Incoming feed - IMAP Email attachment fetcher#

Caution

The IMAP Email fetcher and IMAP Email Attachment fetcher is End of Life as of 5th April 2022.

They will continue to be available for download, and is eligible for support until End of Support Life (EOSL) on 5th October 2022. EOSL products receive critical fixes and security updates, but no further improvements.

Use the newer IMAP Email and attachment fetcher instead.

Note

This article describes how to configure incoming feeds for a particular feed source. To see how to configure incoming feeds in general, see Create and configure incoming feeds.

Specifications

Transport types

IMAP Email attachment fetcher

Content type

See Ingested content types.

Ingested data

Ingests only email attachments from a given IMAP server.

Endpoint(s)

N/A

Processed data

See Ingested content types.

Warning

Back up your Inbox folder before running this feed.

Fetching emails with this transport type will delete emails that it downloads, even if processing the attachment fails.

Deduplicated attachments also deletes the processed emails.

Requirements#

  • IMAP-enabled email account

  • IMAP user name

  • IMAP password

Limitations#

  • Emails are only fetched from the Inbox folder of the target email account.

  • These email providers are not supported:

    • Microsoft Office 365 Outlook

Configure the incoming feed#

  1. Create or edit an incoming feed.

  2. Under Transport and content, fill out these fields:

    Note

    Required fields are marked with an asterisk (*).

    Field

    Description

    Transport type*

    Select IMAP Email attachment fetcher from the drop-down menu.

    Content type*

    Select a content type from the drop-down menu.

    See Ingested content types for more information.

    Warning

    If the selected content type is not compatible with the retrieved attachment file type, the feed fails.

    Accept password protected archives

    Select to display the Archive password field.

    Archive password

    Enter a password to decrypt archives downloaded from this feed.

    Caution

    If the Archive password field does not appear, select a different Content type, and then re-select your intended Content type to force it to appear.

    Host*

    Enter the address of your IMAP server.

    For example: imap.example.com

    Username

    Enter your IMAP account user name.

    Password

    Enter your IMAP account password.

    Use SSL

    Caution

    Most IMAP servers require IMAP SSL. If your feed appears to be unable to fetch emails, select this option to fetch using IMAP SSL.

    • Leave option empty to use the default IMAP port 143.

    • Select to use the IMAP SSL port 993.

    To keyword

    Tip

    Leave To keyword, From keyword, and Subject keyword empty to fetch all emails from your IMAP Inbox folder.

    Enter a keyword to only include emails that have a “To” field (email recipients) containing content that matches it.

    From keyword

    Enter a keyword to only include emails that have a “From” field (sender’s email address) containing content that matches it.

    Subject keyword

    Enter a keyword to only include emails that have a “Subject” field (email subject) containing content that matches it.

    SSL certificate authentication

    Select to enable SSL client certificate authentication.

    When enabled, you can set the SSL certificate and key to use.

    SSL certificate

    Enter the contents of your PEM-formatted certificate chain files.

    It should look like this:

    -----BEGIN CERTIFICATE REQUEST-----
MIICvDCCAaQCAQAwdzELMAkGA1UEBhMCVVMxDTALBgNVBAgMBFV0YWgxDzANBgNV
BAcMBkxpbmRvbjEWMBQGA1UECgwNRGlnaUNlcnQgSW5jLjERMA8GA1UECwwIRGln
[...]
29XI1PpVUNCPQGn9p/eX6Qo7vpDaPybRtA2R7XLKjQaF9oXWeCUqy1hvJac9QFO2
97Ob1alpHPoZ7mWiEuJwjBPii6a9M9G30nUo39lBi1w=
-----END CERTIFICATE REQUEST-----

    SSL key

    Enter the contents of your PEM-formatted SSL certificate key.

    It should look like this:

    -----BEGINRSAPRIVATEKEY-----
MIIEpQIBAAKCAQEA3Tz2mr7SZiAMfQyuvBjM9Oi..Z1BjP5CE/Wm/Rr500P
RK+Lh9x5eJPo5CAZ3/ANBE0sTK0ZsDGMak2m1g7..3VHqIxFTz0Ta1d+NAj
[...]
engiVoWc/hkj8SBHZz1n1xLN7KDf8ySU06MDggB..hJ+gXJKy+gf3mF5Kmj
DtkpjGHQzPF6vOe907y5NQLvVFGXUq/FIJZxB8k..fJdHEm2M4=
-----ENDRSAPRIVATEKEY-----

  3. Store your changes by selecting Save.

Ingested content types#

This incoming feed downloads emails from an IMAP server and only ingests its attachments. The rest of the email is discarded.

Tip

If you want to keep both the email body and its attachments, use the Incoming feed - IMAP Email fetcher instead.

Content type table#

Select a content type to ingest email attachments as that content type.

The content type you select must match the content type of the email attachments being ingested, or the feed will fail.

Available content types:

Content type

Description

EclecticIQ JSON

Ingest EclecticIQ JSON to produce EclecticIQ entities.

Email Message

Similar to the Text content type.

Ingest email attachments to produce:

  • A Report entity.

    • The email attachment is converted to ASCII text, and set to the Analysis field of the entity.

      Note

      The UI displays UTF-8 text, but the data is stored as ASCII.

    • An EML file attached to the entity. This EML file is the ingested email attachment directly converted to ASCII text.

See the Text content type below for more information.

Caution

The email body is discarded even though the target content type is “Email Message”. Only email attachments are ingested.

MISP JSON

Ingest MISP JSON to produce Indicators and Incidents.

PDF

Ingest PDF to produce:

  • A Report entity.

  • The text content of the PDF set to the Analysis field of the entity.

  • The original PDF attached to the entity.

SpyCloud Breach Data JSON

Ingest JSON from SpyCloud to produce Incidents.

STIX 1.0

Ingest STIX 1.0 XML.

STIX 1.1

Ingest STIX 1.1 XML.

STIX 1.1.1

Ingest STIX 1.1.1 XML.

STIX 1.2

Ingest STIX 1.2 XML.

STIX 2.1

Ingest STIX 2.1 JSON. See the documentation on how STIX 2.1 data is processed.

Text

Ingest email attachments as ASCII text files, regardless of actual file type.

This produces:

  • A Report entity.

  • The ASCII text content of the ingested file set to the Assessment field of the entity.

    Note

    The UI displays UTF-8 text, but the data is stored as ASCII.

  • The original file attached to the entity.

This content type is compatible with most file types. It treats all attachments as ASCII text files.

File headers are preserved during this conversion.

Deduplicated attachments#

When this feed downloads an email attachment, it compares the file hash of the downloaded attachment with files that have already been processed by the Intelligence Center.

If the file hash matches an existing record, the email attachment is not ingested.

Warning

Emails containing attachments that have been deduplicated are also deleted from the target email account’s Inbox once this feed accessess its contents.

Back up your Inbox folder before running this feed.