topic Re: Email user and get response back in Splunk SOAR

Email user and get response back

rodneyjerome — Thu, 01 Jul 2021 18:01:38 GMT

Hi,

I am looking send an email to user with simple yes/no response which I can then use to handle the case. I know Palo Alto’s soar has some integrations to handle this. Do we have similar func in Splunk or any idea on how to implement them.

Thanks in advance

Re: Email user and get response back

phanTom — Fri, 02 Jul 2021 08:14:53 GMT

@rodneyjerome it's not out of the box but the way I have done this is with 2 playbooks:

1. 1st/any playbook that sends an email that expects a response first builds an encrypted string that contains useful information for the response ( i use container_id + label value ), then builds a HTML body with the token inserted with an obvious prefix ( easy to pick out in regex ) and then sends the email and completes.

In the middle, you have an app monitoring and ingesting from the mailbox/folder where the user will be replying to.

2. 2nd playbook runs on these ingested emails, retrieves the key value, decrypts it and then uses the information to understand which container to update/work on.

This can be expanded nicely by adding more relevant information into the inserted key.

Re: Email user and get response back

MrM1 — Wed, 07 Feb 2024 17:44:25 GMT

Hello @phanTom ,
Hope my message finds you well.
Are those playbooks by chance in the community repository?