Agari Phishing Defense

Agari Phishing Defense stops phishing, BEC, and other identity deception attacks that trick employees into harming your business.

Data Enrichment & Threat Intelligence · Agari Phishing Defense

Details

IDAgari Phishing Defense
ProviderFortra
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

Agari Phishing Defense stops phishing, BEC, and other identity deception attacks that trick employees into harming your business.
This integration was integrated and tested with a standard version of Agari Phishing Defense.

Configure Agari Phishing Defense in Cortex

Parameter Description Required
url URL to connect to Agari True
apikey API Key True
apisecret Secret Key True
max_fetch Maximum number of incidents to fetch every time True
first_fetch First fetch time interval False
fetch_policy_actions Policy Action False
exclude_alert_type Exclude alerts False
policy_filter Fetches policy events to limit the amount of data. Can be applied to specific fields False
incidentType Incident type False
isFetch Fetch incidents False
insecure Trust any certificate (not secure) False
proxy Use system proxy settings False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

apd-list-policy-events

Retrieves a list of policy events.

Base Command

apd-list-policy-events

Input

Argument Name Description Required
limit The maximum number of items to be returned in the paged response. Optional
start_date The earliest date time (UTC) a search should target (ISO 8601 format).
Formats accepted: YYYY-MM-dd
YYYY-MM-ddTHH:mm:ss
N days
N hours
Example: 2020-05-01
2020-05-01T00:00:00
2 days
5 hours.		 Optional
end_date The latest date time (UTC) a search should target (ISO 8601 format).
Formats accepted: YYYY-MM-dd
YYYY-MM-ddTHH:mm:ss
N days
N hours
Example: 2020-05-01
2020-05-01T00:00:00
2 days
5 hours.		 Optional
page_id To page through a collection of policy events. Optional
sort A comma-delimited string that specifies the field ordering to be applied to the response. Example: created_at DESC, id ASC. Optional
add_fields A comma-delimited list of optional fields to add to the default payload. Additional fields would add data in the entry context. Optional
rem_fields A comma-delimited list of fields to remove from the default payload. Limited fields would return limited data in entry context. Optional
fields A comma-delimited list of fields to include in the payload. Limited fields would return limited data in entry context. Optional
filter Search filters that can be applied to the response. Optional
exclude_alert_types Exclude policy types such as ‘MessageAlert’ or ‘SystemAlert’. Optional
policy_name Find by policy name. Optional
policy_action Filter by policy action: ‘deliver’, ‘mark-spam’, ‘move’, ‘inbox’, ‘delete’ and ‘none’. Optional

Context Output

Path Type Description
AgariPhishingDefense.Alert.alert_definition_name String Alert definition name.
AgariPhishingDefense.Alert.id String Unique alert id.
AgariPhishingDefense.Alert.summary String Summary of the alert.
AgariPhishingDefense.Alert.policy_action String Alert policy action.
AgariPhishingDefense.Alert.policy_enabled Boolean Indicates if policy is enabled.
AgariPhishingDefense.Alert.updated_at Date Updated time of the alert. The format is ISO8601.
AgariPhishingDefense.Alert.created_at Date Created time of the alert. The format is ISO8601.
AgariPhishingDefense.Alert.admin_recipients Unknown List of notified admin recipients.
AgariPhishingDefense.Alert.notified_original_recipients Boolean Indicates whether the original recipient was notified.

Command Example

!apd-list-policy-events limit=2

Context Example

{
    "AgariPhishingDefense": {
        "Alert": [
            {
                "alert_definition_name": "Spoof of Partner Domains",
                "created_at": "2020-12-03T04:32:23Z",
                "id": 549904303,
                "notified_original_recipients": false,
                "policy_action": "none",
                "policy_enabled": true,
                "summary": false,
                "updated_at": "2020-12-03T04:32:23Z"
            },
            {
                "alert_definition_name": "Untrusted Messages",
                "created_at": "2020-12-03T04:32:23Z",
                "id": 549904302,
                "notified_original_recipients": false,
                "policy_action": "none",
                "policy_enabled": true,
                "summary": false,
                "updated_at": "2020-12-03T04:32:23Z"
            }
        ]
    }
}

Human Readable Output

Policy Events

Event ID Alert Definition Name Policy Action Notified Original Recipients Created Updated
549904303 Spoof of Partner Domains none false 2020-12-03T04:32:23Z 2020-12-03T04:32:23Z
549904302 Untrusted Messages none false 2020-12-03T04:32:23Z 2020-12-03T04:32:23Z

apd-list-message-data

Retrieves a list of messages.

