- 20 Oct 2022
- 1 Minute to read
The Mailbox Trigger
- Updated on 20 Oct 2022
- 1 Minute to read
Minimum Role: Organization role of Read Only User or Read Only Commenter to view Playbooks with a Mailbox Trigger; any other Organization role to use the Mailbox Trigger in a Playbook
Prerequisites: Playbooks enabled by a System Administrator
The Playbooks Mailbox Trigger allows ThreatConnect® users to create a mailbox to send information to a Playbook. This functionality will fire whenever an email is received in the inbox you create. It can be used to parse Indicators from an email, send an attachment to a malware analysis tool, or coordinate communication across teams, among other things.
Creating a New Mailbox Trigger
- On the top navigation bar, click Playbooks to display the Playbooks screen.
- Create a new Playbook or open an existing one.
- Click Triggers on the side navigation bar of the Playbook Designer to view all available Trigger types (Figure 1).
- Select Mailbox from the External menu to add a Mailbox Trigger to the design pane (Figure 2).
- Hashtag icon: Hover the cursor over this icon at the upper-left corner of the Trigger in the design pane to display a scrollable list of output variables, which are values that the Trigger can send to other Apps and Operators.
- Information icon: Hover the cursor over this icon at the upper-left corner of the Trigger in the design pane to display the email address for the mailbox associated with the Trigger.
- Menu icon: Click this icon at the upper-right corner of the Trigger box to display a menu with options to edit, disable, clone, or delete the Trigger.
- Double-click the Trigger. The Edit Trigger pane will be displayed on the left side of the screen (Figure 3).Note
Click the Display Documentation icon at the upper-right corner of the Edit Trigger pane to view information about the Trigger, including a description, its input parameters, and its output variables.
- Mailbox Name: Enter a name for the Mailbox Trigger.
- Target Mailbox: Enter the email address for the mailbox that will receive the email that will trigger the Playbook.
- Click the SAVE button.
Now you can continue to build out and then execute the Playbook.
ThreatConnect® is a registered trademark of ThreatConnect, Inc.