Gmail Single User (Beta)

beta

This is a beta Integration, which lets you implement and test pre-release software. Since the integration is beta, it might contain bugs. Updates to the integration during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the integration to help us identify issues, fix them, and continually improve.

Use the Gmail Single User integration to send emails and fetch emails as incidents to Cortex XSOAR.

Note: We recommend using this integration if you only want to fetch and send emails from a single user's mailbox. If you require accessing multiple users' mailboxes, use the GMail Integration.

Application Authorization Flow

To allow Cortex XSOAR to access Gmail, the user has to approve the Demisto App using an OAuth 2.0 authorization flow. Follow these steps to authorize the Demisto app in Gmail.

  1. Create and save an integration instance of the Gmail Single User integration. Do not fill in the Auth Code field, this will be obtained in the next steps.
  2. To obtain the Auth Code run the following command in the playground: !gmail-auth-link. Access the link you receive to authenticate your Gmail account.
  3. Complete the authentication process and copy the received code to the Auth Code configuration parameter of the integration instance.
  4. Save the instance.
  5. To verify that authentication was configured correctly, run the !gmail-auth-test.

NOTE: The Demisto App is going through the Google verification process. During the verification process the app is not fully verified, and you may receive from Google an "unverified app" warning in the authorization flow.

GSuite Admins: You can choose to trust the Demisto App so your users can configure the App. Instructions:

  • Go to App Access Control
  • Choose: Configure new app -> OAuth App Name Or Client ID. GSuite App Configurations* Enter the following Client ID: 391797357217-pa6jda1554dbmlt3hbji2bivphl0j616.apps.googleusercontent.com
  • You will see the Demisto App in the results page. Demisto App* Select the App and grant the App access as Trusted.

Additional info available at: https://support.google.com/a/answer/7281227

Optional: You can use your own Google App instead of the default Demisto App. To create your own app, follow the Google instructions for Desktop Apps.

  • Go to the developers credentials page: https://console.developers.google.com/apis/credentials (you may need to setup a new project if you haven't done so in the past).
  • If needed, configure the Consent Screen. Fill in the Consent Screen information you would like to display to your users.
  • In the credentials page choose: Create Credentials -> OAuth client ID. Create Credentials* When creating the OAuth client ID, select iOS as the type (this type allows Apps to work only with a client id).
  • Name the App and Bundle. You can choose a dummy bundle id such as: com.demisto.app. OAuth App* Make sure to enable the GMail API at: https://console.developers.google.com/apis/api/gmail.googleapis.com/overview
  • After you create the app, copy the client id to the integration configuration. Proceed with the OAuth 2.0 authorization flow detailed above.

Configure Gmail Single User on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Gmail Single User.
  3. Click Add instance to create and configure a new integration instance.
    • Name: a textual name for the integration instance.
    • Email of user
    • Auth Code (run the !gmail-auth-link command to start the auth flow - see Detailed Instructions (?) section)
    • Client ID (Optional: use your own app - see Detailed Instructions (?)
    • Incident type
    • Fetch incidents
    • First fetch timestamp, in days.
    • Events query (e.g. "from:example@demisto.com")
    • Maximum number of emails to pull per fetch
    • Trust any certificate (not secure)
    • Use system proxy settings
  4. Click Test to validate the URLs, token, and connection.

Fetched Incidents Data

  • Incident Name
  • Occurred
  • Owner
  • Type
  • Severity
  • Email From
  • Email Message ID
  • Email Subject
  • Email To
  • Attachment Extension
  • Attachment Name
  • Email Body
  • Email Body Format

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

  1. Send email: send-mail
  2. Get an authentication link: gmail-auth-link
  3. Test authorization: gmail-auth-test

1. Send email

Sends an email using Gmail.

