I am looking for a way to save the header from an email as an attachment so that when I forward the email I can attach the header to the forwarded email.
Use Case:
I have email threat hunt rules set for common phishing terms. When the alert hits the SOAR I can search and retrieve the email information using Mail Graph. Our vendor for reporting possible phish cases is Cofense, and in order to keep the original sender information they need to have the forwarded email contain the header of the original email as an attachment.