Hey there,
Here's one approach you might want to take a look at.
- Have you seen the Business Rule called "Handle Deprecated Observable Fields" on the SIR Table?
-
- There are certain fields that exist on the SIR table (Source IP, Destination IP, Malware URL, etc) -> that have special logic handled by this Biz Rule...
- When you add a value to these fields for a given SIR record, they will automatically create Observables (if they do not already exist), and associate them to the SIR record
- You can look at leveraging this functionality (i.e. putting your parsed values into these fields, checking to see that they correctly establish Observables associated to the SIR (via the M2M table)
- I also believe these can handle comma separated values - you can try to test that out as well
- Alternatively, there's a Script Include called "AddBulkObservablesToSI" you might want to look at:
-
- There are functions that you might be able to use, or reference to create your own functions -> to handle this.
Reference - Using the logic from "Handle Deprecated Observable Fields" Biz Rule:
Hey there,
I think there might be a slight adjustment needed on Line.31 - where you do your `Split`.
Using [email.body_text] should kick out text, vs HTML.
You can try to switch your split from:
var lines = email.body_text.val().split(/<br>/);To:
//var lines = email.body_text.val().split(/<br>/);
var lines = email.body_text.split('\n'); //<-- this is text, not HTML
Full transparency - I'm not a regex ninja 🙂
I kicked the tires using your script as an example, and leveraged OOTB Functions includes with SecOps to do the Regex validation, and attempted to create an SIR from an email to handle an IPV4 addr.
It worked successfully:
- Created the SIR, added the IPV4 to [dest_ip] field on the SIR
- Associated the IPV4 as an Observable to the SIR (via the Biz Rule for accelerator fields)
Not sure why you don't have that Biz Rule for the accelerator fields.
- Attached an XML export of the Biz Rule here, if you want to import it and do some testing with it.
Here is the updated array iteration I kicked the tires at:
//var lines = email.body_text.val().split(/<br>/);
var lines = email.body_text.split('\n'); //<-- this is text, not HTML
for (var i=0; i<lines.length; i++) {
//code here using lines[i] which will give you each line of the message
gs.info ("test val is " + lines[i]);
if (new sn_sec_cmn.RegexValidationUtil().isIPV4Valid(lines[i])) {
current.dest_ip = lines[i];
gs.info("matched to an IP!" + lines[i]);
}
}
Here's the email for simulating:
Here is the SIR that was created for the IPV4 addr:
Here is the updated script that you can iterate from:
(function runAction(/*GlideRecord*/ current, /*GlideRecord*/ event, /*EmailWrapper*/ email, /*ScopedEmailLogger*/ logger, /*EmailClassifiers*/ classifier) {
// Implement email action here
current.short_description = email.subject + " - " + "User Reported";
current.description = email.body_text;
//get affected by from reported_by value
var userID = email.body.reported_by;
gs.info('INBOUND TEST: ' + userID);
if (userID != '') {
var tUser = '';
var gr = new GlideRecord('sys_user');
gr.addQuery('email', userID);
gr.addActiveQuery();
gr.query();
gs.info('INBOUND 2: ' + gr.getRowCount());
if (gr.getRowCount() == 1) {
while (gr.next()) {
gs.info('INBOUND 3: ' + gr.getRowCount());
current.affected_user = gr.sys_id;
current.u_region = gr.u_region;
current.u_country = gr.u_proper_country;
current.location = gr.location;
current.category = "Phishing";
if (gr.vip == true) {
current.subcategory = ' VIP Target';
} else {
current.subcategory = ' Non-VIP Target';
}
}
}
//var lines = email.body_text.val().split(/<br>/);
var lines = email.body_text.split('\n');
for (var i=0; i<lines.length; i++) {
//code here using lines[i] which will give you each line of the message
gs.info ("test val is " + lines[i]);
if (new sn_sec_cmn.RegexValidationUtil().isIPV4Valid(lines[i])) {
current.dest_ip = lines[i];
gs.info("matched to an IP!" + lines[i]);
}
}
}
// logger.logError(JSON.stringify(email));
})(current, event, email, logger, classifier);
/*
Legacy fields
current.source_ip
current.dest_ip //We're using dest_ip for the email parser
current.other_ioc
current.malware_hash
*/
