[Marketplace Contribution] EWS - Content Pack Update

[content-bot]

Original External PR

external pull request

Status

• In Progress
• Ready
• In Hold - (Reason for hold)

Contributor

@alujones

Notes

This allows us to use this integration to fetch incidents as mail is moved into a folder, without missing messages that are moved in a different order from that in which they were received. An example use-case is a folder for managing reports of phishing emails - users don't send those reports strictly in the order our mail servers received them, and our SOC handlers don't move them into the phish folder in received order either. So, we were missing incidents. With this change, we are not.
This is the second time we've submitted changes to an integration to accommodate "modified" date processing - the other is to a Jira integration (so that as an item is modified and matches a query, it becomes available for incidents).
I've tried to make this so that the default mode of operation matches exactly what is currently in-place in EWS O365, so that nothing existing will break.
We've tested this functionality for the last several weeks, and the one complaint we've had is that tagging an item counts as changing its "last modified time". This doesn't seem significant, and our handlers simply tag emails before dragging them into the phish folder.
Changes were made to the parameters, to the fetch_emails_as_incidents function and the fetch_last_emails function.
I have not submitted a video, as this would quickly include email contents and addresses that are private

Video Link

Short demo video of the Pack usage. Speeds up the review. Optional but recommended. Use a video sharing service such as Google Drive or YouTube.

[xsoar-bot]

Link to the unit tests coverage report:
https://output.circle-artifacts.com/output/job/4e60d503-bb16-4a5c-a04a-4c53f50aaf37/artifacts/0/artifacts/coverage_report/html/index.html