abc.com" ], "contains": [ "email" @@ -4812,8 +5584,7 @@ "data_path": "action_result.data.*.internetMessageId", "data_type": "string", "example_values": [ - "", - "" + "" ], "contains": [ "msgoffice365 internet message id" @@ -4987,7 +5758,7 @@ "data_path": "action_result.data.*.sender.emailAddress.address", "data_type": "string", "example_values": [ - "test@testdomain.onmicrosoft.com" + "test@testdomain.abc.com" ], "contains": [ "email" @@ -5035,7 +5806,7 @@ "data_path": "action_result.data.*.toRecipients.*.emailAddress.address", "data_type": "string", "example_values": [ - "Test@testdomain.onmicrosoft.com" + "Test@testdomain.abc.com" ], "contains": [ "email" @@ -5055,6 +5826,17 @@ "singleInstance" ] }, + { + "data_path": "action_result.data.*.vaultId", + "data_type": "string", + "example_values": [ + "719dbf72d7c0bc89d7e34306c08a0b66191902b9" + ], + "contains": [ + "sha1", + "vault id" + ] + }, { "data_path": "action_result.data.*.webLink", "data_type": "string", @@ -5162,7 +5944,7 @@ "email" ], "example_values": [ - "test@testdomain.onmicrosoft.com" + "test@testdomain.abc.com" ] }, { @@ -5180,7 +5962,7 @@ "data_path": "action_result.data.*.@odata.context", "data_type": "string", "example_values": [ - "https://graph.microsoft.com/v1.0/$metadata#users('abc%def.onmicrosoft.com')/mailFolders/$entity" + "https://test.abc.com/v1.0/$metadata#users('abc%def.test.com')/mailFolders/$entity" ], "contains": [ "url" @@ -5349,7 +6131,7 @@ "email" ], "example_values": [ - "test@testdomain.onmicrosoft.com" + "test@testdomain.abc.com" ] }, { diff --git a/office365_connector.py b/office365_connector.py index cbfcce9..63a8f40 100644 --- a/office365_connector.py +++ b/office365_connector.py @@ -538,7 +538,7 @@ def _process_response(self, r, action_result): return self._process_json_response(r, action_result) # Process an HTML response, Do this no matter what the api talks. - # There is a high chance of a PROXY in between phantom and the rest of + # There is a high chance of a PROXY in between Splunk SOAR and the rest of # world, in case of errors, PROXY's return HTML, this function parses # the error and adds it to the action_result. if 'html' in r.headers.get('Content-Type', ''): @@ -569,17 +569,22 @@ def _make_rest_call(self, action_result, url, verify=True, headers={}, params=No except AttributeError: return RetVal(action_result.set_status(phantom.APP_ERROR, "Invalid method: {0}".format(method)), resp_json) - try: - r = request_func( - url, - data=data, - headers=headers, - verify=verify, - params=params, - timeout=MSGOFFICE365_DEFAULT_REQUEST_TIMEOUT) - except Exception as e: - error_msg = _get_error_message_from_exception(e) - return RetVal(action_result.set_status(phantom.APP_ERROR, "Error connecting to server. {0}".format(error_msg)), resp_json) + for _ in range(self._number_of_retries): + try: + r = request_func( + url, + data=data, + headers=headers, + verify=verify, + params=params, + timeout=MSGOFFICE365_DEFAULT_REQUEST_TIMEOUT) + except Exception as e: + error_msg = _get_error_message_from_exception(e) + return RetVal(action_result.set_status(phantom.APP_ERROR, "Error connecting to server. {0}".format(error_msg)), resp_json) + if r.status_code != 502: + break + self.debug_print("Received 502 status code from the server") + time.sleep(self._retry_wait_time) if download: if 200 <= r.status_code < 399: @@ -591,7 +596,7 @@ def _make_rest_call(self, action_result, url, verify=True, headers={}, params=No def _get_asset_name(self, action_result): - rest_endpoint = PHANTOM_ASSET_INFO_URL.format(url=self.get_phantom_base_url(), asset_id=self._asset_id) + rest_endpoint = SPLUNK_SOAR_ASSET_INFO_URL.format(url=self.get_phantom_base_url(), asset_id=self._asset_id) ret_val, resp_json = self._make_rest_call(action_result, rest_endpoint, False) @@ -614,7 +619,7 @@ def _update_container(self, action_result, container_id, container): :param container: container's payload to update :return: status phantom.APP_ERROR/phantom.APP_SUCCESS with status message """ - rest_endpoint = PHANTOM_CONTAINER_INFO_URL.format(url=self.get_phantom_base_url(), container_id=container_id) + rest_endpoint = SPLUNK_SOAR_CONTAINER_INFO_URL.format(url=self.get_phantom_base_url(), container_id=container_id) try: data = json.dumps(container) @@ -635,7 +640,7 @@ def _update_container(self, action_result, container_id, container): def _get_phantom_base_url(self, action_result): - ret_val, resp_json = self._make_rest_call(action_result, PHANTOM_SYS_INFO_URL.format(url=self.get_phantom_base_url()), False) + ret_val, resp_json = self._make_rest_call(action_result, SPLUNK_SOAR_SYS_INFO_URL.format(url=self.get_phantom_base_url()), False) if phantom.is_fail(ret_val): return (ret_val, None) @@ -644,7 +649,7 @@ def _get_phantom_base_url(self, action_result): if not phantom_base_url: return (action_result.set_status(phantom.APP_ERROR, - "Phantom Base URL not found in System Settings. Please specify this value in System Settings"), None) + "Splunk SOAR Base URL not found in System Settings. Please specify this value in System Settings"), None) return (phantom.APP_SUCCESS, phantom_base_url) @@ -653,7 +658,7 @@ def _get_url_to_app_rest(self, action_result=None): if not action_result: action_result = ActionResult() - # get the phantom ip to redirect to + # get the Splunk SOAR ip to redirect to ret_val, phantom_base_url = self._get_phantom_base_url(action_result) if phantom.is_fail(ret_val): @@ -665,7 +670,7 @@ def _get_url_to_app_rest(self, action_result=None): if phantom.is_fail(ret_val): return (action_result.get_status(), None) - self.save_progress('Using Phantom base URL as: {0}'.format(phantom_base_url)) + self.save_progress('Using Splunk SOAR base URL as: {0}'.format(phantom_base_url)) app_json = self.get_app_json() @@ -699,7 +704,8 @@ def _make_rest_call_helper(self, action_result, endpoint, verify=True, headers=N msg = action_result.get_message() if msg and 'token is invalid' in msg or ('Access token has expired' in - msg) or ('ExpiredAuthenticationToken' in msg) or ('AuthenticationFailed' in msg): + msg) or ('ExpiredAuthenticationToken' in msg) or ('AuthenticationFailed' in msg) or ('TokenExpired' in + msg) or ('InvalidAuthenticationToken' in msg): self.debug_print("Token is invalid/expired. Hence, generating a new token.") ret_val = self._get_token(action_result) @@ -1132,6 +1138,18 @@ def _process_email_data(self, config, action_result, endpoint, email): return phantom.APP_SUCCESS + def _remove_tokens(self, action_result): + # checks whether the message includes any of the known error codes + if len(list(filter(lambda x: x in action_result.get_message(), MSGOFFICE365_ASSET_PARAM_CHECK_LIST_ERRORS))) > 0: + if not self._admin_access: + if self._state.get('non_admin_auth', {}).get('access_token'): + self._state['non_admin_auth'].pop('access_token') + if self._state.get('non_admin_auth', {}).get('refresh_token'): + self._state['non_admin_auth'].pop('refresh_token') + else: + if self._state.get('admin_auth', {}).get('access_token'): + self._state['admin_auth'].pop('access_token') + def _handle_test_connectivity(self, param): """ Function that handles the test connectivity action, it is much simpler than other action handlers.""" @@ -1242,6 +1260,7 @@ def _handle_test_connectivity(self, param): ret_val = self._get_token(action_result) if phantom.is_fail(ret_val): + self._remove_tokens(action_result) return action_result.get_status() params = {'$top': '1'} @@ -1355,6 +1374,28 @@ def _handle_delete_email(self, param): return action_result.set_status(phantom.APP_SUCCESS, "Successfully deleted email") + def _handle_delete_event(self, param): + + self.save_progress("In action handler for: {0}".format(self.get_action_identifier())) + action_result = self.add_action_result(ActionResult(dict(param))) + + email_addr = param['email_address'] + message_id = param['id'] + send_decline_response = param.get('send_decline_response') + endpoint = "/users/{0}/events/{1}".format(email_addr, message_id) + method = "delete" + data = None + if send_decline_response: + method = "post" + endpoint += '/decline' + data = json.dumps({'sendResponse': True}) + + ret_val, _ = self._make_rest_call_helper(action_result, endpoint, method=method, data=data) + if phantom.is_fail(ret_val): + return action_result.get_status() + + return action_result.set_status(phantom.APP_SUCCESS, "Successfully deleted event") + def _handle_oof_check(self, param): self.save_progress('In action handler for: {0}'.format(self.get_action_identifier())) action_result = self.add_action_result(ActionResult(dict(param))) @@ -1671,10 +1712,10 @@ def _handle_get_email(self, param): response['internetMessageHeaders'] = header_response.get('internetMessageHeaders') if param.get('download_attachments', False) and response.get('hasAttachments'): - endpoint += '/attachments' attachment_endpoint = '{}?