Classifies Gmail phishing email messages.
Gmail
- Details
- Content
- Dependencies
- Version History
Gmail API and user management (This integration replaces the Gmail functionality in the GoogleApps API and G Suite integration).
Classifiers
| Name | Description |
|---|---|
Gmail - Classifier | |
Gmail - Incoming Mapper | Maps incoming Gmail phishing email message fields. |
Integrations
| Name | Description |
|---|---|
| Gmail | Gmail API and user management (This integration replaces the Gmail functionality in the GoogleApps API and G Suite integration). |
Playbooks
| Name | Description |
|---|---|
| Get Original Email - Gmail v2 | This v2 playbook uses the reporter's email headers to retrieve the original email. This decreases the number of tasks to retrieve the original email. |
| Search And Delete Emails - Gmail | This playbook searches Gmail to identify and delete emails with similar attributes to the malicious email. |
| Search all mailboxes - Gmail with polling | This playbook searches Gmail records for all Google users, designed for large companies with over 2500 Google users. |
| Search in mailboxes Gmail (Loop) with polling | This playbook should only run as a sub-playbook for the Search-all-mailboxes - Gmail playbook, it should not run alone. |
Classifiers
| Name | Description |
|---|---|
Gmail - Classifier | Classifies Gmail phishing email messages. |
Gmail - Incoming Mapper | Maps incoming Gmail phishing email message fields. |
Integrations
| Name | Description |
|---|---|
| Gmail | Gmail API and user management (This integration replaces the Gmail functionality in the GoogleApps API and G Suite integration). |
Playbooks
| Name | Description |
|---|---|
| Get Original Email - Gmail v2 | This v2 playbook uses the reporter's email headers to retrieve the original email. This decreases the number of tasks to retrieve the original email. |
| Search all mailboxes - Gmail with polling | This playbook searches Gmail records for all Google users, designed for large companies with over 2500 Google users. |
| Search And Delete Emails - Gmail | This playbook searches Gmail to identify and delete emails with similar attributes to the malicious email. |
| Search in mailboxes Gmail (Loop) with polling | This playbook should only run as a sub-playbook for the Search-all-mailboxes - Gmail playbook, it should not run alone. |
Required Content Packs (4)
| Pack Name | Pack By |
|---|---|
| Base | By: Cortex XSOAR |
| Common Scripts | By: Cortex XSOAR |
| Filters And Transformers | By: Cortex XSOAR |
| Phishing | By: Cortex XSOAR |
Optional Content Packs (0)
| Pack Name | Pack By |
|---|
All level dependencies (9)
| Pack Name | Pack By |
|---|---|
| Aggregated Scripts | By: Cortex XSOAR |
| Common Types | By: Cortex XSOAR |
| Common Playbooks | By: Cortex XSOAR |
| Phishing | By: Cortex XSOAR |
| Common Scripts | By: Cortex XSOAR |
| Rasterize | By: Cortex XSOAR |
| Cortex REST API | By: Cortex XSOAR |
| Base | By: Cortex XSOAR |
| Filters And Transformers | By: Cortex XSOAR |
1.3.48 - 8490927 (April 27, 2026)
1.3.43 - 6105231 (December 2, 2025)
- 41590
Download
Integrations
Gmail
- Enhanced the Gmail.Attachments output context with structured fields:
- Gmail.Attachments.ID - The email attachment ID (as appears in Gmail).
- Gmail.Attachments.Name - The email attachment name.
- Updated the Docker image to: demisto/google-api-py3:1.0.0.5220244.
- 41590
Download
1.3.33 - 4121830 (July 10, 2025)
- 40523
Download
Classifiers
Gmail - Classifier
- Documentation and metadata improvements.
Mappers
Gmail - Incoming Mapper
- Documentation and metadata improvements.
Playbooks
Get Original Email - Gmail v2
- Documentation and metadata improvements.
Search all mailboxes - Gmail with polling
- Documentation and metadata improvements.
Search And Delete Emails - Gmail
- Documentation and metadata improvements.
Search in mailboxes Gmail (Loop) with polling
- Documentation and metadata improvements.
- 40523
Download
1.3.22 - 1223816 (July 30, 2024)
1.3.15 - 7122577 (December 10, 2023)
- 31342
Download
Integrations
Gmail
- Added the argument run-get-attachments-command to gmail-get-mail to determine wether to retrieve the attachments with the gmail-get-mail command or not.
- Updated the gmail-get-mail command context path to support attachment ids & names.
- Updated the gmail-get-attachments command context path to support file entry context output.
- Note: Removed the Email.Attachments.entryID, Gmail.Attachments context entries from the gmail-get-mail command.
- Updated the Docker image to: demisto/google-api-py3:1.0.0.82944.
