Need to Automate the copying of an attachment in order to push to Splunk

Question

I'm trying to figure out a way to copy an attachment from a specific Mailbox to a folder on our exchange server so it can then be pushed to splunk.

The attachment in question is a log file generated by a cloud based application - our auditors gave us the surprise requirement that this log file now needs to be automatically uploaded into splunk (previously automated email reports were adequate).

The Exchange server is a on-prem 2013, the Splunk is on prem also. I've dabeled in VBA for an outlook script, but I dont want to corner myself into making sure I have a dedicated outlook install for it - I would like it to just be an automated task or scheduled script that runs on the exchange server.

I'm currently playing with the search-mailbox feature in exchange shell - but haven't found any functionality that looks like it can help me.

I already have the local hot-folder for splunk configured, that was the easy part.

Thanks!

Answer 1

You may consider using EWS, see Explore the EWS Managed API, EWS, and web services in Exchange for more information.

The following code example shows how to get an EmailMessage object by using the Bind method, then iterate through the attachment collection and call the FileAttachment.Load or ItemAttachment.Load method on each attachment as appropriate. Each file attachment is saved to the C:\temp\ folder, and each item attachment is loaded into memory. For information about how to save an item attachment, see Save an attached email by using the EWS Managed API.

public static void GetAttachmentsFromEmail(ExchangeService service, ItemId itemId)
{
    // Bind to an existing message item and retrieve the attachments collection.
    // This method results in an GetItem call to EWS.
    EmailMessage message = EmailMessage.Bind(service, itemId, new PropertySet(ItemSchema.Attachments));
    // Iterate through the attachments collection and load each attachment.
    foreach (Attachment attachment in message.Attachments)
    {
        if (attachment is FileAttachment)
        {
            FileAttachment fileAttachment = attachment as FileAttachment;
            // Load the attachment into a file.
            // This call results in a GetAttachment call to EWS.
            fileAttachment.Load("C:\\temp\\" + fileAttachment.Name);
           
            Console.WriteLine("File attachment name: " + fileAttachment.Name);
        }
        else // Attachment is an item attachment.
        {
            ItemAttachment itemAttachment = attachment as ItemAttachment;
            // Load attachment into memory and write out the subject.
            // This does not save the file like it does with a file attachment.
            // This call results in a GetAttachment call to EWS.
            itemAttachment.Load();
            Console.WriteLine("Item attachment name: " + itemAttachment.Name);
        }
    }
}

As for PowerShell, you may find the Exchange Server PowerShell (Exchange Management Shell) section in MSDN helpful.