To send an email and log its response in Google SecOps SOAR, follow these
steps:
Use the Send Mail action to send an email.
Add the Wait For Mail From User action to periodically
query the mailbox for a response. This action identifies the correspondence
by using a unique ID.
Once the response is received, it will be fetched into the platform.
The response can be seen on the case wall and used as an input for other actions
in the playbook.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-29 UTC."],[[["\u003cp\u003eGoogle Security Operations SOAR allows sending emails and logging responses.\u003c/p\u003e\n"],["\u003cp\u003eThe "Send Mail" action initiates the email sending process within the SOAR platform.\u003c/p\u003e\n"],["\u003cp\u003eThe "Wait For Mail From User" action periodically checks for email responses, identifying them by a unique ID.\u003c/p\u003e\n"],["\u003cp\u003eEmail responses are fetched into the SOAR platform and can be viewed on the case wall for use in further playbook actions.\u003c/p\u003e\n"],["\u003cp\u003eEmail capabilities require either the MS Graph Mail or Gmail integration to be installed from the Marketplace.\u003c/p\u003e\n"]]],[],null,["# Send an email from Google Security Operations SOAR and log the response\n\nSend an email from Google Security Operations SOAR and log the\nresponse\n=======================================================================\n\nSupported in: \nGoogle secops [SOAR](/chronicle/docs/secops/google-secops-soar-toc)\n\n\nTo send an email and log its response in Google SecOps SOAR, follow these\nsteps:\n\n1. Use the **Send Mail** action to send an email.\n2. Add the **Wait For Mail From User** action to periodically query the mailbox for a response. This action identifies the correspondence by using a unique ID.\n\n\nOnce the response is received, it will be fetched into the platform.\n\n\nThe response can be seen on the case wall and used as an input for other actions\nin the playbook.\n| **Note:** To enable email capabilities, ensure that one of the following integrations is installed through the Marketplace:\n|\n| - [MS Graph Mail](/chronicle/docs/soar/marketplace-integrations/microsoft-graph-mail) -- Use for Exchange Online.\n| - [Gmail](/chronicle/docs/soar/marketplace-integrations/gmail) -- Use for Gmail accounts.\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
