The Mailbox Trigger
  • 19 Mar 2024
  • 1 Minute to read
  • Dark
    Light

The Mailbox Trigger

  • Dark
    Light

Article Summary

Overview

The Playbooks Mailbox Trigger allows ThreatConnect® users to create a mailbox to send information to a Playbook. This functionality will fire whenever an email is received in the inbox you create. It can be used to parse Indicators from an email, send an attachment to a malware analysis tool, or coordinate communication across teams, among other things.

Before You Start

Minimum Role(s)
  • Organization role of Read Only User or Read Only Commenter to view Playbooks with a Mailbox Trigger
  • Any other Organization role to use the Mailbox Trigger in a Playbook
PrerequisitesPlaybooks enabled by a System Administrator

Creating a New Mailbox Trigger

  1. On the top navigation bar, click Playbooks to display the Playbooks screen.
  2. Create a new Playbook or open an existing one.
  3. Click Triggers icon Triggers on the side navigation bar of the Playbook Designer to view all available Trigger types (Figure 1).
    Figure 1

     

  4. Select Mailbox from the External menu to add a Mailbox Trigger to the design pane (Figure 2).
    Figure 2

     

    • HashtagHashtag icon icon: Hover the cursor over this icon at the upper-left corner of the Trigger in the design pane to display a scrollable list of output variables, which are values that the Trigger can send to other Apps and Operators.
    • InformationInformation icon icon: Hover the cursor over this icon at the upper-left corner of the Trigger in the design pane to display the email address for the mailbox associated with the Trigger.
    • MenuMenu icon icon: Click this icon at the upper-right corner of the Trigger box to display a menu with options to edit, disable, clone, or delete the Trigger.
  5. Double-click the Trigger. The Edit Trigger pane will be displayed on the left side of the screen (Figure 3).
    Note

    Click the Display Documentation Display Documentation icon icon at the upper-right corner of the Edit Trigger pane to view information about the Trigger, including a description, its input parameters, and its output variables.

    Figure 3

     

    • Mailbox Name: Enter a name for the Mailbox Trigger.
    • Target Mailbox: Enter the email address for the mailbox that will receive the email that will trigger the Playbook.
    • Click the SAVE button.

Now you can continue to build out and then execute the Playbook.


ThreatConnect® is a registered trademark of ThreatConnect, Inc.

20099-01 v.02.C


Was this article helpful?