The Mailbox Trigger
  • 19 Mar 2024
  • 1 Minute to read
  • Dark

The Mailbox Trigger

  • Dark

Article summary


The Playbooks Mailbox Trigger allows ThreatConnect® users to create a mailbox to send information to a Playbook. This functionality will fire whenever an email is received in the inbox you create. It can be used to parse Indicators from an email, send an attachment to a malware analysis tool, or coordinate communication across teams, among other things.

Before You Start

Minimum Role(s)
  • Organization role of Read Only User or Read Only Commenter to view Playbooks with a Mailbox Trigger
  • Any other Organization role to use the Mailbox Trigger in a Playbook
PrerequisitesPlaybooks enabled by a System Administrator

Creating a New Mailbox Trigger

  1. On the top navigation bar, click Playbooks to display the Playbooks screen.
  2. Create a new Playbook or open an existing one.
  3. Click Triggers icon Triggers on the side navigation bar of the Playbook Designer to view all available Trigger types (Figure 1).
    Figure 1


  4. Select Mailbox from the External menu to add a Mailbox Trigger to the design pane (Figure 2).
    Figure 2


    • HashtagHashtag icon icon: Hover the cursor over this icon at the upper-left corner of the Trigger in the design pane to display a scrollable list of output variables, which are values that the Trigger can send to other Apps and Operators.
    • InformationInformation icon icon: Hover the cursor over this icon at the upper-left corner of the Trigger in the design pane to display the email address for the mailbox associated with the Trigger.
    • MenuMenu icon icon: Click this icon at the upper-right corner of the Trigger box to display a menu with options to edit, disable, clone, or delete the Trigger.
  5. Double-click the Trigger. The Edit Trigger pane will be displayed on the left side of the screen (Figure 3).

    Click the Display Documentation Display Documentation icon icon at the upper-right corner of the Edit Trigger pane to view information about the Trigger, including a description, its input parameters, and its output variables.

    Figure 3


    • Mailbox Name: Enter a name for the Mailbox Trigger.
    • Target Mailbox: Enter the email address for the mailbox that will receive the email that will trigger the Playbook.
    • Click the SAVE button.

Now you can continue to build out and then execute the Playbook.

ThreatConnect® is a registered trademark of ThreatConnect, Inc.

20099-01 v.02.C

Was this article helpful?