SPLUNK SOAR Data Collection over Email

[harishlnu]

Hi Team,

I am having requirement where i need to send an email for approval, if they reply to that email i need to read that email and continue with next steps.

Could you please help me with your suggestions.

Thanks in Advance

[phanTom]

@harishlnu one way I have done this in the past is to use 2 lots of automation. 

1st automation sends the email with a key nested in the HTML such as "SOARKEY=" and then add useful information to the other side, usually b64 encoded, at a minimum having the original container id in it. This sends the email and then stops automation. 

Then you ingest the replies (you may need to setup mail rules to push replies to SOAR emails into a dedicated inbox) using SOAR and look for the SOARKEY in the HTML Body, get the encoded string, decode and then <do something>.

-- Hope this helps! Happy SOARing! --