Base Command

apd-list-message-data

Input

Argument Name Description Required
start_date The earliest date time (UTC) a search should target (ISO 8601 format).
Formats accepted: YYYY-MM-dd
YYYY-MM-ddTHH:mm:ss
N days
N hours
Example: 2020-05-01
2020-05-01T00:00:00
2 days
5 hours.		 Optional
end_date The latest date time (UTC) a search should target (ISO 8601 format).
Formats accepted: YYYY-MM-dd
YYYY-MM-ddTHH:mm:ss
N days
N hours
Example: 2020-05-01
2020-05-01T00:00:00
2 days
5 hours.		 Optional
add_fields A comma-delimited list of optional fields to add to the default payload. Additional fields would add data in the entry context. Optional
rem_fields A comma-delimited list of fields to remove from the default payload. Limited fields would return limited data in entry context. Optional
fields A comma-delimited list of fields to include in the payload. Limited fields would return limited data in entry context. Optional
limit The maximum number of items to be returned in the paged response. Optional
page_id To page through a collection of message data. Optional
sort A comma-delimited string that specifies the field ordering to be applied to the response. Optional
search Search using advanced search syntax.
Format: field operator operand {and/or field operator operand}
Example: has_attachment=true and ip=’10.0.0.0’
sbrs in [3.5, 2.6]
domain_reputation is not null
sbrs gt 3
sbrs>=3 and domain_tags eq internal		 Optional

Context Output

Path Type Description
AgariPhishingDefense.Message.has_attachment Boolean Has attachment.
AgariPhishingDefense.Message.ip String IP address.
AgariPhishingDefense.Message.message_id String The Global message ID.
AgariPhishingDefense.Message.ptr_name String PTR name.
AgariPhishingDefense.Message.sbrs String SBRS.
AgariPhishingDefense.Message.id String The internal message ID.
AgariPhishingDefense.Message.authenticity Number Authenticity score.
AgariPhishingDefense.Message.to String Message recipient.
AgariPhishingDefense.Message.date String Date in ISO format.
AgariPhishingDefense.Message.timestamp_ms Number Timestamp in ms since epoch.
AgariPhishingDefense.Message.from String Sender’s email.
AgariPhishingDefense.Message.from_domain String From domain.
AgariPhishingDefense.Message.subject String Message subject.
AgariPhishingDefense.Message.domain_reputation Number Reputation of sender domain.
AgariPhishingDefense.Message.message_trust_score Number Risk score.
AgariPhishingDefense.Message.message_details_link String Link to message details.
AgariPhishingDefense.Message.domain_tags Unknown List of domain tags.
AgariPhishingDefense.Message.mail_from String Mail from domain.
AgariPhishingDefense.Message.reply_to String Reply-to address.
AgariPhishingDefense.Message.uris Unknown List of URIs.
AgariPhishingDefense.Message.attachment_extensions Unknown List of message attachment extensions.
AgariPhishingDefense.Message.attachment_filenames Unknown List of message attachment filenames.
AgariPhishingDefense.Message.attachment_sha256 Unknown List of message attachment SHA256 hashes.
AgariPhishingDefense.Message.attachment_types Unknown List of message attachment types.
AgariPhishingDefense.Message.attack_types Unknown List of attack type classifications.
AgariPhishingDefense.Message.dkim_result String DKIM result.
AgariPhishingDefense.Message.dmarc_result String DMARC result.
AgariPhishingDefense.Message.domain_dmarc_policy String DMARC policy for domain.
AgariPhishingDefense.Message.enforcement_action String Enforcement action.
AgariPhishingDefense.Message.enforcement_folder String Enforcement folder.
AgariPhishingDefense.Message.enforcement_result String Enforcement result.
AgariPhishingDefense.Message.expanded_from String Expanded from.
AgariPhishingDefense.Message.forwarded_from String Forwarded from.
AgariPhishingDefense.Message.has_malicious_attachment Boolean Has malicious attachment.
AgariPhishingDefense.Message.message_read_status Boolean Message read status.
AgariPhishingDefense.Message.org_domain String Organization domain.
AgariPhishingDefense.Message.policy_ids Unknown List of triggered policy IDs.
AgariPhishingDefense.Message.sender_approval_state String Sender approval state.
AgariPhishingDefense.Message.sender_type String Sender type.
AgariPhishingDefense.Message.spf_result String SPF result.

