Pattern Match on Email Headers to retrieve a specific value

InsightConnect
, ,
1

Hi,

I have a step in a workflow which I’m looking to try and extract the value of a specific header. Can I use the pattern match function to achieve this, or is there a separate function that would be better suited to do this?

For example, if the header is has a “name” of 'Sender-IP", how to I extract the associated “value” of this to a variable I can use across the rest of the workflow?

2

How do you get your headers? I have a Python script we use in our workflow. The header comes across as an attachment and we loop over the attached text file to pull out the relevant information.

def run(params={}):
    
    from email.parser import Parser
    import socket
      
    header_file = params.get('header')
    bad_chars = [">"]
 
    parser = Parser()
    
    msg = parser.parsestr(header_file)
    d = {}
    d['Date'] = msg["Date"]
    d['From'] = msg["From"]
    d['Subject'] = msg["Subject"]
    try:
        d['SenderDomain'] = msg['From'].split("@")[1]
    except:
        d['SenderDomain'] = msg['From']
    for i in bad_chars:
        d['SenderDomain'] = d['SenderDomain'].replace(i, '')
    d['Auth-Results'] = msg['Authentication-Results']
    d['Received-SPF'] = msg['Received-SPF']
    try:
        d['Smtp'] = msg['Authentication-Results'].split(";")[0].split("=")[2]
    except:
        d['Smtp'] = msg['From']
    d['Return-Path'] = msg['Return-Path']
    d['Received'] = msg['Received']
    try:
        d['ipaddr'] = socket.gethostbyname(str(d['Smtp']))
    except:
        try:
           d['ipaddr'] = socket.gethostbyname(str(d['SenderDomain']))
        except:
           d['ipaddr'] = "Domain will not resolve!!!!" 
    return d
3

Looking for headers with an email trigger is tough.
I loop through the header field, then have a Decision step looking for the Key name.
If found it creates a string array of the key=value, that I then loop though to create an object.
Not pretty and if you find a better way, I’d be interested. Just not python for maintainability reasons.