Base Command

send-mail

Input
Argument NameDescriptionRequired
toThe email addresses of the receiver.Required
bodyThe contents (body) of the email to be sent in plain text.Optional
subjectThe subject of the email to be sent.Required
attachIDsA comma-separated list of IDs of War Room entries that contain files, which need be attached to the email.Optional
ccThe additional recipient email address (CC).Optional
bccThe additional recipient email address (BCC).Optional
htmlBodyThe contents (body) of the email to be sent in HTML format.Optional
replyToThe email address used to reply to the message.Optional
attachNamesA comma-separated list of new names to renamfor existing attachments, which relates to the order that they were attached to the email. For example, rename the first and third file attachNames=new_fileName1,,new_fileName3 To rename the second and fifth files, attachNames=,new_fileName2,,,new_fileName5Optional
attachCIDsA comma-separated list of CID images to embed attachments to the email.Optional
transientFileThe textual name for an attached file. Multiple files are supported as a comma-separated list. For example, transientFile="t1.txt,temp.txt,t3.txt" transientFileContent="test 2,temporary file content,third file content" transientFileCID="t1.txt@xxx.yyy,t2.txt@xxx.zzz".Optional
transientFileContentThe content for the attached file. Multiple files are supported as a comma-separated list. For example, transientFile="t1.txt,temp.txt,t3.txt" transientFileContent="test 2,temporary file content,third file content" transientFileCID="t1.txt@xxx.yyy,t2.txt@xxx.zzz".Optional
transientFileCIDThe CID image for an attached file to include within the email body. Multiple files are supported as comma-separated list. For example, transientFile="t1.txt,temp.txt,t3.txt" transientFileContent="test 2,temporary file content,third file content" transientFileCID="t1.txt@xxx.yyy,t2.txt@xxx.zzz".Optional
additionalHeaderA comma-separated list of additional headers in the format: headerName=headerValue. For example, "headerName1=headerValue1,headerName2=headerValue2".Optional
templateParams'Replaces {varname} variables with values from this parameter. Expected values are in the form of a JSON document. For example, {"varname" :{"value" "some value", "key": "context key"}}. Each var name can either be provided with the value or a context key to retrieve the value.'Optional
Context Output
PathTypeDescription
Gmail.SentMail.IDStringThe immutable ID of the message.
Gmail.SentMail.LabelsStringList of IDs of labels applied to this message.
Gmail.SentMail.ThreadIdStringThe ID of the thread in which the message belongs.
Gmail.SentMail.ToStringThe recipient of the email.
Gmail.SentMail.FromUnknownThe sender of the email.
Gmail.SentMail.CcStringAdditional recipient email address (CC).
Gmail.SentMail.BccStringAdditional recipient email address (BCC).
Gmail.SentMail.SubjectStringThe subject of the email.
Gmail.SentMail.BodyUnknownThe plain-text version of the email.
Gmail.SentMail.MailBoxStringThe mailbox from which the mail was sent.
Command Example

!send-mail subject="this is the subject" to=test@demistodev.com body="this is the body"

Context Example
{
"Gmail.SentMail": [
{
"Body": "this is the body",
"From": "example@demisto.com",
"Cc": null,
"Labels": [
"SENT"
],
"Bcc": null,
"To": "test@demistodev.com",
"ThreadId": "16f662789d3a2972",
"Mailbox": "test@demistodev.com",
"Type": "Gmail",
"ID": "16f662789d3a2972",
"Subject": "this is the subject"
}
]
}
Human Readable Output

Email sent:

TypeIDToFromSubjectBodyLabelsThreadId
Gmail16f662789d3a2972test@demistodev.comexample@demisto.comthis is the subjectthis is the bodySENT16f662789d3a2972

2. Get an authentication link

Returns a link to use to authenticate to Gmail. It starts the OAuth2 process. 

Base Command

gmail-auth-link

Input

There is no input for this command.

Context Output

There is no context output for this command.

Command Example

!gmail-auth-link

Human Readable Output

Gmail Auth Link

Please follow the following link. After Completing the authentication process, copy the received code to the Auth Code configuration parameter of the integration instance. Save the integration instance and then run !gmail-auth-test to test that the authentication is properly set.

3. Test authorization

Tests that Gmail auth is properly configured. Use this command after completing the OAuth2 authentication process.

Base Command

gmail-auth-test

Input

There is no input for this command.

Context Output

There is no context output for this command.

Command Example

!gmail-auth-test

Human Readable Output

Authentication test completed successfully.

Edit this page
Report an Issue