$expand=microsoft.graph.itemattachment/item'.format(endpoint) ret_val, attach_resp = self._make_rest_call_helper(action_result, attachment_endpoint) + if phantom.is_fail(ret_val): return action_result.get_status() @@ -1689,6 +1730,16 @@ def _handle_get_email(self, param): response['attachments'] = attach_resp['value'] + if response.get('@odata.type') in ["#microsoft.graph.eventMessage", "#microsoft.graph.eventMessageRequest", + "#microsoft.graph.eventMessageResponse"]: + + event_endpoint = '{}/?$expand=Microsoft.Graph.EventMessage/Event'.format(endpoint) + ret_val, event_resp = self._make_rest_call_helper(action_result, event_endpoint) + if phantom.is_fail(ret_val): + return action_result.get_status() + + response['event'] = event_resp['event'] + if 'internetMessageHeaders' in response: response['internetMessageHeaders'] = self._flatten_headers(response['internetMessageHeaders']) @@ -1703,6 +1754,13 @@ def _handle_get_email(self, param): if attachment_type == '#microsoft.graph.itemAttachment': attachment['itemType'] = attachment.get('item', {}).get('@odata.type', '') + if param.get('download_email'): + subject = response.get('subject') + email_message = {'id': message_id, 'name': subject if subject else "email_message_{}".format(message_id)} + if not self._handle_item_attachment(email_message, self.get_container_id(), '/users/{0}/messages'.format(email_addr), action_result): + return action_result.set_status(phantom.APP_ERROR, 'Could not download the email. See logs for details') + response['vaultId'] = email_message['vaultId'] + action_result.add_data(response) return action_result.set_status(phantom.APP_SUCCESS, "Successfully fetched email") @@ -2348,6 +2406,9 @@ def handle_action(self, param): elif action_id == 'delete_email': ret_val = self._handle_delete_email(param) + elif action_id == 'delete_event': + ret_val = self._handle_delete_event(param) + elif action_id == 'get_email': ret_val = self._handle_get_email(param) @@ -2491,6 +2552,18 @@ def initialize(self): self._admin_consent = config.get('admin_consent') self._scope = config.get('scope') if config.get('scope') else None + self._number_of_retries = config.get("retry_count", MSGOFFICE365_DEFAULT_NUMBER_OF_RETRIES) + ret_val, self._number_of_retries = _validate_integer(self, self._number_of_retries, + "'Maximum attempts to retry the API call' asset configuration") + if phantom.is_fail(ret_val): + return self.get_status() + + self._retry_wait_time = config.get("retry_wait_time", MSGOFFICE365_DEFAULT_RETRY_WAIT_TIME) + ret_val, self._retry_wait_time = _validate_integer(self, self._retry_wait_time, + "'Delay in seconds between retries' asset configuration") + if phantom.is_fail(ret_val): + return self.get_status() + if not self._admin_access: if not self._scope: return self.set_status(phantom.APP_ERROR, "Please provide scope for non-admin access in the asset configuration") @@ -2512,9 +2585,6 @@ def initialize(self): if not admin_consent and action_id != 'test_connectivity': return self.set_status(phantom.APP_ERROR, MSGOFFICE365_RUN_CONNECTIVITY_MSG) - if not self._access_token: - return self.set_status(phantom.APP_ERROR, MSGOFFICE365_UNEXPECTED_ACCESS_TOKEN_ERR) - if not self._admin_access and action_id != 'test_connectivity' and (not self._access_token or not self._refresh_token): ret_val = self._get_token(action_result) diff --git a/office365_consts.py b/office365_consts.py index a4dbd90..f80c8a4 100644 --- a/office365_consts.py +++ b/office365_consts.py @@ -14,9 +14,9 @@ # and limitations under the License. TC_STATUS_SLEEP = 2 MSGOFFICE365_PER_PAGE_COUNT = 999 -PHANTOM_SYS_INFO_URL = "{url}rest/system_info" -PHANTOM_ASSET_INFO_URL = "{url}rest/asset/{asset_id}" -PHANTOM_CONTAINER_INFO_URL = "{url}rest/container/{container_id}" +SPLUNK_SOAR_SYS_INFO_URL = "{url}rest/system_info" +SPLUNK_SOAR_ASSET_INFO_URL = "{url}rest/asset/{asset_id}" +SPLUNK_SOAR_CONTAINER_INFO_URL = "{url}rest/container/{container_id}" O365_TIME_FORMAT = "%Y-%m-%dT%H:%M:%SZ" MSGOFFICE365_RUN_CONNECTIVITY_MSG = "Please run test connectivity first to complete authorization flow and "\ "generate a token that the app can use to make calls to the server " @@ -28,12 +28,12 @@ "displayName eq 'sync issues'" MSGOFFICE365_STATE_FILE_CORRUPT_ERR = "Error occurred while loading the state file. " \ "Resetting the state file with the default format. Please test the connectivity." -MSGOFFICE365_AUTHORIZE_TROUBLESHOOT_MSG = 'If authorization URL fails to communicate with your Phantom instance, check whether you have: '\ +MSGOFFICE365_AUTHORIZE_TROUBLESHOOT_MSG = 'If authorization URL fails to communicate with your Splunk SOAR instance, check whether you have: '\ ' 1. Specified the Web Redirect URL of your App -- The Redirect URL should be /result . '\ - ' 2. Configured the base URL of your Phantom Instance at Administration -> Company Settings -> Info' + ' 2. Configured the base URL of your Splunk SOAR Instance at Administration -> Company Settings -> Info' MSGOFFICE365_INVALID_PERMISSION_ERR = "Error occurred while saving the newly generated access token "\ "(in place of the expired token) in the state file." -MSGOFFICE365_INVALID_PERMISSION_ERR += " Please check the owner, owner group, and the permissions of the state file. The Phantom " +MSGOFFICE365_INVALID_PERMISSION_ERR += " Please check the owner, owner group, and the permissions of the state file. The Splunk SOAR " MSGOFFICE365_INVALID_PERMISSION_ERR += "user should have the correct access rights and ownership for the corresponding state file "\ "(refer to readme file for more information)." MSGOFFICE365_NO_DATA_FOUND = "No data found" @@ -41,7 +41,15 @@ MSGOFFICE365_ERR_EMPTY_RESPONSE = "Status Code {code}. Empty response and no information in the header." MSGOFFICE365_DEFAULT_REQUEST_TIMEOUT = 30 # in seconds +MSGOFFICE365_DEFAULT_NUMBER_OF_RETRIES = 3 +MSGOFFICE365_DEFAULT_RETRY_WAIT_TIME = 60 # in seconds MSGOFFICE365_CONTAINER_DESCRIPTION = 'Email ingested using MS Graph API - {last_modified_time}' +MSGOFFICE365_HTTP_401_STATUS_CODE = '401' +MSGOFFICE365_INVALID_CLIENT_ID_ERROR_CODE = 'AADSTS700016' +MSGOFFICE365_INVALID_TENANT_ID_FORMAT_ERROR_CODE = 'AADSTS900023' +MSGOFFICE365_INVALID_TENANT_ID_NOT_FOUND_ERROR_CODE = 'AADSTS90002' +MSGOFFICE365_ASSET_PARAM_CHECK_LIST_ERRORS = [MSGOFFICE365_HTTP_401_STATUS_CODE, MSGOFFICE365_INVALID_CLIENT_ID_ERROR_CODE, + MSGOFFICE365_INVALID_TENANT_ID_FORMAT_ERROR_CODE, MSGOFFICE365_INVALID_TENANT_ID_NOT_FOUND_ERROR_CODE] # Constants relating to '_get_error_message_from_exception' ERR_MSG_UNAVAILABLE = "Error message unavailable. Please check the asset configuration and|or action parameters" diff --git a/office365_get_email.html b/office365_get_email.html index b7ac359..e018b60 100644 --- a/office365_get_email.html +++ b/office365_get_email.html @@ -134,6 +134,7 @@