- 31342
Download
1.3.9 - R5387347 (May 28, 2023)
- 25679
- 26439
- 26372
- 26457
- 26428
- 26368
- 26413
- 26472
- 25218
- 26469
- 26342
- 26226
- 26410
- 26321
- 26458
- 26338
- 26465
- 26392
- 26048
- 26438
- 26480
- 26453
Download
Integrations
Gmail
- Updated the Docker image to: demisto/google-api-py3:1.0.0.59755.
- Updated the description of the message_id argument in the following commands:
- gmail-get-mail
- gmail-delete-mail
- gmail-move-mail
- gmail-move-mail-to-mailbox
- gmail-get-attachments
- Updated the Docker image to: demisto/google-api-py3:1.0.0.61016.
- 25679
- 26439
- 26372
- 26457
- 26428
- 26368
- 26413
- 26472
- 25218
- 26469
- 26342
- 26226
- 26410
- 26321
- 26458
- 26338
- 26465
- 26392
- 26048
- 26438
- 26480
- 26453
Download
1.3.0 - R4372591 (January 11, 2023)
- 23175
Download
Integrations
Gmail
- Updated the Docker image to: demisto/google-api-py3:1.0.0.43438.
- Added support for searching large numbers of mailboxes in the gmail-search-all-mailboxes command, see the command descriptions for more information.
NOTE: When using the gmail-search-all-mailboxes command, the argument show-only-mailboxes is now be True by default.
Playbooks
New: Search all mailboxes - Gmail with polling
This playbook searches Gmail records for all Google users. It is intended for large companies with over 2500 Google users. (Available from Cortex XSOAR 6.5.0).
New: Search in mailboxes Gmail (Loop) with polling
This playbook should only run as a sub-playbook for the Search-all-mailboxes - Gmail with polling playbook, it should not run alone. (Available from Cortex XSOAR 6.5.0).
- 23175
Download
1.3.48 - 8490927 (April 27, 2026)
1.3.43 - 6095247 (December 2, 2025)
- 41590
Download
Integrations
Gmail
- Enhanced the Gmail.Attachments output context with structured fields:
- Gmail.Attachments.ID - The email attachment ID (as appears in Gmail).
- Gmail.Attachments.Name - The email attachment name.
- Updated the Docker image to: demisto/google-api-py3:1.0.0.5220244.
- 41590
Download
1.3.33 - 4118212 (July 9, 2025)
- 40523
Download
Classifiers
Gmail - Classifier
- Documentation and metadata improvements.
Mappers
Gmail - Incoming Mapper
- Documentation and metadata improvements.
Playbooks
Get Original Email - Gmail v2
- Documentation and metadata improvements.
Search all mailboxes - Gmail with polling
- Documentation and metadata improvements.
Search And Delete Emails - Gmail
- Documentation and metadata improvements.
Search in mailboxes Gmail (Loop) with polling
- Documentation and metadata improvements.
- 40523
Download
1.3.22 - 1223816 (July 30, 2024)
1.3.15 - 7122577 (December 10, 2023)
- 31342
Download
Integrations
Gmail
- Added the argument run-get-attachments-command to gmail-get-mail to determine wether to retrieve the attachments with the gmail-get-mail command or not.
- Updated the gmail-get-mail command context path to support attachment ids & names.
- Updated the gmail-get-attachments command context path to support file entry context output.
- Note: Removed the Email.Attachments.entryID, Gmail.Attachments context entries from the gmail-get-mail command.
- Updated the Docker image to: demisto/google-api-py3:1.0.0.82944.
- 31342
Download
1.3.9 - R5387347 (May 28, 2023)
1.3.8 - R5348201 (May 23, 2023)
1.3.0 - R4361094 (January 9, 2023)
- 23175
Download
Integrations
Gmail
- Updated the Docker image to: demisto/google-api-py3:1.0.0.43438.
- Added support for searching large numbers of mailboxes in the gmail-search-all-mailboxes command, see the command descriptions for more information.
NOTE: When using the gmail-search-all-mailboxes command, the argument show-only-mailboxes is now be True by default.
Playbooks
New: Search all mailboxes - Gmail with polling
This playbook searches Gmail records for all Google users. It is intended for large companies with over 2500 Google users. (Available from Cortex XSOAR 6.5.0).
New: Search in mailboxes Gmail (Loop) with polling
This playbook should only run as a sub-playbook for the Search-all-mailboxes - Gmail with polling playbook, it should not run alone. (Available from Cortex XSOAR 6.5.0).
- 23175
Download
PUBLISHER
PLATFORMS
Cortex XSOARCortex XSIAM
INFO
| Certification | Certified | Read more |
| Supported By | Cortex | |
| Created | July 23, 2020 | |
| Last Release | April 27, 2026 |
WORKS WITH THE FOLLOWING INTEGRATIONS:
