Background:
My organization has a process that goes out to various mailboxes and extracts attached files from them based on various properties such as sender, subject, body, and has attachments. We have an API set up using Azure that allows us to connect to them, and everything has been working well up until a security update a few days ago. After said update, the body of external emails now contain a message stating it is from an external sender with a button to report it as suspicious. From what I can tell, this button probably does some sort of API post, but the URL must contain an escape character or something that is causing the reading of email bodies to get messed up.
This is the query I am using:
“(contains(body/content,‘Please see backup attached.’) and (hasAttachments eq true))”
Here is an example of the JSON email body returned by the API without the security message:
Body=“Please see backup attached. This rebate will be processed as usual, either as an A/P deduction or your payment. We greatly appreciate your prompt review and notification of concerns. All disputes and/or requests for information can be forwarded to my email address within 60 days of rebate period.”
This is an example of the json email body after the security update:
Body=@"Please see backup attached. Employee Name Specialist,
Senior Product FoodCompany,
Inc. Work: xxx-xxx-xxxx
***********BannerStart
This Message Is From an External Sender
This message came from outside your organization.
https://us-phishalarm-ewt.proofpoint.com****************************$
Report Suspicious
***************BannerEnd
Please see backup attached.
Employee Name
Specialist,
Senior Product
Food Company,
Inc.
Work: xxx-xxx-xxxx
"
Issue:
The body filter no longer works. I think it may be due to the “@” symbol being added to the body results before the string. I assume it is being added to make it a verbatim string probably because of an escape character now present in the body. If you look at the new query results it says Body=@“String…” Even if I try to pass an empty string into the body filter it does not work.
Question:
Any experts out there know a way around this or a possible solution?