Command Example

!apd-list-message-data limit=2

Context Example

{
    "AgariPhishingDefense": {
        "Message": [
            {
                "attack_types": [
                    "spoof (Domain spoof)"
                ],
                "authenticity": "0.085819915",
                "date": "2020-12-03T02:07:02+00:00",
                "domain_reputation": "9.0",
                "domain_tags": [
                    "partner"
                ],
                "enforcement_action": "move",
                "enforcement_result": "pending",
                "from": "Accounts@abc.com",
                "from_domain": "abc.com",
                "has_attachment": "false",
                "id": "785d91a8-34fb-11eb-bf90-f6ba445dac4f",
                "ip": "1.2.3.4",
                "message_details_link": "https://apis.com/messages/785d91a8-34fb-11eb-bf90-f6ba445dac4f",
                "message_id": "<facade2c8712345c91c755d17f1134cb@BY2PR12MB0054.abc.com>",
                "message_trust_score": "0.6",
                "policy_ids": [
                    9014,
                    9008,
                    2843446
                ],
                "subject": "Please approve and forward expense report \"December Expenses\"",
                "timestamp_ms": "1606961222000",
                "to": "acoyle@xyz.com"
            },
            {
                "attack_types": [
                    "spoof (Domain spoof)"
                ],
                "authenticity": "0.07902577",
                "date": "2020-12-03T02:07:02+00:00",
                "domain_reputation": "8.6",
                "domain_tags": [
                    "internal"
                ],
                "enforcement_action": "move",
                "enforcement_result": "pending",
                "from": "help@xyz.com",
                "from_domain": "xyz.com",
                "has_attachment": "false",
                "id": "7852dc68-34fb-11eb-bf90-f6ba445dac4f",
                "ip": "2.2.3.4",
                "message_details_link": "https://apis.com/messages/7852dc68-34fb-11eb-bf90-f6ba445dac4f",
                "message_id": "<facade2c12345f9c91c755d17f1134cb@BY2PR12MB0054.xyz.com>",
                "message_trust_score": "0.8",
                "policy_ids": [
                    9014,
                    9009,
                    2843455
                ],
                "subject": "Please approve and forward expense report \"December Expenses\"",
                "timestamp_ms": "1606961222000",
                "to": "aarmstrong@xyz.com"
            }
        ]
    }
}

Human Readable Output

Messages

ID From To Subject Message Trust Score Domain Reputation IP Authenticity Attack Types Date
785d91a8-34fb-11eb-bf90-f6ba445dac4f Accounts@abc.com acoyle@xyz.com Please approve and forward expense report “December Expenses” 0.6 9.0 1.2.3.4 0.085819915 spoof (Domain spoof) 2020-12-03T02:07:02+00:00
7852dc68-34fb-11eb-bf90-f6ba445dac4f help@xyz.com aarmstrong@xyz.com Please approve and forward expense report “December Expenses” 0.8 8.6 2.2.3.4 0.07902577 spoof (Domain spoof) 2020-12-03T02:07:02+00:00

apd-remediate-message

Remediate suspected message.

Base Command

apd-remediate-message

Input

Argument Name Description Required
id The primary identifier to remediate a message (UUID). To retrieve the ID execute the apd-list-message-data command. Required
operation An operation to remediate a message. Remediation operation is either ‘delete’ or ‘move’. Required

Context Output

There is no context output for this command.