Data

To Has Attachments? Internet Message ID + Event ID {% for data in result.data %} @@ -199,6 +200,18 @@

Data

+ {% if data.event.id %} + + + {{ data.event.id }} +   + + + + {% else %} + None + {% endif %} {% endfor %} diff --git a/office365_list_events.html b/office365_list_events.html index 5305de1..4e067f9 100644 --- a/office365_list_events.html +++ b/office365_list_events.html @@ -126,6 +126,7 @@

Info

Data

+ @@ -133,6 +134,18 @@

Data

{% for data in result.data %} + {% if data.id %} + + {% else %} + + {% endif %} diff --git a/readme.html b/readme.html index ddfd602..0a9bb8a 100644 --- a/readme.html +++ b/readme.html @@ -31,7 +31,7 @@

Authentication

Once the app is created, follow the below-mentioned steps:
  • Under Certificates & secrets select New client secret. Enter the Description and select the desired duration in Expires. Click on Add. Note down this value somewhere secure, as it cannot be retrieved after closing the window.
    • -
  • Under Authentication, select Add a platform. In the Add a platform window, select Web. The Redirect URLs should be filled right here. We will get Redirect URLs from the Phantom asset we create below in the section titled Phantom Graph Asset.
    • +
  • Under Authentication, select Add a platform. In the Add a platform window, select Web. The Redirect URLs should be filled right here. We will get Redirect URLs from the Splunk SOAR asset we create below in the section titled Splunk SOAR Graph Asset.
  • Under API Permissions Click on Add a permission.
  • Under the Microsoft API section, select Microsoft Graph.
  • Provide the following Application permissions to the app:
    • @@ -42,17 +42,18 @@

