So, I have been working on setting it up so that my user reported emails go to from KnowBe4 to a webhook, where it sends a JSON over to my Logic App. I have figured out how to use this data to open tickets in my ticketing software. However, I am constructing the second app that will be used to close the ticket, and I am not sure how to grab the data that I need. In the JSON below, there is an array that has a bunch of objects in them, and I am looking to have it so that the Logic App can find the object that has "trigger_type": "User", then goes into that object and finds the "trigger_name": "Closer Name". For all automated tasks, the trigger_type is null and the trigger_name is null. However, when someone manually closes the ticket, it pops a trigger_type of "User", and in that same object, it shows the "trigger_name" with the user's name that closed the ticket.
If I can get that user name into a Compose or variable, I should have no issues getting the ticket closed in our ticketing software on their behalf, but I this filtering of this array is a little outside of my knowledge. If anyone knows a good way of going under that history array and grabbing what I need, I would be thrilled to see how to do it!
Sorry for the massive JSON here. I just figured it might be better if someone was able to use the entire thing, as opposed to just the "history" section.
{
"body": {
"headers": [
{
"sha1": "1c3dcbc5a9",
"headers": [
{
"From": "domainname Automated Notification System <ivcom>"
},
{
"Subject": "Completed: Complete viaSign: #2 -domainname - Friday, February 23, 2024"
},
{
"To": " <@domainname.com>"
},
{
"Content-Type": "multipart/mixed; boundary=\"----sinikael-?=_1-17087150419670.9288702915236632\""
},
{
"Content-Transfer-Encoding": "7bit"
}
],
"filename": "rawHeaders.txt",
"byte_size": 7396,
"mime_type": "text/plain",
"md5": "d624ae7cbef7"
}
],
"addresses": {
"cc": "",
"reply_to": "",
"reported_by": "@domainname.com",
"from": "ivm",
"to": [
"@domainname.com"
]
},
"links": [
"https://trad5b6b8&id=6b7205781d",
"http://domainname.com"
],
"phishml": {
"confidence_spam": "0.002280122367665171",
"confidence_clean": "0.00008148026972776279",
"category": "threat",
"confidence_threat": "0.9976683855056763"
},
"history": [
{
"date": "2024-02-23T14:15:46-05:00",
"trigger_name": null,
"causer_type": "Action",
"event_type": "other",
"trigger_type": null,
"events": {
"phishrip_completed": {
"queried_fields": [
"from",
"subject"
],
"read": "0",
"time_range": {
"start_time": "2024-02-22T14:10:25-05:00",
"end_time": "2024-02-23 19:10:25 +0000"
},
"quarantine": "true",
"id": "8de87290-5ae1-41de-9f31-a75821972172",
"results": "0",
"users": "0",
"status": "complete"
}
},
"causer_name": "Threat Email Notification for Reporter"
},
{
"date": "2024-02-23T14:10:31-05:00",
"trigger_name": null,
"causer_type": "Action",
"event_type": "other",
"trigger_type": null,
"events": {
"phishrip_started": {
"queried_fields": [
"from",
"subject"
],
"time_range": {
"start_time": "2024-02-22T14:10:25-05:00",
"end_time": "2024-02-23 19:10:25 +0000"
},
"quarantine": "true",
"id": "8de87290-5ae1-41de-9f31-a75821972172",
"status": "processing"
}
},
"causer_name": "Threat Email Notification for Reporter"
},
{
"date": "2024-02-23T14:10:25-05:00",
"trigger_name": "Closer Name",
"causer_type": "Action",
"event_type": "other",
"trigger_type": "User",
"events": {
"emails": [
{
"action_email_id": "c4ba53c9-8932-40a7-a347-f0cb74d04f15",
"to": [
"@domainname.com"
],
"email": "Threat Email Notification for Reporter",
"status": null
}
],
"changed_fields": {
"action_status": [
"received",
"resolved"
]
}
},
"causer_name": "Threat Email Notification for Reporter"
},
{
"date": "2024-02-23T14:07:39-05:00",
"trigger_name": null,
