G Suite for GMail

Integrates with G Suite for various investigative and containment actions

Supported Actions

• on poll: Poll for new emails from Gmail and yield Container objects.
• on es poll: Poll for new emails and yield Finding objects for ES ingestion.
• test connectivity: Test connectivity to Google Workspace. Verifies that the service account credentials are valid and can access the configured domain.
• get user: Retrieve user profile information. Uses the Gmail API to get user profile metadata including message and thread counts.
• list users: List users in the Google Workspace domain. Uses the Admin SDK to retrieve users with pagination support.
• run query: Search emails in a user's mailbox. Constructs a Gmail query from provided filters and returns matching emails with pagination support.
• delete email: Delete emails from a user's mailbox (idempotent). Deletes one or more emails by their message IDs. If a message ID doesn't exist (likely already deleted), it's treated as successful and added to ignored_ids.
• get email: Retrieve and parse email details. Fetches email from Gmail API, parses MIME structure, extracts IOCs and optionally downloads attachments and raw email to vault.
• send email: Send email via Gmail. Constructs MIME message with attachments, respecting 25MB size limit. Optionally creates send-as alias before sending.
• trash email: Move emails to trash in a user's mailbox (idempotent). Moves one or more emails to the Trash label by their message IDs. If a message ID doesn't exist, it is treated as successful and added to ignored_ids.
• untrash email: Restore emails from trash in a user's mailbox (idempotent). Removes one or more emails from the Trash label by their message IDs. If a message ID doesn't exist, it is treated as successful and added to ignored_ids.
• add label: Add labels to emails in a user's mailbox using Gmail batchModify. Applies one or more label IDs to one or more messages.
• make request: make request