    Authentication

    • For non-admin access, use User.Read (Delegated permission) instead (https://graph.microsoft.com/User.Read)
  • Group.Read.All (https://graph.microsoft.com/Group.Read.All) - It is required only if you want to run the list events action for the group's calendar and for the list groups and the list group members action.
  • Calendar.Read (https://graph.microsoft.com/Calendars.Read) - It is required only if you want to run the list events action for the user's calendar.
    • +
  • Calendars.ReadWrite (https://graph.microsoft.com/Calendars.ReadWrite) - It is required only if you want to run the delete event action from the user's calendar.
  • MailboxSettings.Read (https://graph.microsoft.com/MailboxSettings.Read) - It is required only if you want to run the oof status action.
After making these changes, click Add permissions, then select Grant admin consent for <your_organization_name_as_on_azure_portal> at the bottom of the screen. -

Phantom Graph Asset

+

Splunk SOAR Graph Asset

When creating an asset for the MS Graph for Office 365 app, place Application ID of the app created during the app registration on the Azure Portal in the Application ID field and place the client secret generated during the app registration process in the Application Secret field. Then, after filling out the Tenant field, click SAVE. Both the Application/Client ID and the Tenant ID can be found in the Overview tab on your app's Azure page.

After saving, a new field will appear in the Asset Settings tab. Take the URL found in the POST incoming for MS Graph for Office 365 to this location field and place it in the Redirect URLs field mentioned in the previous step. To this URL, add /result. After doing so the URL should look something like:

-https://<phantom_host>/rest/handler/msgraphforoffice365_0a0a4087-10e8-4c96-9872-b740ff26d8bb/<asset_name>/result +https://<splunk_soar_host>/rest/handler/msgraphforoffice365_0a0a4087-10e8-4c96-9872-b740ff26d8bb/<asset_name>/result


Once again, click SAVE at the bottom of the screen. @@ -74,9 +75,9 @@

Admin User Workflow

  • Configure the asset with required details while keeping the Admin Access Required as checked.
  • While configuring the asset for the first time, keep Admin Consent Already Provided as unchecked.
    • -
  • The Redirect URLs must be configured before executing test connectivity. To configure Redirect URLs, checkout the section titled Phantom Graph Asset above.
    • +
  • The Redirect URLs must be configured before executing test connectivity. To configure Redirect URLs, checkout the section titled Splunk SOAR Graph Asset above.
  • After setting up the asset and user, click the TEST CONNECTIVITY button.
    • -
  • A window should pop up and display a URL. You will be asked to open the link in a new tab. Open the link in the same browser so that you are logged into Splunk Phantom for the redirect. If you wish to use a different browser, log in to the Splunk Phantom first, and then open the provided link. This new tab will redirect to the Microsoft login page.
    • +
  • A window should pop up and display a URL. You will be asked to open the link in a new tab. Open the link in the same browser so that you are logged into Splunk SOAR for the redirect. If you wish to use a different browser, log in to the Splunk SOAR first, and then open the provided link. This new tab will redirect to the Microsoft login page.
  • Log in to the Microsoft account with the admin user.
  • You will be prompted to agree to the permissions requested by the App.
  • Review the requested permissions listed, then click Accept.
    • @@ -89,9 +90,9 @@

    Non-Admin User Workflow

    • Configure the asset with required details while keeping the Admin Access Required as unchecked. Admin Consent Already Provided config parameter will be ignored in the non-admin workflow.
    • Provide Access Scope parameter in the asset configuration. All the actions will get executed according to the scopes provided in the Access Scope config parameter.
      • -
    • The Redirect URLs must be configured before executing test connectivity. To configure Redirect URLs, checkout the section titled Phantom Graph Asset above.
      • +
    • The Redirect URLs must be configured before executing test connectivity. To configure Redirect URLs, checkout the section titled Splunk SOAR Graph Asset above.
    • After setting up the asset and user, click the TEST CONNECTIVITY button.
      • -
    • A window should pop up and display a URL. You will be asked to open the link in a new tab. Open the link in the same browser so that you are logged into Splunk Phantom for the redirect. If you wish to use a different browser, log in to the Splunk Phantom first, and then open the provided link. This new tab will redirect to the Microsoft login page.
      • +
    • A window should pop up and display a URL. You will be asked to open the link in a new tab. Open the link in the same browser so that you are logged into Splunk SOAR for the redirect. If you wish to use a different browser, log in to the Splunk SOAR first, and then open the provided link. This new tab will redirect to the Microsoft login page.
    • Log in to the Microsoft account.
    • You will be prompted to agree to the permissions requested by the App.
    • Review the requested permissions listed, then click Accept.
      • @@ -144,8 +145,8 @@

      State file path

    State file permissions

      -
    • File rights: rw-rw-r-- (664) (The phantom user should have read and write access for the state file)
      • -
    • File owner: Appropriate phantom user
      • +
    • File rights: rw-rw-r-- (664) (The Splunk SOAR user should have read and write access for the state file)
      • +
    • File owner: Appropriate Splunk SOAR user

