MISP / MISP/misp-modules

[ENH] Heuristic extraction of forwarded mails

Open
#764 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Python
Stars
377
Forks
280
Avg merge
2d 2h
Merged PRs (30d)
10

Description

As there are often mails being forwarded to security departments, i.e.

The mail followed by the forwarded mail.

Greetings
Jens
________________________________
From: Name <mail@gmail.com>
Sent: Friday, 20 February 2026 11:43
To: Other Name
Subject: Are you in the office?

or


<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p>Hello,</p>
<p><br>
</p>

<br>
<br>
<div style="color: rgb(0, 0, 0);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Name &lt;mail@gmail.com&gt;<br>
<b>Sent:</b> Friday, 20 February 2026 11:43<br>
<b>To:</b> Other Name <br>
<b>Subject:</b> Are you in the office?</font>
<div>&nbsp;</div>
</div>
<div>
<div dir="ltr">
<div dir="ltr"><br>
</div>
</div>
</div>
</div>
</div>
</body>
</html>

so extracting the partial inline mails as dependent mail objects seems to be a useful feature

[I would be willing to try to implement this, if it is wanted]

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the Python entry point that processes forwarded mail content, then compare it with the plain-text and HTML examples in the issue. Done means partial inline forwarded mails are extracted and represented as dependent mail objects, with behavior covering both shown formats.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.