EmailSearches

Overview

The Adhoc adapter has 6 endpoints for querying Email Message objects. The endpoints allow the user to query on:

• Email subject
• Email Address Field: 'from'
• Email Address Field: 'to'
• Email Address Field: 'cc'
• Email Address Field: 'bcc'
• All Email Address Fields

The endpoints expect a plain text list of query-able values and returns matching IDs against these values. The All Email Address Fields endpoint will iterate through each Address Field and will return matching values on each Address Field with IDs. However, there is no indication on what Address Field was matched, which is the reason for the more specific Address Field queries.

---

Email subject query

Users can query the REST endpoint:

/adapter/certuk_adhoc/email/subject/

With a comma or new line separated list of queryable email subjects. If the Accept header on the request is application/json or text/json then the user will receive a JSON response of email subjects and matching IDs. If not, the user will receive a plain text response.

Input:

Malicious email ,
hi

JSON Response:

{
  "duration": "2.68",
  "matches": [
    {
      "Malicious email": [
        "opensource:observable-94322cba-b29e-40f3-bbe6-c0d65d7e59e7"
      ]
    },
    {
      "hi": [
        "opensource:observable-733d7395-a82f-41a0-b9c8-e17fe78d6bd7"
      ]
    }
  ],
  "state": "success"
}

Plain text response:

Malicious email - opensource:observable-94322cba-b29e-40f3-bbe6-c0d65d7e59e7
hi - opensource:observable-733d7395-a82f-41a0-b9c8-e17fe78d6bd7

---

Email Address Fields

This is an example for the 'from' address field and then querying the other endpoints requires the user to change the URL for the endpoint. The endpoints for querying email address fields are:

/adapter/certuk_adhoc/email/address/from/
/adapter/certuk_adhoc/email/address/to/
/adapter/certuk_adhoc/email/address/cc/
/adapter/certuk_adhoc/email/address/bcc/
/adapter/certuk_adhoc/email/address/

Following the same steps as before:

Input:

[email protected], 
[email protected]

JSON Response:

{
  "duration": "2.59",
  "matches": [
    {
      "[email protected]": [
        "opensource:observable-94322cba-b29e-40f3-bbe6-c0d65d7e59e7"
      ]
    },
    {
      "[email protected]": [
        "opensource:observable-733d7395-a82f-41a0-b9c8-e17fe78d6bd7"
      ]
    }
  ],
  "state": "success"
}

Plain text response:

[email protected] - opensource:observable-94322cba-b29e-40f3-bbe6-c0d65d7e59e7
[email protected] - opensource:observable-733d7395-a82f-41a0-b9c8-e17fe78d6bd7

---

Postman Is a web REST client that allows you to enter and monitor HTTP requests and responses. One possible option for users to query the REST endpoints.