RFC822 Parser

the rfc822 parser provides tools to extract and analyze data from emails formatted according to the rfc822 standard, enabling automated processing of email content and attachments rfc822 is a standard format for email messages, widely used for exchanging email data and attachments the rfc822 parser connector enables automated extraction and parsing of email attachments in rfc822 format, allowing security teams to efficiently analyze email content, headers, and attachments within swimlane turbine by integrating this connector, users can streamline the ingestion and processing of email evidence, enhance threat detection workflows, and reduce manual effort in handling email based incidents limitations calendar only files (outlook vcalendar / ics ) are not supported and will return a failure status outlook msg files are supported only when they contain an embedded rfc822 message supported versions this connector uses python's built in email library and does not depend on a versioned external api additional documents rfc 822 standard https //datatracker ietf org/doc/html/rfc822python email library https //docs python org/3/library/email html configuration prerequisites this connector does not require any external api credentials it operates entirely on the email attachment passed as input no asset configuration is needed authentication methods no authentication is required this connector is stateless and processes the provided email attachment directly capabilities this rfc822 parser connector provides the following capabilities parse attachment parse attachment (light) parse attachment extracts all data from an rfc822 formatted email attachment, including headers, mime parts, body text, and attached files the full unformatted raw email string is also returned output fields field description from sender address to list of recipient addresses cc list of cc addresses bcc list of bcc addresses subject email subject line message id message id header value date send date in iso 8601 format headers all headers as a list of {key, value} objects size raw email size in bytes raw full unformatted email string parts list of mime parts (see below) status success or failure status details human readable result description or error message each entry in parts contains field description content type mime content type (e g text/plain ) content disposition disposition header value content id content id header value is attachment true if the part is an attachment filename filename of the part creation date file creation date (iso 8601) modification date file modification date (iso 8601) read date file read date (iso 8601) mime type mime type of the part charset character set of the part content text decoded body text (for non attachment text/ parts) content attachment file object (for attachment parts) parse attachment (light) same output as parse attachment but truncates large fields to keep the playbook payload under turbine's 20 mib limit headers and attachment content are fully preserved; only body text and the raw email string are capped truncation limits field limit content text (per mime part) 64 kib raw (full email string) 512 kib when truncation occurs, the affected field is suffixed with \n\[ truncated ] and status details reads parsed (body/raw truncated to stay under playbook limit) use this action instead of parse attachment when processing large emails or when only headers, metadata, and attachment files are needed downstream actions parse attachment extract data from rfc822 email attachments to enable enhanced analysis and processing endpoint method get input argument name type required description attachment object optional file to be uploaded attachment file string optional parameter for parse attachment attachment file name string optional name of the resource attachment description string optional parameter for parse attachment input example {"attachment" {"file" "string","file name" "example name","description" "string"}} output parameter type description from string output field from to array output field to cc array output field cc bcc array output field bcc subject string output field subject message id string unique identifier date string date value headers array http headers for the request headers key string http headers for the request headers value string http headers for the request size number size in bytes raw string unformatted email parts array output field parts parts content type string type of the resource parts content disposition string response content parts content id string unique identifier parts is attachment boolean output field parts is attachment parts filename string name of the resource parts creation date string date value parts modification date string date value parts read date string date value parts mime type string type of the resource parts charset string output field parts charset parts content text string response content parts content array response content output example {"from" "string","to" \[],"cc" \[],"bcc" \[],"subject" "string","message id" "string","date" "string","headers" \[],"size" 123,"raw" "string","parts" \[],"status" "string","status details" "string"} parse attachment (light) parse email attachments with truncated body parts and raw email string to maintain size limits, preserving headers and attachment content endpoint method get input argument name type required description attachment object optional file to be uploaded attachment file string optional parameter for parse attachment (light) attachment file name string optional name of the resource attachment description string optional parameter for parse attachment (light) input example {"attachment" {"file" "string","file name" "example name","description" "string"}} output parameter type description from string output field from to array output field to cc array output field cc bcc array output field bcc subject string output field subject message id string unique identifier date string date value headers array http headers for the request headers key string http headers for the request headers value string http headers for the request size number size in bytes raw string unformatted email (truncated to 512 kib) parts array output field parts parts content type string type of the resource parts content disposition string response content parts content id string unique identifier parts is attachment boolean output field parts is attachment parts filename string name of the resource parts creation date string date value parts modification date string date value parts read date string date value parts mime type string type of the resource parts charset string output field parts charset parts content text string body text (truncated to 64 kib) parts content array response content output example {"from" "string","to" \[],"cc" \[],"bcc" \[],"subject" "string","message id" "string","date" "string","headers" \[],"size" 123,"raw" "string","parts" \[],"status" "string","status details" "string"} response headers header description example content type the media type of the resource application/json date the date and time at which the message was originated thu, 01 jan 2024 00 00 00 gmt