"causer_type": "User",
"event_type": "other",
"trigger_type": null,
"events": {
"changed_fields": {
"viewed": [
false,
true
]
}
},
"causer_name": "Name Here"
},
{
"date": "2024-02-23T14:06:06-05:00",
"trigger_name": null,
"causer_type": "Action",
"event_type": "other",
"trigger_type": null,
"events": {
"emails": [
{
"action_email_id": "0ebd75cc-23ea-4f91-8459-023f81e6c891",
"to": [
"@domainname.com",
"@domainname.com",
"@domainname.com",
"@domainname.com",
"@domainname.com"
],
"email": "Threat Email Notification for Admin",
"status": null
}
],
"tags": {
"added": [
"MANUAL"
]
},
"changed_fields": {
"severity": [
"unknown_severity",
"critical"
],
"category": [
"unknown",
"threat"
]
}
},
"causer_name": "Threat Notification for Admin"
},
{
"date": "2024-02-23T14:05:56-05:00",
"trigger_name": null,
"causer_type": null,
"event_type": "other",
"trigger_type": null,
"events": {
"changed_fields": {
"pipeline_status": [
"processing",
"processed"
]
}
},
"causer_name": null
},
{
"date": "2024-02-23T14:05:38-05:00",
"trigger_name": null,
"causer_type": "Integrations::Virustotal::Report",
"event_type": "other",
"trigger_type": null,
"events": {
"report": {
"name": "VirusTotal",
"results": [
{
"field": "url",
"value": "domainname.com"
},
{
"field": "scanned",
"value": 89
},
{
"field": "positives",
"value": 0
},
{
"field": "scan_date",
"value": "2023-04-19 08:27:24 UTC"
},
{
"field": "permalink",
"value": "https://www.virustotn/u-5169a4f97145c6a3572aba5ffaa180763a37e9c7bb0f62babe950a6f53fe63a4-1681892844"
}
]
},
"tags": {
"removed": [
"VT_PENDING"
],
"added": [
"VT_SCANNED"
]
}
},
"causer_name": "VirusTotal"
},
{
"date": "2024-02-23T14:05:28-05:00",
"trigger_name": null,
"causer_type": "Integrations::Virustotal::Report",
"event_type": "other",
"trigger_type": null,
"events": {
"report": {
"name": "VirusTotal",
"results": [
{
"field": "url",
"value": "https://nam11.eserved=0"
},
{
"field": "scanned",
"value": 91
},
{
"field": "positives",
"value": 0
},
{
"field": "scan_date",
"value": "2024-02-23 18:54:09 UTC"
},
{
"field": "permalink",
"value": "https://wwaa14449"
}
]
}
},
"causer_name": "VirusTotal"
},
{
"date": "2024-02-23T14:05:16-05:00",
"trigger_name": null,
"causer_type": "Integrations::PhishMl::Report",
"event_type": "other",
"trigger_type": null,
"events": {
"report": {
"name": "Phish ML",
"results": [
{
"field": "clean",
"value": "0.01"
},
{
"field": "spam",
"value": "0.23"
},
{
"field": "threat",
"value": "99.77"
}
]
},
"tags": {
"added": [
"PML:THREAT"
]
}
},
"causer_name": "Phish ML"
},
{
"date": "2024-02-23T14:05:16-05:00",
"trigger_name": null,
"causer_type": "Rule",
"event_type": "other",
"trigger_type": null,
"events": {
"tags": {
"added": [
"KB4:SPF_PASS"
]
}
},
"causer_name": "KB4:DKIM_PASS"
},
{
"date": "2024-02-23T14:05:04-05:00",
"trigger_name": null,
"causer_type": null,
"event_type": "other",
"trigger_type": null,
"events": {
"message_link": {
"item_id": "66cedbe1-c413-4230-ae7e-c3d639b79a9d",
"item_type": "MessageLink",
"performed_action": "virus_total",
"name": "https://t8d5b6b8&id=6b7205781d"
}
},
"causer_name": null
},
{
"date": "2024-02-23T14:05:04-05:00",
"trigger_name": null,
"causer_type": null,
"event_type": "other",
"trigger_type": null,
"events": {
"message_link": {
"item_id": "3530e872-7fa4-4d12-b597-1a2577c7b44d",
"item_type": "MessageLink",
"performed_action": "virus_total",
"name": "http://domainname.com"
}
},
"causer_name": null
},
{
"date": "2024-02-23T14:04:35-05:00",
"trigger_name": null,
"causer_type": null,
"event_type": "created",
"trigger_type": null,
"events": null,
"causer_name": null
}
],
"bad_links": [],
"tags": [
"FAILURE_TAG",
"SUCCESS_TAG",
"MANUAL",
"VT_SCANNED",
"KB4:SPF_PASS",
"KB4:DKIM_PASS",
"PML:THREAT"
]
}
}
