https://tines.com/ logo
Join Slack
Powered by
Hello, I am trying to create a story to which asse...
# community-help
r
Hello, I am trying to create a story to which assessed emails I am using the MS graph to pull emails using the http request action. I have some logic run slip if attachments are in the email and then run another http request to get the attachment. the graph requires the following url: https://graph.microsoft.com/v1.0/me/mailFolders/inbox/messages/XXXXX/attachments the XXXXX is a placeholder for the messageID which I get from the original http request my question is this. How can I get the messageID value from the original http request without the quotations surrounding the ID? Any help would be greatly appreciated.
m
Hi Thomas - nice to meet you! Can you share a sample event perhaps so we can see how it's formatted?
r
Hi Thomas, Nice to meet you too. Here you go: {"agents":[{"disabled":false,"name":"Get Emails in Outlook using MSGraph for Office365","options":"{\"url\":\"https://graph.microsoft.com/v1.0/me/mailFolders/inbox/messages\",\"method\":\"get\",\"headers\":{\"Authorization\":\"Bearer <<CREDENTIAL.msgraph>>\"}}","position":{"x":450,"y":-1230},"schedule":[{"cron":"0 */3 * * *","timezone":"Europe/London"}],"type":"httpRequest"},{"disabled":false,"name":"Event Transform Action","options":"{\"mode\":\"explode\",\"path\":\"=get_emails_in_outlook_using_msgraph_for_office365.body.value\",\"to\":\"individual_item\"}","position":{"x":450,"y":-975},"type":"eventTransformation"},{"disabled":false,"name":"Trigger Action","options":"{\"rules\":[{\"type\":\"field==value\",\"value\":\"false\",\"path\":\"<<event_transform_action.individual_item.hasAttachments>>\"}]}","position":{"x":450,"y":-870},"type":"trigger"},{"disabled":false,"name":"Trigger Action","options":"{\"rules\":[{\"type\":\"field==value\",\"value\":\"true\",\"path\":\"<<event_transform_action.individual_item.hasAttachments>>\"}]}","position":{"x":735,"y":-870},"type":"trigger"},{"disabled":false,"name":"Retrieve Message Attachments by Message ID using MSGraph for Office365","options":"{\"url\":\"https://graph.microsoft.com/v1.0/me/mailFolders/inbox/messages/<<RESOURCE.event_tranform_Action.individual_item.id>>/attachments\",\"method\":\"get\",\"headers\":{\"Authorization\":\"Bearer <<CREDENTIAL.msgraph>>\"}}","position":{"x":735,"y":-675},"type":"httpRequest"}],"links":[{"sourceIdentifier":0,"receiverIdentifier":1},{"sourceIdentifier":1,"receiverIdentifier":2},{"sourceIdentifier":1,"receiverIdentifier":3},{"sourceIdentifier":3,"receiverIdentifier":4}],"diagramNotes":[]} Getting the message ID from the first http request into the url in the 2nd without quotations is causing me trouble.😔 Let me know if you want it in a different format.
m
so I think you should just be able to call the value directly, but maybe i have something wrong! I'm not sure i understand the need for the 
RESOURCE
variable?
can you copy / paste this and let me know if it works?
Copy code
{
  "agents": [
    {
      "disabled": false,
      "name": "explode individual emails",
      "options": "{\"mode\":\"explode\",\"path\":\"=get_email_from_msgraph.body.value\",\"to\":\"individual_email\"}",
      "position": {
        "x": 1845,
        "y": 975
      },
      "type": "eventTransformation"
    },
    {
      "disabled": false,
      "name": "Get Email from MSGraph",
      "options": "{\"url\":\"<https://graph.microsoft.com/v1.0/me/mailFolders/Inbox/messages?$filter=isRead> ne true\",\"method\":\"get\",\"headers\":{\"Authorization\":\"Bearer <<CREDENTIAL.msgraph>>\"},\"log_error_on_status\":[]}",
      "position": {
        "x": 1845,
        "y": 870
      },
      "type": "httpRequest"
    },
    {
      "disabled": false,
      "name": "Get attached email",
      "options": "{\"url\":\"<https://graph.microsoft.com/v1.0/me/messages/><<explode_individual_emails.individual_email.id>>/attachments/<<explode_attachments.individual_attachment.id>>\",\"method\":\"get\",\"headers\":{\"Authorization\":\"Bearer <<CREDENTIAL.oauth2020>>\"}}",
      "position": {
        "x": 1845,
        "y": 1410
      },
      "type": "httpRequest"
    },
    {
      "disabled": false,
      "name": "Explode Attachments",
      "options": "{\"mode\":\"explode\",\"path\":\"=get_attachments.body.value\",\"to\":\"individual_attachment\"}",
      "position": {
        "x": 1845,
        "y": 1200
      },
      "type": "eventTransformation"
    },
    {
      "disabled": false,
      "name": "trigger if .eml",
      "options": "{\"rules\":[{\"type\":\"regex\",\"value\":\"#microsoft.graph.itemAttachment\",\"path\":\"<<explode_attachments.individual_attachment[\\\"@odata.type\\\"]>>\"}]}",
      "position": {
        "x": 1845,
        "y": 1305
      },
      "type": "trigger"
    },
    {
      "disabled": false,
      "name": "Get Attachments",
      "options": "{\"url\":\"<https://graph.microsoft.com/v1.0/me/messages/><<explode_individual_emails.individual_email.id>>/attachments\",\"method\":\"get\",\"headers\":{\"Authorization\":\"Bearer <<CREDENTIAL.msgraph>>\"},\"log_error_on_status\":[]}",
      "position": {
        "x": 1845,
        "y": 1095
      },
      "type": "httpRequest"
    }
  ],
  "links": [
    {
      "sourceIdentifier": 0,
      "receiverIdentifier": 5
    },
    {
      "sourceIdentifier": 4,
      "receiverIdentifier": 2
    },
    {
      "sourceIdentifier": 3,
      "receiverIdentifier": 4
    },
    {
      "sourceIdentifier": 5,
      "receiverIdentifier": 3
    },
    {
      "sourceIdentifier": 1,
      "receiverIdentifier": 0
    }
  ],
  "diagramNotes": []
}
r
Hi Thomas, when I tried passing it directly I kept getting a 400 error from the graph stating a malformed ID. The resource method was the latest in ways I was trying to get it to work. I will carry on using what you have provided. Thank you for your help.
m
did you get it working?
a
I've gone through this for automating purging of emails in phishing campaigns. A few things to consider. Do you have the permissions to query other users inboxes assigned to your azure app? Have you tried on just your own account for testing? Also it's not messageID you have to give in the API url, each message has an individual ID. Two seperate fields. If you have to do this at scale it's a lot of enumerating. I cheated a bit and had our MS messagetrace feed into a SIEM and I can pull raw logs from their for specific emails and get the individual IDs. But messageID is the wrong reference here.
2 Views
Open in Slack
PreviousNext
Powered by