    diff --git a/release_notes/unreleased.md b/release_notes/unreleased.md index fbcb2fd..727d18f 100644 --- a/release_notes/unreleased.md +++ b/release_notes/unreleased.md @@ -1 +1,6 @@ **Unreleased** +* Added the 'delete event' action +* Added 'download email' parameter in the 'get email' action +* Updated the 'get email' action to provide event related information +* Added 'retry_count' and 'retry_wait_time' asset configuration parameters to implement retry mechanism [PAPP-25674] +* Updated the asset configuration parameter name [PAPP-26294] \ No newline at end of file From 540d0f8904e94e7b9c688deffde8bd84b070ba19 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 12 Aug 2022 02:23:03 -0700 Subject: [PATCH 4/4] Release notes for version 2.7.0 --- LICENSE | 2 +- README.md | 168 +++++++++++++++++++++++++++++++----- release_notes/2.7.0.md | 5 ++ release_notes/unreleased.md | 5 -- 4 files changed, 153 insertions(+), 27 deletions(-) create mode 100644 release_notes/2.7.0.md diff --git a/LICENSE b/LICENSE index 9a2c915..6af04d8 100644 --- a/LICENSE +++ b/LICENSE @@ -198,4 +198,4 @@ distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and - limitations under the License. + limitations under the License. \ No newline at end of file diff --git a/README.md b/README.md index 3f48faf..6364fad 100644 --- a/README.md +++ b/README.md @@ -2,11 +2,11 @@ # MS Graph for Office 365 Publisher: Splunk -Connector Version: 2\.6\.0 +Connector Version: 2\.7\.0 Product Vendor: Microsoft Product Name: Office 365 \(MS Graph\) Product Version Supported (regex): "\.\*" -Minimum Product Version: 5\.2\.0 +Minimum Product Version: 5\.3\.0 This app connects to Office 365 using the MS Graph API to support investigate and generic actions related to the email messages and calendar events @@ -47,7 +47,7 @@ Once the app is created, follow the below-mentioned steps: - Under **Authentication** , select **Add a platform** . In the **Add a platform** window, select **Web** . The **Redirect URLs** should be filled right here. We will get **Redirect URLs** from - the Phantom asset we create below in the section titled **Phantom Graph Asset** . + the Splunk SOAR asset we create below in the section titled **Splunk SOAR Graph Asset** . - Under **API Permissions** Click on **Add a permission** . @@ -75,13 +75,16 @@ Once the app is created, follow the below-mentioned steps: - Calendar.Read (https://graph.microsoft.com/Calendars.Read) - It is required only if you want to run the **list events** action for the user's calendar. + - Calendars.ReadWrite (https://graph.microsoft.com/Calendars.ReadWrite) - It is required only + if you want to run the **delete event** action from the user's calendar. + - MailboxSettings.Read (https://graph.microsoft.com/MailboxSettings.Read) - It is required only if you want to run the **oof status** action. After making these changes, click **Add permissions** , then select **Grant admin consent for \** at the bottom of the screen. -## Phantom Graph Asset +## Splunk SOAR Graph Asset When creating an asset for the **MS Graph for Office 365** app, place **Application ID** of the app created during the app registration on the Azure Portal in the **Application ID** field and place @@ -95,7 +98,7 @@ URLs** field mentioned in the previous step. To this URL, add **/result** . Afte should look something like: -https://\/rest/handler/msgraphforoffice365_0a0a4087-10e8-4c96-9872-b740ff26d8bb/\/result +https://\/rest/handler/msgraphforoffice365_0a0a4087-10e8-4c96-9872-b740ff26d8bb/\/result Once again, click SAVE at the bottom of the screen. @@ -130,11 +133,11 @@ the window. To give this user permission to view assets, follow these steps: - While configuring the asset for the first time, keep **Admin Consent Already Provided** as unchecked. - The **Redirect URLs** must be configured before executing test connectivity. To configure - **Redirect URLs** , checkout the section titled **Phantom Graph Asset** above. + **Redirect URLs** , checkout the section titled **Splunk SOAR Graph Asset** above. - After setting up the asset and user, click the **TEST CONNECTIVITY** button. - A window should pop up and display a URL. You will be asked to open the link in a new tab. Open - the link in the same browser so that you are logged into Splunk Phantom for the redirect. If you - wish to use a different browser, log in to the Splunk Phantom first, and then open the provided + the link in the same browser so that you are logged into Splunk SOAR for the redirect. If you + wish to use a different browser, log in to the Splunk SOAR first, and then open the provided link. This new tab will redirect to the Microsoft login page. - Log in to the Microsoft account with the admin user. - You will be prompted to agree to the permissions requested by the App. @@ -154,11 +157,11 @@ the window. To give this user permission to view assets, follow these steps: - Provide **Access Scope** parameter in the asset configuration. All the actions will get executed according to the scopes provided in the **Access Scope** config parameter. - The **Redirect URLs** must be configured before executing test connectivity. To configure - **Redirect URLs** , checkout the section titled **Phantom Graph Asset** above. + **Redirect URLs** , checkout the section titled **Splunk SOAR Graph Asset** above. - After setting up the asset and user, click the **TEST CONNECTIVITY** button. - A window should pop up and display a URL. You will be asked to open the link in a new tab. Open - the link in the same browser so that you are logged into Splunk Phantom for the redirect. If you - wish to use a different browser, log in to the Splunk Phantom first, and then open the provided + the link in the same browser so that you are logged into Splunk SOAR for the redirect. If you + wish to use a different browser, log in to the Splunk SOAR first, and then open the provided link. This new tab will redirect to the Microsoft login page. - Log in to the Microsoft account. - You will be prompted to agree to the permissions requested by the App. @@ -226,9 +229,9 @@ Please check the permissions for the state file as mentioned below. #### State file permissions -- File rights: rw-rw-r-- (664) (The phantom user should have read and write access for the state - file) -- File owner: Appropriate phantom user +- File rights: rw-rw-r-- (664) (The Splunk SOAR user should have read and write access for the + state file) +- File owner: Appropriate Splunk SOAR user ### Note @@ -285,8 +288,8 @@ VARIABLE | REQUIRED | TYPE | DESCRIPTION **admin\_consent** | optional | boolean | Admin Consent Already Provided **scope** | optional | string | Access Scope \(for use with non\-admin access; space\-separated\) **ph\_2** | optional | ph | -**email\_address** | optional | string | User Email Mailbox \(On Poll\) -**folder** | optional | string | Mailbox folder name/folder path or the internal o365 folder ID to ingest \(On Poll\) +**email\_address** | optional | string | Email Address of the User \(On Poll\) +**folder** | optional | string | Mailbox folder name/folder path or the internal office365 folder ID to ingest \(On Poll\) **get\_folder\_id** | optional | boolean | Retrieve the folder ID for the provided folder name/folder path automatically and replace the folder parameter value \(On Poll\) **ph\_3** | optional | ph | **first\_run\_max\_emails** | optional | numeric | Maximum Containers for scheduled polling first time @@ -298,6 +301,8 @@ VARIABLE | REQUIRED | TYPE | DESCRIPTION **extract\_hashes** | optional | boolean | Extract Hashes **ingest\_eml** | optional | boolean | Ingest EML file for the itemAttachment **ingest\_manner** | optional | string | How to Ingest \(during ingestion, should the app get the latest emails or the oldest\) +**retry\_count** | optional | numeric | Maximum attempts to retry the API call \(Default\: 3\) +**retry\_wait\_time** | optional | numeric | Delay in seconds between retries \(Default\: 60\) ### Supported Actions [test connectivity](#action-test-connectivity) - Use supplied credentials to generate a token with MS Graph @@ -311,6 +316,7 @@ VARIABLE | REQUIRED | TYPE | DESCRIPTION [copy email](#action-copy-email) - Copy an email to a folder [move email](#action-move-email) - Move an email to a folder [delete email](#action-delete-email) - Delete an email +[delete event](#action-delete-event) - Delete an event from user calendar [get email](#action-get-email) - Get an email from the server [get email properties](#action-get-email-properties) - Get non\-standard email properties from the server [run query](#action-run-query) - Search emails @@ -423,7 +429,7 @@ action\_result\.data\.\*\.end\.timeZone | string | action\_result\.data\.\*\.hasAttachments | boolean | action\_result\.data\.\*\.hideAttendees | boolean | action\_result\.data\.\*\.iCalUId | string | -action\_result\.data\.\*\.id | string | +action\_result\.data\.\*\.id | string | `msgoffice365 event id` action\_result\.data\.\*\.importance | string | action\_result\.data\.\*\.isAllDay | boolean | action\_result\.data\.\*\.isCancelled | boolean | @@ -590,17 +596,17 @@ PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS DATA PATH | TYPE | CONTAINS --------- | ---- | -------- action\_result\.status | string | -action\_result\.parameter\.group\_id | string | `msgoffice365 group id` -action\_result\.parameter\.get\_transitive\_members | boolean | action\_result\.parameter\.filter | string | +action\_result\.parameter\.get\_transitive\_members | boolean | +action\_result\.parameter\.group\_id | string | `msgoffice365 group id` action\_result\.parameter\.limit | numeric | +action\_result\.data\.\*\.\@odata\.type | string | action\_result\.data\.\*\.businessPhones | string | action\_result\.data\.\*\.displayName | string | action\_result\.data\.\*\.givenName | string | action\_result\.data\.\*\.id | string | `msgoffice365 user id` action\_result\.data\.\*\.jobTitle | string | action\_result\.data\.\*\.mail | string | `email` -action\_result\.data\.\*\.\@odata\.type | string | action\_result\.data\.\*\.mobilePhone | string | action\_result\.data\.\*\.officeLocation | string | action\_result\.data\.\*\.preferredLanguage | string | @@ -802,6 +808,32 @@ action\_result\.message | string | summary\.total\_objects | numeric | summary\.total\_objects\_successful | numeric | +## action: 'delete event' +Delete an event from user calendar + +Type: **generic** +Read only: **False** + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**id** | required | Event ID to delete | string | `msgoffice365 event id` +**email\_address** | required | Email address of the mailbox owner | string | `email` +**send\_decline\_response** | optional | Send decline response to the organizer | boolean | + +#### Action Output +DATA PATH | TYPE | CONTAINS +--------- | ---- | -------- +action\_result\.status | string | +action\_result\.parameter\.email\_address | string | `email` +action\_result\.parameter\.id | string | `msgoffice365 event id` +action\_result\.parameter\.send\_decline\_response | boolean | +action\_result\.data | string | +action\_result\.summary | string | +action\_result\.message | string | +summary\.total\_objects | numeric | +summary\.total\_objects\_successful | numeric | + ## action: 'get email' Get an email from the server @@ -817,17 +849,21 @@ PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS **email\_address** | required | Email address of the mailbox owner | string | `email` **download\_attachments** | optional | Download attachments to vault | boolean | **extract\_headers** | optional | Extract email headers | boolean | +**download\_email** | optional | Download email to vault | boolean | #### Action Output DATA PATH | TYPE | CONTAINS --------- | ---- | -------- action\_result\.status | string | action\_result\.parameter\.download\_attachments | boolean | +action\_result\.parameter\.download\_email | boolean | action\_result\.parameter\.email\_address | string | `email` action\_result\.parameter\.extract\_headers | boolean | action\_result\.parameter\.id | string | `msgoffice365 message id` action\_result\.data\.\*\.\@odata\.context | string | `url` action\_result\.data\.\*\.\@odata\.etag | string | +action\_result\.data\.\*\.\@odata\.type | string | +action\_result\.data\.\*\.allowNewTimeProposals | string | action\_result\.data\.\*\.attachments\.\*\.\@odata\.mediaContentType | string | action\_result\.data\.\*\.attachments\.\*\.\@odata\.type | string | action\_result\.data\.\*\.attachments\.\*\.attachmentType | string | @@ -840,7 +876,7 @@ action\_result\.data\.\*\.attachments\.\*\.itemType | string | action\_result\.data\.\*\.attachments\.\*\.lastModifiedDateTime | string | action\_result\.data\.\*\.attachments\.\*\.name | string | action\_result\.data\.\*\.attachments\.\*\.size | numeric | -action\_result\.data\.\*\.attachments\.\*\.vaultId | string | `sha1` +action\_result\.data\.\*\.attachments\.\*\.vaultId | string | `sha1` `vault id` action\_result\.data\.