Command Example

!apd-remediate-message id="0e43a684-2e0e-11eb-815a-0a8f2da72108" operation="move"

Context Example

{}

Human Readable Output

Message ID - 0e43a684-2e0e-11eb-815a-0a8f2da72108 remediated successfully with operation ‘move’.

Configuration parameters

  • url — URL to connect to Agari (required)
  • apikey — API Key (required)
  • apisecret — Secret Key (required)
  • max_fetch — Maximum number of incidents to fetch every time (required)
  • first_fetch — First fetch time interval
  • fetch_policy_actions — Policy action taken
  • exclude_alert_type — Exclude alerts
  • policy_filter — Fetches policy events as per the filter to limit the amount of data. Can be applied to specific fields.
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • isFetch — Fetch incidents
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (3)

  • apd-list-message-data

    Retrieves a list of messages.

  • apd-list-policy-events

    Retrieves a list of policy events.

  • apd-remediate-message

    Remediate suspected message.

Source

AgariPhishingDefense.py AgariPhishingDefense_test.py AgariPhishingDefense.yml AgariPhishingDefense_description.md
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: Fortra
commonfields:
  id: Agari Phishing Defense
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- defaultvalue: https://api.agari.com/v1/ep
  display: URL to connect to Agari
  name: url
  required: true
  type: 0
  section: Connect
- additionalinfo: API Client ID created in the User management UI.
  display: API Key
  name: apikey
  required: true
  type: 4
  section: Connect
- additionalinfo: API Client Secret created in the User management UI.
  display: Secret Key
  name: apisecret
  required: true
  type: 4
  section: Connect
- defaultvalue: '50'
  display: Maximum number of incidents to fetch every time
  name: max_fetch
  required: true
  type: 0
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: The time range to consider for the initial data fetch. (<number> <unit>, e.g., 2 minutes, 2 hours, 2 days, 2 months, 2 years). Default is 3 days.
  defaultvalue: 3 days
  display: First fetch time interval
  name: first_fetch
  type: 0
  required: false
  section: Collect
- additionalinfo: Apply the filter to fetch policy events having actions such as "deliver", "mark-spam", "move", "inbox", "delete", "none". Fetches all types of actions by default.
  display: Policy action taken
  name: fetch_policy_actions
  options:
  - deliver
  - mark-spam
  - move
  - inbox
  - delete
  - none
  type: 15
  required: false
  section: Collect
- additionalinfo: Exclude alerts while fetching policy events of type 'Message Alert' or 'System Alert'.
  defaultvalue: System Alert
  display: Exclude alerts
  name: exclude_alert_type
  options:
  - System Alert
  - Message Alert
  type: 15
  required: false
  section: Collect
- additionalinfo: "Syntax: field.operator(operand) {and/or field.operator(operand)} \n\nExample: created_at.after(2020-11-11T09:16:44Z) or id.eq(537557694)"
  display: Fetches policy events as per the filter to limit the amount of data. Can be applied to specific fields.
  name: policy_filter
  type: 12
  required: false
  section: Collect
- defaultvalue: Agari Phishing Defense Policy Event
  display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
  supportedModules:
  - agentix
  - xsiam
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
description: Agari Phishing Defense stops phishing, BEC, and other identity deception attacks that trick employees into harming your business.
display: Agari Phishing Defense
name: Agari Phishing Defense
script:
  commands:
  - arguments:
    - defaultValue: '25'
      description: The maximum number of items to be returned in the paged response.
      name: limit
    - description: |-
        The earliest date time (UTC) a search should target (ISO 8601 format).
        Formats accepted: YYYY-MM-dd
        YYYY-MM-ddTHH:mm:ss
        N days
        N hours
        Example: 2020-05-01
        2020-05-01T00:00:00
        2 days
        5 hours.
      name: start_date
    - description: "The latest date time (UTC) a search should target (ISO 8601 format).\nFormats accepted: YYYY-MM-dd\nYYYY-MM-ddTHH:mm:ss\nN days\nN hours\nExample: 2020-05-01 \n2020-05-01T00:00:00\n2 days\n5 hours."
      name: end_date
    - defaultValue: '1'
      description: To page through a collection of policy events.
      name: page_id
