RFC822 Parser

The RFC822 Parser provides tools to extract and analyze data from emails formatted according to the RFC822 standard, enabling automated processing of email content and attachments.

RFC822 is a standard format for email messages, widely used for exchanging email data and attachments. The RFC822 Parser connector enables automated extraction and parsing of email attachments in RFC822 format, allowing security teams to efficiently analyze email content, headers, and attachments within Swimlane Turbine. By integrating this connector, users can streamline the ingestion and processing of email evidence, enhance threat detection workflows, and reduce manual effort in handling email-based incidents.

Limitations

Calendar-only files (Outlook VCALENDAR / .ics) are not supported and will return a Failure status.

Outlook .msg files are supported only when they contain an embedded RFC822 message.

Supported Versions

This connector uses Python's built-in email library and does not depend on a versioned external API.

Additional Documents

RFC 822 Standard

Python email library

Configuration

Prerequisites

This connector does not require any external API credentials. It operates entirely on the email attachment passed as input. No asset configuration is needed.

Authentication Methods

No authentication is required. This connector is stateless and processes the provided email attachment directly.

Capabilities

This RFC822 Parser connector provides the following capabilities:

Parse Attachment

Parse Attachment (Light)

Parse Attachment

Extracts all data from an RFC822 formatted email attachment, including headers, MIME parts, body text, and attached files. The full unformatted raw email string is also returned.

Output fields:

Field	Description
from	Sender address
to	List of recipient addresses
cc	List of CC addresses
bcc	List of BCC addresses
subject	Email subject line
message_id	Message-ID header value
date	Send date in ISO 8601 format
headers	All headers as a list of {key, value} objects
size	Raw email size in bytes
raw	Full unformatted email string
parts	List of MIME parts (see below)
status	Success or Failure
status_details	Human-readable result description or error message

Each entry in parts contains:

Field	Description
content_type	MIME content type (e.g. text/plain)
content_disposition	Disposition header value
content_id	Content-ID header value
is_attachment	true if the part is an attachment
filename	Filename of the part
creation_date	File creation date (ISO 8601)
modification_date	File modification date (ISO 8601)
read_date	File read date (ISO 8601)
mime_type	MIME type of the part
charset	Character set of the part
content_text	Decoded body text (for non-attachment text/* parts)
content	Attachment file object (for attachment parts)

Parse Attachment (Light)

Same output as Parse Attachment but truncates large fields to keep the playbook payload under Turbine's 20 MiB limit. Headers and attachment content are fully preserved; only body text and the raw email string are capped.

Truncation limits:

Field	Limit
content_text (per MIME part)	64 KiB
raw (full email string)	512 KiB

When truncation occurs, the affected field is suffixed with \n[... truncated ...] and status_details reads Parsed (body/raw truncated to stay under playbook limit).

Use this action instead of Parse Attachment when processing large emails or when only headers, metadata, and attachment files are needed downstream.

Actions

Parse Attachment

Extract data from RFC822 email attachments to enable enhanced analysis and processing.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
attachment	object	Optional	File to be uploaded
attachment.file	string	Optional	Parameter for Parse Attachment
attachment.file_name	string	Optional	Name of the resource
attachment.description	string	Optional	Parameter for Parse Attachment

Input Example

{"attachment":{"file":"string","file_name":"Example Name","description":"string"}}

Output

Parameter	Type	Description
from	string	Output field: from
to	array	Output field: to
cc	array	Output field: cc
bcc	array	Output field: bcc
subject	string	Output field: subject
message_id	string	Unique identifier
date	string	Date value
headers	array	HTTP headers for the request
headers.key	string	HTTP headers for the request
headers.value	string	HTTP headers for the request
size	number	Size in Bytes
raw	string	Unformatted email
parts	array	Output field: parts
parts.content_type	string	Type of the resource
parts.content_disposition	string	Response content
parts.content_id	string	Unique identifier
parts.is_attachment	boolean	Output field: parts.is_attachment
parts.filename	string	Name of the resource
parts.creation_date	string	Date value
parts.modification_date	string	Date value
parts.read_date	string	Date value
parts.mime_type	string	Type of the resource
parts.charset	string	Output field: parts.charset
parts.content_text	string	Response content
parts.content	array	Response content

Output Example

{"from":"string","to":[],"cc":[],"bcc":[],"subject":"string","message_id":"string","date":"string","headers":[],"size":123,"raw":"string","parts":[],"status":"string","status_details":"string"}