\*\.bccRecipients\.email | string | `email` action\_result\.data\.\*\.bccRecipients\.name | string | action\_result\.data\.\*\.body\.content | string | @@ -853,6 +889,61 @@ action\_result\.data\.\*\.changeKey | string | action\_result\.data\.\*\.conversationId | string | action\_result\.data\.\*\.conversationIndex | string | action\_result\.data\.\*\.createdDateTime | string | +action\_result\.data\.\*\.endDateTime\.dateTime | string | +action\_result\.data\.\*\.endDateTime\.timeZone | string | +action\_result\.data\.\*\.event\.\@odata\.etag | string | +action\_result\.data\.\*\.event\.allowNewTimeProposals | boolean | +action\_result\.data\.\*\.event\.attendees\.\*\.emailAddress\.address | string | `email` +action\_result\.data\.\*\.event\.attendees\.\*\.emailAddress\.name | string | +action\_result\.data\.\*\.event\.attendees\.\*\.status\.response | string | +action\_result\.data\.\*\.event\.attendees\.\*\.status\.time | string | +action\_result\.data\.\*\.event\.attendees\.\*\.type | string | +action\_result\.data\.\*\.event\.body\.content | string | +action\_result\.data\.\*\.event\.body\.contentType | string | +action\_result\.data\.\*\.event\.bodyPreview | string | +action\_result\.data\.\*\.event\.calendar\@odata\.associationLink | string | `url` +action\_result\.data\.\*\.event\.calendar\@odata\.navigationLink | string | `url` +action\_result\.data\.\*\.event\.changeKey | string | +action\_result\.data\.\*\.event\.createdDateTime | string | +action\_result\.data\.\*\.event\.end\.dateTime | string | +action\_result\.data\.\*\.event\.end\.timeZone | string | +action\_result\.data\.\*\.event\.hasAttachments | boolean | +action\_result\.data\.\*\.event\.hideAttendees | boolean | +action\_result\.data\.\*\.event\.iCalUId | string | +action\_result\.data\.\*\.event\.id | string | `msgoffice365 event id` +action\_result\.data\.\*\.event\.importance | string | +action\_result\.data\.\*\.event\.isAllDay | boolean | +action\_result\.data\.\*\.event\.isCancelled | boolean | +action\_result\.data\.\*\.event\.isDraft | boolean | +action\_result\.data\.\*\.event\.isOnlineMeeting | boolean | +action\_result\.data\.\*\.event\.isOrganizer | boolean | +action\_result\.data\.\*\.event\.isReminderOn | boolean | +action\_result\.data\.\*\.event\.lastModifiedDateTime | string | +action\_result\.data\.\*\.event\.location\.displayName | string | +action\_result\.data\.\*\.event\.location\.locationType | string | +action\_result\.data\.\*\.event\.location\.uniqueIdType | string | +action\_result\.data\.\*\.event\.occurrenceId | string | +action\_result\.data\.\*\.event\.onlineMeeting\.joinUrl | string | `url` +action\_result\.data\.\*\.event\.onlineMeetingProvider | string | +action\_result\.data\.\*\.event\.onlineMeetingUrl | string | +action\_result\.data\.\*\.event\.organizer\.emailAddress\.address | string | `email` +action\_result\.data\.\*\.event\.organizer\.emailAddress\.name | string | +action\_result\.data\.\*\.event\.originalEndTimeZone | string | +action\_result\.data\.\*\.event\.originalStartTimeZone | string | +action\_result\.data\.\*\.event\.recurrence | string | +action\_result\.data\.\*\.event\.reminderMinutesBeforeStart | numeric | +action\_result\.data\.\*\.event\.responseRequested | boolean | +action\_result\.data\.\*\.event\.responseStatus\.response | string | +action\_result\.data\.\*\.event\.responseStatus\.time | string | +action\_result\.data\.\*\.event\.sensitivity | string | +action\_result\.data\.\*\.event\.seriesMasterId | string | +action\_result\.data\.\*\.event\.showAs | string | +action\_result\.data\.\*\.event\.start\.dateTime | string | +action\_result\.data\.\*\.event\.start\.timeZone | string | +action\_result\.data\.\*\.event\.subject | string | +action\_result\.data\.\*\.event\.transactionId | string | +action\_result\.data\.\*\.event\.type | string | +action\_result\.data\.\*\.event\.webLink | string | `url` action\_result\.data\.\*\.flag\.flagStatus | string | action\_result\.data\.\*\.from\.emailAddress\.address | string | `email` action\_result\.data\.\*\.from\.emailAddress\.name | string | `email` @@ -860,8 +951,12 @@ action\_result\.data\.\*\.hasAttachments | boolean | action\_result\.data\.\*\.id | string | `msgoffice365 message id` action\_result\.data\.\*\.importance | string | action\_result\.data\.\*\.inferenceClassification | string | +action\_result\.data\.\*\.internetMessageHeaders\.ARC\-Authentication\-Results | string | +action\_result\.data\.\*\.internetMessageHeaders\.ARC\-Message\-Signature | string | +action\_result\.data\.\*\.internetMessageHeaders\.ARC\-Seal | string | action\_result\.data\.\*\.internetMessageHeaders\.Accept\-Language | string | action\_result\.data\.\*\.internetMessageHeaders\.Authentication\-Results | string | +action\_result\.data\.\*\.internetMessageHeaders\.Authentication\-Results\-Original | string | action\_result\.data\.\*\.internetMessageHeaders\.Content\-Language | string | action\_result\.data\.\*\.internetMessageHeaders\.Content\-Transfer\-Encoding | string | action\_result\.data\.\*\.internetMessageHeaders\.Content\-Type | string | @@ -882,10 +977,13 @@ action\_result\.data\.\*\.internetMessageHeaders\.To | string | action\_result\.data\.\*\.internetMessageHeaders\.X\-EOPAttributedMessage | string | action\_result\.data\.\*\.internetMessageHeaders\.X\-EOPTenantAttributedMessage | string | action\_result\.data\.\*\.internetMessageHeaders\.X\-Forefront\-Antispam\-Report | string | +action\_result\.data\.\*\.internetMessageHeaders\.X\-Forefront\-Antispam\-Report\-Untrusted | string | action\_result\.data\.\*\.internetMessageHeaders\.X\-Gm\-Message\-State | string | action\_result\.data\.\*\.internetMessageHeaders\.X\-Google\-DKIM\-Signature | string | action\_result\.data\.\*\.internetMessageHeaders\.X\-Google\-Smtp\-Source | string | action\_result\.data\.\*\.internetMessageHeaders\.X\-MS\-Exchange\-AntiSpam\-MessageData | string | +action\_result\.data\.\*\.internetMessageHeaders\.X\-MS\-Exchange\-AntiSpam\-MessageData\-Original\-0 | string | +action\_result\.data\.\*\.internetMessageHeaders\.X\-MS\-Exchange\-AntiSpam\-MessageData\-Original\-ChunkCount | string | action\_result\.data\.\*\.internetMessageHeaders\.X\-MS\-Exchange\-CrossTenant\-AuthAs | string | action\_result\.data\.\*\.internetMessageHeaders\.X\-MS\-Exchange\-CrossTenant\-AuthSource | string | action\_result\.data\.\*\.internetMessageHeaders\.X\-MS\-Exchange\-CrossTenant\-FromEntityHeader | string | @@ -905,10 +1003,13 @@ action\_result\.data\.