    - description: 'A comma-delimited string that specifies the field ordering to be applied to the response. Example: created_at DESC, id ASC.'
      isArray: true
      name: sort
    - description: A comma-delimited list of optional fields to add to the default payload. Additional fields would add data in the entry context.
      isArray: true
      name: add_fields
    - description: A comma-delimited list of fields to remove from the default payload. Limited fields would return limited data in entry context.
      isArray: true
      name: rem_fields
    - description: A comma-delimited list of fields to include in the payload. Limited fields would return limited data in entry context.
      isArray: true
      name: fields
    - description: Search filters that can be applied to the response.
      name: filter
    - description: Exclude policy types such as 'MessageAlert' or 'SystemAlert'.
      name: exclude_alert_types
    - description: Find by policy name.
      name: policy_name
    - auto: PREDEFINED
      description: 'Filter by policy action: ''deliver'', ''mark-spam'', ''move'', ''inbox'', ''delete'' and ''none''.'
      name: policy_action
      predefined:
      - deliver
      - mark-spam
      - move
      - inbox
      - delete
      - none
    description: Retrieves a list of policy events.
    name: apd-list-policy-events
    outputs:
    - contextPath: AgariPhishingDefense.Alert.alert_definition_name
      description: Alert definition name.
      type: String
    - contextPath: AgariPhishingDefense.Alert.id
      description: Unique alert id.
      type: String
    - contextPath: AgariPhishingDefense.Alert.summary
      description: Summary of the alert.
      type: String
    - contextPath: AgariPhishingDefense.Alert.policy_action
      description: Alert policy action.
      type: String
    - contextPath: AgariPhishingDefense.Alert.policy_enabled
      description: Indicates if policy is enabled.
      type: Boolean
    - contextPath: AgariPhishingDefense.Alert.updated_at
      description: Updated time of the alert. The format is ISO8601.
      type: Date
    - contextPath: AgariPhishingDefense.Alert.created_at
      description: Created time of the alert. The format is ISO8601.
      type: Date
    - contextPath: AgariPhishingDefense.Alert.admin_recipients
      description: List of notified admin recipients.
      type: Unknown
    - contextPath: AgariPhishingDefense.Alert.notified_original_recipients
      description: Indicates whether the original recipient was notified.
      type: Boolean
  - arguments:
    - description: "The earliest date time (UTC) a search should target (ISO 8601 format).\nFormats accepted: YYYY-MM-dd\nYYYY-MM-ddTHH:mm:ss\nN days\nN hours\nExample: 2020-05-01 \n2020-05-01T00:00:00\n2 days\n5 hours."
      name: start_date
    - description: "The latest date time (UTC) a search should target (ISO 8601 format).\nFormats accepted: YYYY-MM-dd\nYYYY-MM-ddTHH:mm:ss\nN days\nN hours\nExample: 2020-05-01 \n2020-05-01T00:00:00\n2 days\n5 hours."
      name: end_date
    - description: A comma-delimited list of optional fields to add to the default payload. Additional fields would add data in the entry context.
      isArray: true
      name: add_fields
    - description: A comma-delimited list of fields to remove from the default payload. Limited fields would return limited data in entry context.
      isArray: true
      name: rem_fields
    - description: A comma-delimited list of fields to include in the payload. Limited fields would return limited data in entry context.
      isArray: true
      name: fields
    - defaultValue: '25'
      description: The maximum number of items to be returned in the paged response.
      name: limit
    - defaultValue: '1'
      description: To page through a collection of message data.
      name: page_id
    - description: A comma-delimited string that specifies the field ordering to be applied to the response.
      isArray: true
      name: sort
    - description: |-
        Search using advanced search syntax.
        Format: field operator operand {and/or field operator operand}
        Example: has_attachment=true and ip='10.0.0.0'
        sbrs in [3.5, 2.6]
        domain_reputation is not null
        sbrs gt 3
        sbrs>=3 and domain_tags eq internal.
      name: search
    description: Retrieves a list of messages.
    name: apd-list-message-data
    outputs:
