ParseEmailFiles: Fixed an issue where same eml files are not recognized (demisto#34081)

Author: moishce

Packs/CommonScripts/ReleaseNotes/1_14_36.md

@@ -0,0 +1,4 @@
+
+#### Scripts
+##### ParseEmailFilesV2
+- Fixed an issue where some eml files where not recognized.

Packs/CommonScripts/Scripts/ParseEmailFilesV2/ParseEmailFilesV2.py

@@ -95,11 +95,23 @@ def extract_file_info(entry_id: str) -> tuple:
         dt_file_type = demisto.dt(demisto.context(), f"File(val.EntryID=='{entry_id}').Type")
         file_type = dt_file_type[0] if isinstance(dt_file_type, list) else dt_file_type
 
+        dt_file_info = demisto.dt(demisto.context(), f"File(val.EntryID=='{entry_id}').Info")
+        file_info = dt_file_info[0] if isinstance(dt_file_info, list) else dt_file_info
+        demisto.debug(f'Context values: {dt_file_type=}, {file_type=}, {dt_file_info=}, {file_info=}')
+
+        if file_info:
+            file_info_lower = file_info.lower()
+
+        if (file_type == 'eml' or file_type == 'txt') and ('rfc' in file_info_lower or 'ascii' in file_info_lower):
+            demisto.debug(f'{file_type=} seems wrong, changing it to {file_info=}')
+            file_type = file_info
+
     except Exception as ex:
         return_error(
             "Failed to load file entry with entry id: {}. Error: {}".format(
                 entry_id, str(ex) + "\n\nTrace:\n" + traceback.format_exc()))
 
+    demisto.debug(f'extract_file_info returning {file_type=}, {file_path=}, {file_name=}')
     return file_type, file_path, file_name
 
 

Packs/CommonScripts/pack_metadata.json

@@ -2,7 +2,7 @@
     "name": "Common Scripts",
     "description": "Frequently used scripts pack.",
     "support": "xsoar",
-    "currentVersion": "1.14.35",
+    "currentVersion": "1.14.36",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",