RFC822 Parser

the rfc822 parser is a tool for extracting and processing data from rfc822 formatted email messages rfc822 parser is a specialized tool designed to automate the parsing of email attachments, specifically those formatted in the rfc822 standard this connector enables swimlane turbine users to extract and analyze data from email attachments efficiently, enhancing threat analysis and processing capabilities by integrating with the rfc822 parser, users can streamline the handling of email based threats, ensuring that critical information is quickly accessible for security operations and decision making limitations calendar only files (outlook vcalendar / ics ) are not supported and will return a failure status outlook msg files are supported only when they contain an embedded rfc822 message supported versions this connector uses python's built in email library and does not depend on a versioned external api additional documents rfc 822 standard https //datatracker ietf org/doc/html/rfc822python email library https //docs python org/3/library/email html configuration prerequisites this connector does not require any external api credentials it operates entirely on the email attachment passed as input no asset configuration is needed authentication methods no authentication is required this connector is stateless and processes the provided email attachment directly capabilities this rfc822 parser connector provides the following capabilities parse attachment parse attachment (light) parse attachment extracts all data from an rfc822 formatted email attachment, including headers, mime parts, body text, and attached files the full unformatted raw email string is also returned output fields field description from sender address to list of recipient addresses cc list of cc addresses bcc list of bcc addresses subject email subject line message id message id header value date send date in iso 8601 format headers all headers as a list of {key, value} objects size raw email size in bytes raw full unformatted email string parts list of mime parts (see below) status success or failure status details human readable result description or error message each entry in parts contains field description content type mime content type (e g text/plain ) content disposition disposition header value content id content id header value is attachment true if the part is an attachment filename filename of the part creation date file creation date (iso 8601) modification date file modification date (iso 8601) read date file read date (iso 8601) mime type mime type of the part charset character set of the part content text decoded body text (for non attachment text/ parts) content attachment file object (for attachment parts) parse attachment (light) same output as parse attachment but truncates large fields to keep the playbook payload under turbine's 20 mib limit headers and attachment content are fully preserved; only body text and the raw email string are capped truncation limits field limit content text (per mime part) 64 kib raw (full email string) 512 kib when truncation occurs, the affected field is suffixed with \n\[ truncated ] and status details reads parsed (body/raw truncated to stay under playbook limit) use this action instead of parse attachment when processing large emails or when only headers, metadata, and attachment files are needed downstream actions parse attachment extract data from rfc822 email attachments for enhanced analysis and processing endpoint method get input argument name type required description attachment object optional file to be uploaded attachment file string optional parameter for parse attachment attachment file name string optional name of the resource attachment description string optional parameter for parse attachment input example {"attachment" {"file" "string","file name" "example name","description" "string"}} output parameter type description from string output field from to array output field to cc array output field cc bcc array output field bcc subject string output field subject message id string unique identifier date string date value headers array http headers for the request headers key string http headers for the request headers value string http headers for the request size number size in bytes raw string unformatted email parts array output field parts parts content type string type of the resource parts content disposition string response content parts content id string unique identifier parts is attachment boolean output field parts is attachment parts filename string name of the resource parts creation date string date value parts modification date string date value parts read date string date value parts mime type string type of the resource parts charset string output field parts charset parts content text string response content parts content array response content output example {"from" "string","to" \[],"cc" \[],"bcc" \[],"subject" "string","message id" "string","date" "string","headers" \[],"size" 123,"raw" "string","parts" \[],"status" "string","status details" "string"} parse attachment (light) parse email attachments with truncated body parts and raw email string to maintain size limits, while keeping headers and attachment content unchanged endpoint method get input argument name type required description attachment object optional file to be uploaded attachment file string optional parameter for parse attachment (light) attachment file name string optional name of the resource attachment description string optional parameter for parse attachment (light) input example {"attachment" {"file" "string","file name" "example name","description" "string"}} output parameter type description from string output field from to array output field to cc array output field cc bcc array output field bcc subject string output field subject message id string unique identifier date string date value headers array http headers for the request headers key string http headers for the request headers value string http headers for the request size number size in bytes raw string unformatted email (truncated to 512 kib) parts array output field parts parts content type string type of the resource parts content disposition string response content parts content id string unique identifier parts is attachment boolean output field parts is attachment parts filename string name of the resource parts creation date string date value parts modification date string date value parts read date string date value parts mime type string type of the resource parts charset string output field parts charset parts content text string body text (truncated to 64 kib) parts content array response content output example {"from" "string","to" \[],"cc" \[],"bcc" \[],"subject" "string","message id" "string","date" "string","headers" \[],"size" 123,"raw" "string","parts" \[],"status" "string","status details" "string"} response headers header description example content type the media type of the resource application/json date the date and time at which the message was originated thu, 01 jan 2024 00 00 00 gmt