---
title: "The Mailbox Trigger Knowledge Base Article | ThreatConnect"
slug: "playbooks-the-mailbox-trigger"
description: "This article describes how to configure the Mailbox Trigger, which allows you to create a mailbox to send information to a Playbook in ThreatConnect."
tags: ["Orchestration and Automation"]
updated: 2024-11-08T13:56:33Z
published: 2024-11-08T13:56:33Z
canonical: "knowledge.threatconnect.com/playbooks-the-mailbox-trigger"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt
> Use this file to discover all available pages before exploring further.

# The Mailbox Trigger

## Overview

The Playbooks Mailbox Trigger allows ThreatConnect® users to create a mailbox to send information to a Playbook. This functionality will fire whenever an email is received in the inbox you create. It can be used to parse Indicators from an email, send an attachment to a malware analysis tool, or coordinate communication across teams, among other things.

## Before You Start

| Minimum Role(s) | - Organization role of Read Only User or Read Only Commenter to view Playbooks with a Mailbox Trigger - Any other Organization role to use the Mailbox Trigger in a Playbook |
| --- | --- |
| Prerequisites | Playbooks enabled by a System Administrator |

## Creating a New Mailbox Trigger

1. On the top navigation bar, click **Playbooks** to display the [**Playbooks** screen](https://knowledge.threatconnect.com/docs/the-playbooks-screen).
2. Create a new [Playbook](https://knowledge.threatconnect.com/docs/playbooks) or open an existing one.
3. Click ![Playbook Designer Triggers icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Playbook%20Designer%20Triggers%20icon.png) **Triggers** on the side navigation bar of the [Playbook Designer](https://knowledge.threatconnect.com/docs/the-playbook-designer) to view all available Trigger types.
4. Select **Mailbox** from the **External** menu to add a Mailbox Trigger to the design pane (Figure 1).![Figure 1_The Mailbox Trigger_Redlines](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%201_The%20Mailbox%20Trigger_Redlines.png)
  - **Hashtag**![Playbook Trigger Hashtag icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Playbook%20Trigger%20Hashtag%20icon.png) icon: Hover the cursor over this icon at the upper-left corner of the Trigger in the design pane to display a scrollable list of output variables, which are values that the Trigger can send to other [Apps and Operators](https://knowledge.threatconnect.com/docs/parts-of-a-playbook).
  - **Information**![Playbook Trigger Information icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Playbook%20Trigger%20Information%20icon.png) icon: Hover the cursor over this icon at the upper-left corner of the Trigger in the design pane to display the email address for the mailbox associated with the Trigger.
  - **Menu**![Playbook Trigger Menu icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Playbook%20Trigger%20Menu%20icon.png) icon: Click this icon at the upper-right corner of the Trigger box to display a menu with options to edit, disable, clone, or delete the Trigger.
5. Double-click the Trigger. The **Edit Trigger** pane will be displayed on the left side of the screen (Figure 2).Note

Click the **Display Documentation** ![Playbooks_Display Documentation icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Playbooks_Display%20Documentation%20icon.png) icon at the upper-right corner of the **Edit Trigger** pane to view information about the Trigger, including a description, its input parameters, and its output variables.

![Figure 2_The Mailbox Trigger_Redlines](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%202_The%20Mailbox%20Trigger_Redlines.png)
  - **Mailbox Name**: Enter a name for the Mailbox Trigger.
  - **Target Mailbox**: Enter the email address for the mailbox that will receive the email that will trigger the Playbook.
  - Click the **SAVE** button.

Now you can continue to [build out](https://knowledge.threatconnect.com/docs/designing-a-playbook) and then [execute](https://knowledge.threatconnect.com/docs/executing-a-playbook#playbooks-with-a-mailbox-trigger) the Playbook.

---

*ThreatConnect® is a registered trademark of ThreatConnect, Inc.*

20099-01 v.02.D

## Related

- [Executing a Playbook](/executing-a-playbook.md)
- [Parts of a Playbook](/parts-of-a-playbook.md)
- [The Playbook Designer](/the-playbook-designer.md)