IMAP mode

The Receive Email Action in IMAP mode emits Events when it detects new emails on an IMAP server.

Use the Receive Email Action to automate actions based on received emails, for example: analyze potentially malicious emails for threats; auto-respond to customers based on email subject or body; or alert teammates in Slack when particular emails are received.

Features​ 

  • Check for new emails manually or run on a schedule.

  • In the first visit to a folder, only check for the initial status and do not emit Events.

  • Only emit Events when new emails meet certain conditions.

  • Optionally mark emails as "read" after checking IMAP server.

  • Specify the folder to check for new emails.

  • Keep a list of Message-Id's for 100 most recent emails, so duplicate emails do not emit multiple events.

Configuration Options​ 

  • host: Enter the host of the IMAP server.

  • username: Enter the username used to authenticate to the IMAP server.

  • password: Enter the password used to authenticate to the IMAP server. Remember, never include sensitive details such as passwords directly in Action configurations. Instead, use the CREDENTIAL formulas key (see example configuration options below).

  • port: (Optional) Enter the port used to connect to the IMAP server.

  • ssl: (Optional) When this key is set to "true", the Action will connect to the IMAP server using SSL.

  • folders: Define an array of folder names to monitor for new emails.

  • mark_as_read: (Optional) When this key is set to "true" it will mark detected emails mails as read on the IMAP server. Set as "false" by default.

  • disable_ssl_verification: (Optional) Set to 'true' to disable ssl verification. Set as "false" by default.

  • use_tunnel: (Optional) If you have one or more Tines Tunnels configured, you can choose to send IMAP traffic from this Action through a Tunnel.

  • mode: (Optional) A string denoting the Receive Email Action's mode of operation, in this case: imap. A Receive Email Action defaults to Email mode when this field is not provided.

  • authentication_type: (Optional) Selects the authentication type used for the IMAP connection. The default LOGIN type can be changes to XOAUTH2 in order to use OAuth2 credentials - when using this type you can set an OAuth2 credential as the password to connect successfully.

  • mime_types: Allows you to set the sort order of the parts, overriding the default sort order. Defaults to 'text/plain', then 'text/enriched', then 'text/html' with any other content type coming after.

  • include_rfc822: Optionally include the raw message, in RFC 822 format, in emitted events (under the rfc822 key).

Emitted Events​ 

Events emitted by the Receive Email Action in IMAP mode look similar to the below:

{
  "message_id": "1688375064.8603887.1514928714437@example.com",
  "folder": "INBOX",
  "subject": "This is the subject of the email",
  "from": "bob@example.com",
  "to": ["alice@example.com"],
  "cc": ["carol@example.com"],
  "date": "2018-01-01T10:10:00+00:00",
  "mime_type": "text/plain",
  "body": "This is the body of the email.",
  "has_attachment": true,
  "attachments": [
    {
      "filename": "hello.txt",
      "guid": "dee73fe0-044f-4e2d-873e-e6850debc03a",
      "md5": "aba2d86ed17f587eb6d57e6c75f64f05",
      "sha256": "807126cbae47c03c99590d081b82d5761e0b9c57a92736fc8516cf41bc564a7d",
      "sizeinbytes": 1578,
      "base64encodedcontents": "ug4AtAnNIbgBTM0hVGhpc=="
    }
  ]
}

Example Configuration Options​ 

Create Events for all emails from the Inbox of a GMail/GSuite account:

{
  "host": "imap.gmail.com",
  "username": "alice@gmail.com",
  "password": "<<CREDENTIAL.gmail>>",
  "ssl": true,
  "folders": ["INBOX"],
  "conditions": {}
}

Create Events for emails sent to an Office365 account where the subject contains "Urgent" (case-insensitive):

{
  "host": "outlook.office365.com",
  "username": "alice@outlook.com",
  "password": "<<CREDENTIAL.outlook>>",
  "ssl": true,
  "disable_ssl_verification": true,
  "mark_as_read": true,
  "folders": ["INBOX"],
  "conditions": {
    "subject": "(?i)urgent"
  }
}

Create Events for emails from any @example.com address which also include an attachment:

{
  "host": "outlook.office365.com",
  "username": "alice@outlook.com",
  "password": "<<CREDENTIAL.outlook>>",
  "ssl": true,
  "folders": ["INBOX"],
  "conditions": {
    "from": "*@example.com",
    "has_attachment": true
  }
}

Create Events for all emails from the Inbox of a GMail/GSuite account, connecting through OAuth2:


{
  "host": "imap.gmail.com",
  "username": "alice@gmail.com",
  "password": "<<CREDENTIAL.gmail_oauth2>>",
  "ssl": true,
  "folders": ["INBOX"],
  "conditions": {},
  "authentication_type": "XOAUTH2"
}
Was this helpful?