The Mailbox Trigger

Overview

The Playbooks Mailbox Trigger allows ThreatConnect^® users to create a mailbox to send information to a Playbook. This functionality will fire whenever an email is received in the inbox you create. It can be used to parse Indicators from an email, send an attachment to a malware analysis tool, or coordinate communication across teams, among other things.

Before You Start

Creating a New Mailbox Trigger

1. On the top navigation bar, click Playbooks to display the Playbooks screen.
2. Create a new Playbook or open an existing one.
3. Click Triggers on the side navigation bar of the Playbook Designer to view all available Trigger types.
4. Select Mailbox from the External menu to add a Mailbox Trigger to the design pane (Figure 1).
   

    

   • Hashtag icon: Hover the cursor over this icon at the upper-left corner of the Trigger in the design pane to display a scrollable list of output variables, which are values that the Trigger can send to other Apps and Operators.
   • Information icon: Hover the cursor over this icon at the upper-left corner of the Trigger in the design pane to display the email address for the mailbox associated with the Trigger.
   • Menu icon: Click this icon at the upper-right corner of the Trigger box to display a menu with options to edit, disable, clone, or delete the Trigger.
5. Double-click the Trigger. The Edit Trigger pane will be displayed on the left side of the screen (Figure 2).
   Note

   Click the Display Documentation  icon at the upper-right corner of the Edit Trigger pane to view information about the Trigger, including a description, its input parameters, and its output variables.

   

    

   • Mailbox Name: Enter a name for the Mailbox Trigger.
   • Target Mailbox: Enter the email address for the mailbox that will receive the email that will trigger the Playbook.
   • Click the SAVE button.

Now you can continue to build out and then execute the Playbook.

ThreatConnect^® is a registered trademark of ThreatConnect, Inc.

20099-01 v.02.D