How to configure Email EML Connector in chronicle SOAR to pull email from a gmail account?

[Antonino_La2]

Hi, Is there a way to configure Email EML Connector in chronicle SOAR to pull email from a gmail account? Google disabled the possibility to Turn on access for less secure apps and this is a requirement as per documentation here https://integrations.siemplify.co/doc/email-v2#overview

[Dmitry_Sarakeev]

hey, it is possible, you need to enable 2FA on the account and configure something called "App Password". So you will need to auth with user name and app password instead of regular password.

that setup should work

[Antonino_La2]

Hi @Dmitry_Sarakeev thank you for the reply. I've enabled 2FA and setup the App Password. Unfortunately testing the connector I'm still getting the same error that appear when I've tried with username and password auth.

[Antonino_La2]

This is the error I get: Error when executing dynamic script connector Email EML Connector_6381674f-0675-47e2-9d4f-17e63656f596_test. Exit code: 1. Script output: Script did not return expected data. Did you call build_result/end_script? Check DebugOutput for details. Debug output: /usr/local/lib/python2.7/site-packages/arrow/arrow.py:28: DeprecationWarning: Arrow will drop support for Python 2.7 and 3.5 in the upcoming v1.0.0 release. Please upgrade to Python 3.6+ to continue receiving updates for Arrow. DeprecationWarning, /opt/siemplify/siemplify_server/bin/Scripting/PythonSDK/SiemplifyVaultCyberArkPam.py:10: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release. from cryptography.hazmat.primitives.serialization.pkcs12 import load_key_and_certificates [2023-05-08,13:48:48,000 INFO] =======Starting Email EML Connector.======= [2023-05-08,13:48:48,000 INFO] The current regex map is: {'to': '(?<=To:).*<(.*?)>|(?<=^To: ).*', 'from_list': '(?<=From:).*<(.*?)>|(?<=From: ).*', 'subject': '(?<=Subject:\\* ).*|(?<=Subject: ).*'} [2023-05-08,13:48:48,000 INFO] Connecting to Email Manager [2023-05-08,13:48:48,000 INFO] Login to IMAP [2023-05-08,13:48:48,000 ERROR] Got exception on main handler. [2023-05-08,13:48:48,000 ERROR] Traceback (most recent call last): File "/opt/siemplify/siemplify_server/bin/Scripting/PythonSDK/IntegrationsVirtualEnvironment/#/Email_V27.0/bv44eqpp.0qv/y5t2ob0e.ief.py", line 302, in main use_ssl=use_ssl) File "/opt/siemplify/siemplify_server/bin/Scripting/PythonSDK/IntegrationsVirtualEnvironment/#/Email_V27.0/bv44eqpp.0qv/EmailManager.py", line 297, in login_imap port)) if use_ssl else imaplib.IMAP4(host=host, port=int(port)) File "/usr/local/lib/python2.7/imaplib.py", line 1168, in __init__ IMAP4.__init__(self, host, port) File "/usr/local/lib/python2.7/imaplib.py", line 173, in __init__ self.open(host, port) File "/usr/local/lib/python2.7/imaplib.py", line 1179, in open self.sock = socket.create_connection((host, port)) File "/usr/local/lib/python2.7/socket.py", line 557, in create_connection for res in getaddrinfo(host, port, 0, SOCK_STREAM): gaierror: [Errno -2] Name or service not known STDOUT: Test execution started =======Starting Email EML Connector.======= The current regex map is: {'to': '(?<=To:).*<(.*?)>|(?<=^To: ).*', 'from_list': '(?<=From:).*<(.*?)>|(?<=From: ).*', 'subject': '(?<=Subject:\\* ).*|(?<=Subject: ).*'} Connecting to Email Manager Login to IMAP Got exception on main handler. [Errno -2] Name or service not known STDERR: Traceback (most recent call last): File "/opt/siemplify/siemplify_server/bin/Scripting/PythonSDK/IntegrationsVirtualEnvironment/#/Email_V27.0/bv44eqpp.0qv/y5t2ob0e.ief.py", line 463, in main(is_test=True) File "/opt/siemplify/siemplify_server/bin/Scripting/PythonSDK/SiemplifyUtils.py", line 81, in wrapper return func(*args, **kwargs) File "/opt/siemplify/siemplify_server/bin/Scripting/PythonSDK/IntegrationsVirtualEnvironment/#/Email_V27.0/bv44eqpp.0qv/y5t2ob0e.ief.py", line 302, in main use_ssl=use_ssl) File "/opt/siemplify/siemplify_server/bin/Scripting/PythonSDK/IntegrationsVirtualEnvironment/#/Email_V27.0/bv44eqpp.0qv/EmailManager.py", line 297, in login_imap port)) if use_ssl else imaplib.IMAP4(host=host, port=int(port)) File "/usr/local/lib/python2.7/imaplib.py", line 1168, in __init__ IMAP4.__init__(self, host, port) File "/usr/local/lib/python2.7/imaplib.py", line 173, in __init__ self.open(host, port) File "/usr/local/lib/python2.7/imaplib.py", line 1179, in open self.sock = socket.create_connection((host, port)) File "/usr/local/lib/python2.7/socket.py", line 557, in create_connection for res in getaddrinfo(host, port, 0, SOCK_STREAM): socket.gaierror: [Errno -2] Name or service not known ​ at Siemplify.Connectors.DynamicScriptConnector.DynamicScriptCaseConnector.ValidateScriptExecutionStatus(ConnectorContext context, IConnectorLoggingService loggingService, ScriptExecutionResult scriptResult, ConnectorInstance connectorInfo) in /sourceDir/Connectors/Siemplify.Connectors.DynamicScriptConnector/DynamicScriptCaseConnector.cs:line 288 at Siemplify.Connectors.DynamicScriptConnector.DynamicScriptCaseConnector.RunConnectorAsync(ConnectorContext context, Int64 integrationLastUpdated, CancellationToken cancellationToken, IConnectorLoggingService loggingService) in /sourceDir/Connectors/Siemplify.Connectors.DynamicScriptConnector/DynamicScriptCaseConnector.cs:line 159

View files in slack

[Dmitry_Sarakeev]

you are getting name or service unknown error

for gmail im using the follwoing config
imap server: imap.gmail.com
imap port: 993
smtp server: smtp.gmail.com
smtp port: 465 (doubt it but it can be 587)

[Antonino_La2]

I managed to get it work but with another connector. Using the one named "Email EML Connector" I get the error above. Using the one named "Email connector" everything works. Did you know the differences between them? Justo to point out, I used the same parameters as you for imap and smtp servers

[Dmitry_Sarakeev]

waaait... i misread! so you want to use exchange integration eml connector to connect to gmail? i surprised the regular email connector worked!
diff between them - EML connector creates CSOAR alerts only from attached to received emails EML files, email connector creates the alerts from the actual email received in mailbox

[Dmitry_Sarakeev]

i would recommend to use imap connector from email v2 integration to work with gmail

[Antonino_La2]

Ok I'll try the connector from email v2 then, thank you. But isn't that strange that EML version didn't work? I supplied the same credentials

[Dmitry_Sarakeev]

i would assume they both would not work

as we are using exchange web services lib (exchnagelib) in exchange integration that is not aimed at support of gmail.