feat(email-cases-importer): add connector to import emails as incident-response cases (#7036)

external-import/email-cases-importer/.dockerignore

@@ -0,0 +1,42 @@
+# VCS / editor
+.git
+.gitignore
+.gitattributes
+.vscode
+.idea
+*.swp
+*.swo
+
+# Build artifacts / caches
+__pycache__
+*.pyc
+*.pyo
+*.pyd
+*.egg-info
+.pytest_cache
+.mypy_cache
+.ruff_cache
+.coverage
+htmlcov
+dist
+build
+
+# Local virtualenvs and secrets
+.venv
+venv
+env
+.env
+
+# Connector ops files (not needed in the image)
+docker-compose.yml
+config.yml
+config.yml.sample
+README.md
+.dockerignore
+Dockerfile
+
+# Tests and tooling (image should not ship test code)
+tests
+test-requirements.txt
+pyproject.toml
+.pylintrc

external-import/email-cases-importer/.env.sample

@@ -0,0 +1,27 @@
+# Copy to .env and fill in. Docker Compose reads this file to populate the
+# ${...} variables referenced in docker-compose.yml. Never commit your real .env.
+
+# --- OpenCTI platform ---
+OPENCTI_ADMIN_TOKEN=ChangeMe        # OpenCTI API token (maps to OPENCTI_TOKEN)
+CONNECTOR_EMAIL_CASES_ID=ChangeMe   # Unique UUIDv4 for this connector instance
+
+# --- IMAP (default protocol) ---
+EMAIL_CASES_IMAP_HOST=imap.example.com
+EMAIL_CASES_IMAP_USERNAME=soc@example.com
+EMAIL_CASES_IMAP_PASSWORD=ChangeMe
+
+# --- Email filtering ---
+EMAIL_CASES_SENDER_ADDRESS=alerts@example.com
+# JSON array of subject filters. Use [] to accept any subject.
+EMAIL_CASES_SUBJECT_FILTERS=[]
+
+# --- Microsoft Graph (only if EMAIL_CASES_PROTOCOL=microsoft_graph) ---
+# EMAIL_CASES_GRAPH_TENANT_ID=
+# EMAIL_CASES_GRAPH_CLIENT_ID=
+# EMAIL_CASES_GRAPH_CLIENT_SECRET=
+# EMAIL_CASES_GRAPH_USER_ID=
+
+# --- EWS (only if EMAIL_CASES_PROTOCOL=ews) ---
+# EMAIL_CASES_EWS_SERVER=
+# EMAIL_CASES_EWS_USERNAME=
+# EMAIL_CASES_EWS_PASSWORD=

external-import/email-cases-importer/Dockerfile

@@ -0,0 +1,38 @@
+FROM python:3.12-alpine
+
+ENV CONNECTOR_TYPE=EXTERNAL_IMPORT
+ENV PYTHONUNBUFFERED=1
+
+RUN apk update && apk upgrade && \
+    apk add --no-cache \
+        libmagic \
+        p7zip \
+        libarchive-tools \
+        libffi \
+        libxml2 \
+        libxslt && \
+    apk add --no-cache --virtual .build-deps \
+        git \
+        gcc \
+        musl-dev \
+        libffi-dev \
+        openssl-dev \
+        libxml2-dev \
+        libxslt-dev && \
+    rm -rf /var/cache/apk/*
+
+COPY src/requirements.txt /opt/opencti-connector/
+WORKDIR /opt/opencti-connector
+
+RUN pip install --no-cache-dir -r requirements.txt && \
+    apk del .build-deps
+
+COPY entrypoint.sh /
+RUN chmod +x /entrypoint.sh
+
+COPY src/ /opt/opencti-connector/
+
+RUN adduser -D connector
+USER connector
+
+ENTRYPOINT ["/entrypoint.sh"]