\*\.internetMessageHeaders\.X\-MS\-Exchange\-Organization\ action\_result\.data\.\*\.internetMessageHeaders\.X\-MS\-Exchange\-Organization\-Network\-Message\-Id | string | action\_result\.data\.\*\.internetMessageHeaders\.X\-MS\-Exchange\-Organization\-SCL | string | action\_result\.data\.\*\.internetMessageHeaders\.X\-MS\-Exchange\-Processed\-By\-BccFoldering | string | +action\_result\.data\.\*\.internetMessageHeaders\.X\-MS\-Exchange\-Transport\-CrossTenantHeadersPromoted | string | action\_result\.data\.\*\.internetMessageHeaders\.X\-MS\-Exchange\-Transport\-CrossTenantHeadersStamped | string | +action\_result\.data\.\*\.internetMessageHeaders\.X\-MS\-Exchange\-Transport\-CrossTenantHeadersStripped | string | action\_result\.data\.\*\.internetMessageHeaders\.X\-MS\-Exchange\-Transport\-EndToEndLatency | string | action\_result\.data\.\*\.internetMessageHeaders\.X\-MS\-Has\-Attach | string | action\_result\.data\.\*\.internetMessageHeaders\.X\-MS\-Office365\-Filtering\-Correlation\-Id | string | +action\_result\.data\.\*\.internetMessageHeaders\.X\-MS\-Office365\-Filtering\-Correlation\-Id\-Prvs | string | action\_result\.data\.\*\.internetMessageHeaders\.X\-MS\-Oob\-TLC\-OOBClassifiers | string | action\_result\.data\.\*\.internetMessageHeaders\.X\-MS\-PublicTrafficType | string | action\_result\.data\.\*\.internetMessageHeaders\.X\-MS\-TNEF\-Correlator | string | @@ -916,24 +1017,48 @@ action\_result\.data\.\*\.internetMessageHeaders\.X\-MS\-TrafficTypeDiagnostic | action\_result\.data\.\*\.internetMessageHeaders\.X\-Microsoft\-Antispam | string | action\_result\.data\.\*\.internetMessageHeaders\.X\-Microsoft\-Antispam\-Mailbox\-Delivery | string | action\_result\.data\.\*\.internetMessageHeaders\.X\-Microsoft\-Antispam\-Message\-Info | string | +action\_result\.data\.\*\.internetMessageHeaders\.X\-Microsoft\-Antispam\-Message\-Info\-Original | string | +action\_result\.data\.\*\.internetMessageHeaders\.X\-Microsoft\-Antispam\-Untrusted | string | action\_result\.data\.\*\.internetMessageHeaders\.X\-Originating\-IP | string | action\_result\.data\.\*\.internetMessageHeaders\.X\-Received | string | action\_result\.data\.\*\.internetMessageHeaders\.subject | string | +action\_result\.data\.\*\.internetMessageHeaders\.x\-ms\-exchange\-antispam\-relay | string | +action\_result\.data\.\*\.internetMessageHeaders\.x\-ms\-exchange\-calendar\-series\-instance\-id | string | +action\_result\.data\.\*\.internetMessageHeaders\.x\-ms\-exchange\-senderadcheck | string | +action\_result\.data\.\*\.internetMessageHeaders\.x\-ms\-traffictypediagnostic | string | action\_result\.data\.\*\.internetMessageId | string | `msgoffice365 internet message id` +action\_result\.data\.\*\.isAllDay | boolean | +action\_result\.data\.\*\.isDelegated | boolean | action\_result\.data\.\*\.isDeliveryReceiptRequested | boolean | action\_result\.data\.\*\.isDraft | boolean | +action\_result\.data\.\*\.isOutOfDate | boolean | action\_result\.data\.\*\.isRead | boolean | action\_result\.data\.\*\.isReadReceiptRequested | boolean | action\_result\.data\.\*\.lastModifiedDateTime | string | +action\_result\.data\.\*\.meetingMessageType | string | +action\_result\.data\.\*\.meetingRequestType | string | action\_result\.data\.\*\.parentFolderId | string | `msgoffice365 folder id` +action\_result\.data\.\*\.previousEndDateTime | string | +action\_result\.data\.\*\.previousLocation | string | +action\_result\.data\.\*\.previousStartDateTime | string | +action\_result\.data\.\*\.previousEndDateTime\.dateTime | string | +action\_result\.data\.\*\.previousEndDateTime\.timeZone | string | +action\_result\.data\.\*\.previousStartDateTime\.dateTime | string | +action\_result\.data\.\*\.previousStartDateTime\.timeZone | string | action\_result\.data\.\*\.receivedDateTime | string | +action\_result\.data\.\*\.recurrence | string | action\_result\.data\.\*\.replyTo | string | +action\_result\.data\.\*\.responseRequested | boolean | action\_result\.data\.\*\.sender\.emailAddress\.address | string | `email` action\_result\.data\.\*\.sender\.emailAddress\.name | string | `email` action\_result\.data\.\*\.sentDateTime | string | +action\_result\.data\.\*\.startDateTime\.dateTime | string | +action\_result\.data\.\*\.startDateTime\.timeZone | string | action\_result\.data\.\*\.subject | string | `msgoffice365 subject` action\_result\.data\.\*\.toRecipients\.\*\.emailAddress\.address | string | `email` action\_result\.data\.\*\.toRecipients\.\*\.emailAddress\.name | string | +action\_result\.data\.\*\.type | string | +action\_result\.data\.\*\.vaultId | string | action\_result\.data\.\*\.webLink | string | `url` action\_result\.summary | string | action\_result\.message | string | @@ -1143,6 +1268,7 @@ action\_result\.data\.\*\.subject | string | `msgoffice365 subject` action\_result\.data\.\*\.toRecipients\.\*\.emailAddress\.address | string | `email` action\_result\.data\.\*\.toRecipients\.\*\.emailAddress\.name | string | action\_result\.data\.\*\.type | string | +action\_result\.data\.\*\.vaultId | string | `sha1` `vault id` action\_result\.data\.\*\.webLink | string | `url` action\_result\.summary\.emails\_matched | numeric | action\_result\.message | string | diff --git a/release_notes/2.7.0.md b/release_notes/2.7.0.md new file mode 100644 index 0000000..35038a5 --- /dev/null +++ b/release_notes/2.7.0.md @@ -0,0 +1,5 @@ +* Added the 'delete event' action +* Added 'download email' parameter in the 'get email' action +* Updated the 'get email' action to provide event related information +* Added 'retry_count' and 'retry_wait_time' asset configuration parameters to implement retry mechanism [PAPP-25674] +* Updated the asset configuration parameter name [PAPP-26294] \ No newline at end of file diff --git a/release_notes/unreleased.md b/release_notes/unreleased.md index 727d18f..fbcb2fd 100644 --- a/release_notes/unreleased.md +++ b/release_notes/unreleased.md @@ -1,6 +1 @@ **Unreleased** -* Added the 'delete event' action -* Added 'download email' parameter in the 'get email' action -* Updated the 'get email' action to provide event related information -* Added 'retry_count' and 'retry_wait_time' asset configuration parameters to implement retry mechanism [PAPP-25674] -* Updated the asset configuration parameter name [PAPP-26294] \ No newline at end of file
Event ID Subject Start Time End Time
+ + {{ data.id }} +   + + + None{{ data.subject }} {{ data.start.dateTime }} {{ data.end.dateTime }}