Exciting news! We are redesigning the Arctic Wolf Help Documentation site to provide a better user experience. Our new site will launch on May 1, 2024.

Managed Security Awareness


Managed Security Awareness Portal User Guide

Updated Mar 18, 2024

Review user-reported emails

Arctic Wolf Managed Security Awareness® (MA) Portal administrators can review emails that were reported using the Report Email button.

Before you begin

Steps

  1. Download the file.
  2. Retrieve the message.

Step 1: Download the file

  1. Navigate to the Microsoft Graph CLI download page.

  2. For the latest release of Microsoft Graph CLI, click Assets.

  3. Download the file specific to the OS that Microsoft Graph CLI will run on.

  4. Extract the files.

    A file with the filename mgc is included in the extracted content.

Step 2: Retrieve the message

Based on your environment, retrieve the message using one of these CLI options:

Retrieve the message using PowerShell

  1. Open Powershell.

  2. Run this command to set the environment variable for AZURE_CLIENT_SECRET:

    $Env:AZURE_CLIENT_SECRET = "<secret_id>"

    Where:

    • <secret_id> is your Client Secret value.
  3. Run this command to sign in to the Azure application and specify the directory (tenant) and application (client) IDs:

    ./mgc login --tenant-id <tenant_id> `
        --client-id <client_id> `
        --strategy Environment `
        --scopes .default

    Where:

    • <tenant_id> is the Directory (tenant) ID value.
    • <client_id> is the Application (client) ID value.
  4. Run one of these commands to set the email address and Graph Message ID:

    • If you want the output to include headers, body, and attachments, run this command:

      ./mgc users messages get `
         --user-id <user_email> `
         --message-id '<message_id>/$value'

      Where:

      • <user_email> is the user email address.
      • <message_id> is the Graph Message ID. The Graph Message ID includes an equals (=) character at the end. Surround '<message_id>/$value' with single quotes. For example, 'abcd1234=/$value'.
    • If you do not want the output to include headers, body, and attachments, run this command:

      ./mgc users messages get `
         --user-id <user_email> `
         --message-id <message_id>

      Where:

      • <user_email> is the user email address.
      • <message_id> is the Graph Message ID. The Graph Message ID includes an equals (=) character at the end.

Retrieve the message using Windows Command Prompt

  1. Open Windows Command Prompt.

  2. Run this command to set the environment variable for AZURE_CLIENT_SECRET:

    set AZURE_CLIENT_SECRET=<secret_id>

    Where:

    • <secret_id> is your Client Secret value.
  3. Run this command to sign in to the Azure application and specify the directory (tenant) and application (client) IDs:

    mgc.exe login --tenant-id <tenant_id> --client-id <client_id> --strategy Environment --scopes .default

    Where:

    • <tenant_id> is the Directory (tenant) ID value.
    • <client_id> is the Application (client) ID value.
  4. Run one of these commands to set the email address and Graph Message ID.

    • If you want the output to include headers, body, and attachments, run this command:

      mgc.exe users messages get --user-id <user_email> --message-id <message_id>/$value

      Where:

      • <user_email> is the user email address.
      • <message_id> is the Graph Message ID. The Graph Message ID includes an equals (=) character at the end.
    • If you do not want the output to include headers, body, and attachments, run this command:

      mgc.exe users messages get --user-id <user_email> --message-id <message_id>

      Where:

      • <user_email> is the user email address.
      • <message_id> is the Graph Message ID. The Graph Message ID includes an equals (=) character at the end.

Retrieve the message using the macOS or Linux CLI

  1. Open the macOS or Linux CLI.

  2. Run this command to set the environment variable for AZURE_CLIENT_SECRET:

    export AZURE_CLIENT_SECRET='<secret_id>'

    Where:

    • <secret_id> is your Client Secret value. Surround '<secret_id>' with single quotes.
  3. Run this command to sign in to the Azure app and specify the directory (tenant) and application (client) IDs:

    ./mgc login \
     --tenant-id <tenant_id> \
     --client-id <client_id> \
     --strategy Environment \
     --scopes .default

    Where:

    • <tenant_id> is the Directory (tenant) ID value.
    • <client_id> is the Application (client) ID value.
  4. Run one of these commands to set the email address and Graph Message ID.

    • If you want the output to include headers, body, and attachments, run this command:

      ./mgc users messages get \
       --user-id '<user_email>' \
       --message-id '<message_id>/$value'

      Where:

      • <user_email> is the user email address.
      • <message_id> is the Graph Message ID. The Graph Message ID includes an equals (=) character at the end. Surround '<message_id>/$value' with single quotes. For example, 'abcd1234=/$value'.
    • If you do not want the output to include headers, body, and attachments, run this command:

      ./mgc users messages get \
       --user-id '<user_email>' \
       --message-id '<message_id>'

      Where:

      • <user_email> is the user email address.
      • <message_id> is the Graph Message ID. The Graph Message ID includes an equals (=) character at the end.