Skip to content

About Email Intake Connectors#

This topic explains what email intake connectors are in TheHive.

Organizations that receive alert data by email can use email intake connectors to automate the creation of alerts in TheHive.

Usage#

Email intake connectors integrate mailboxes that receive alerts.

It automatically processes incoming emails, extracts relevant information, and creates alerts within TheHive platform. The email itself, its sender, and any attached files are automatically added as observables within the respective alerts.

Parsing emails

The content of the email itself isn't automatically parsed when creating the alert. To enable observable extraction, a notification must trigger a FilteredEvent that runs the EmlParser analyzer.

Below is an example of the FilteredEvent trigger:

{
    "_and": [
        {
            "_is": {
                "action": "create"
            }
        },
        {
            "_is": {
                "objectType": "Observable"
            }
        },
        {
            "_is": {
                "object.alert.type": "email-intake"
            }
        }
    ]
}

Data mapping#

Alerts#

Alert field API Alert field UI Alert value
title Title The subject of the email. If empty, displays no subject.
type Type email-intake
source Source The formatted name of the email intake connector.
sourceRef Reference {message-id}, or {lastUidValidity}.{uidEmail} if the message-id is inaccessible.
date Occurred date The date the email was received.
severity Severity low
tlp TLP amber
pap PAP amber
follow Track new updates false
tags Tags [email-intake, {source}, {provider name}, {inbox folder name}]
status Status new
description Description The content of the email.

Modification restrictions

Only the prefilled values for the tags, source, and type fields allow modification. Changes to other fields aren't allowed.

Observables#

Observable field API Observable field UI Observable value
message Description Automatically created from email followed by {alert.id} and either {sender} or {file}.
tlp TLP {alert.tlp}
pap PAP {alert.pap}
ioc IOC false
sighted Sighted false
ignoreSimilarity Ignore similarity false
dataType Data type file for the email or mail for the sender's email address.
tags Tags {alert.tags}

Authorized email providers#

The following email providers are available in TheHive:

  • Google Workspace
  • IMAP server
  • Microsoft 365
  • 5.5 Microsoft Graph API

Permissions#

Required permissions

Only users with an admin-type profile that has the managePlatform permission can manage email intake connectors in TheHive.

Next steps