topic O365 Integration for SOAR (Ingest emails?) in Splunk SOAR

O365 Integration for SOAR (Ingest emails?)

EdgeSync — Fri, 08 Oct 2021 10:49:48 GMT

Hi all,

Is there any app, method or guidance for ingesting emails directly form a O365 mailbox?

So a use case for us would be:

We have a mailbox which receives Phishing Reports
SOAR logs onto the mailbox, downloads the unread mails + turns them into "Events"
Playbook begins working on these events - checking URL's, checking to/from addresses, maybe further triage based on o365 logs or whatever
Detonate mail/attachments in Sandbox, capture networks/process/file related results, e.g. Cuckoo
Playbook decides if mail is okay, suspicious, or phishing (or integrates with another tool to get that information - e.g. Proofpoint
All information made available to the analyst who reviews

In order to kick these off we'd need to be able to INGEST the email to begin with, but don't see any way to do that at present.

If it doesn't exist I will write my own app for it - but don't want to reinvent the wheel if I don't have to 🙂

Thanks!

Re: O365 Integration for SOAR (Ingest emails?)

phanTom — Fri, 08 Oct 2021 11:46:03 GMT

@EdgeSync there is an O365 App already that will be able to poll the inbox and create the necessary events:

https://my.phantom.us/4.10/docs/app_reference/phantom_office365

Actions:
run query - Search emails
delete email - Delete emails
copy email - Copy an email to a folder
move email - Move an email to a folder
block sender - Add the sender email into the block list
unblock sender - Remove the sender email from the block list
get email - Get an email from the server
list addresses - Get the email addresses that make up a Distribution List
lookup email - Resolve an Alias name or email address, into mailboxes
update email - Update an email on the server
on poll - Action handler for the ingest functionality

The on-poll action is run outside of a playbook and can be scheduled in the asset settings under the "ingest setting" tab when creating the asset to communicate with the 365 servers.

All you need is a playbook set to work on the label you assign to the ingested email events and if you want it to run automatically just set it to active and watch the magic 😄

Apps are also now available on splunkbase now too: https://splunkbase.splunk.com/app/5829/

Re: O365 Integration for SOAR (Ingest emails?)

EdgeSync — Fri, 08 Oct 2021 12:36:26 GMT

@phanTom

This is an excellent start, thank you very much. I was searching in SOAR App's window and it's not there, and also checked splunkbase, but found nothing.

Best,

EdgeSync