    - contextPath: AgariPhishingDefense.Message.has_attachment
      description: Has attachment.
      type: Boolean
    - contextPath: AgariPhishingDefense.Message.ip
      description: IP address.
      type: String
    - contextPath: AgariPhishingDefense.Message.message_id
      description: The Global message ID.
      type: String
    - contextPath: AgariPhishingDefense.Message.ptr_name
      description: A Pointer Record to get the associated domain/hostname.
      type: String
    - contextPath: AgariPhishingDefense.Message.sbrs
      description: SBRS.
      type: String
    - contextPath: AgariPhishingDefense.Message.id
      description: The internal message ID.
      type: String
    - contextPath: AgariPhishingDefense.Message.authenticity
      description: Authenticity score.
      type: Number
    - contextPath: AgariPhishingDefense.Message.to
      description: Message recipient.
      type: String
    - contextPath: AgariPhishingDefense.Message.date
      description: Date in ISO format.
      type: String
    - contextPath: AgariPhishingDefense.Message.timestamp_ms
      description: Timestamp in ms since epoch.
      type: Number
    - contextPath: AgariPhishingDefense.Message.from
      description: Sender's email.
      type: String
    - contextPath: AgariPhishingDefense.Message.from_domain
      description: From domain.
      type: String
    - contextPath: AgariPhishingDefense.Message.subject
      description: Message subject.
      type: String
    - contextPath: AgariPhishingDefense.Message.domain_reputation
      description: Reputation of sender domain.
      type: Number
    - contextPath: AgariPhishingDefense.Message.message_trust_score
      description: Risk score.
      type: Number
    - contextPath: AgariPhishingDefense.Message.message_details_link
      description: Link to message details.
      type: String
    - contextPath: AgariPhishingDefense.Message.domain_tags
      description: List of domain tags.
      type: Unknown
    - contextPath: AgariPhishingDefense.Message.mail_from
      description: Mail from domain.
      type: String
    - contextPath: AgariPhishingDefense.Message.reply_to
      description: Reply-to address.
      type: String
    - contextPath: AgariPhishingDefense.Message.uris
      description: List of URIs.
      type: Unknown
    - contextPath: AgariPhishingDefense.Message.attachment_extensions
      description: List of message attachment extensions.
      type: Unknown
    - contextPath: AgariPhishingDefense.Message.attachment_filenames
      description: List of message attachment filenames.
      type: Unknown
    - contextPath: AgariPhishingDefense.Message.attachment_sha256
      description: List of message attachment SHA256 hashes.
      type: Unknown
    - contextPath: AgariPhishingDefense.Message.attachment_types
      description: List of message attachment types.
      type: Unknown
    - contextPath: AgariPhishingDefense.Message.attack_types
      description: List of attack type classifications.
      type: Unknown
    - contextPath: AgariPhishingDefense.Message.dkim_result
      description: DKIM result.
      type: String
    - contextPath: AgariPhishingDefense.Message.dmarc_result
      description: DMARC result.
      type: String
    - contextPath: AgariPhishingDefense.Message.domain_dmarc_policy
      description: DMARC policy for domain.
      type: String
    - contextPath: AgariPhishingDefense.Message.enforcement_action
      description: Enforcement action.
      type: String
    - contextPath: AgariPhishingDefense.Message.enforcement_folder
      description: Enforcement folder.
      type: String
    - contextPath: AgariPhishingDefense.Message.enforcement_result
      description: Enforcement result.
      type: String
    - contextPath: AgariPhishingDefense.Message.expanded_from
      description: Expanded from.
      type: String
    - contextPath: AgariPhishingDefense.Message.forwarded_from
      description: Forwarded from.
      type: String
    - contextPath: AgariPhishingDefense.Message.has_malicious_attachment
      description: Has malicious attachment.
      type: Boolean
    - contextPath: AgariPhishingDefense.Message.message_read_status
      description: Message read status.
      type: Boolean
    - contextPath: AgariPhishingDefense.Message.org_domain
      description: Organization domain.
      type: String
    - contextPath: AgariPhishingDefense.Message.policy_ids
      description: List of triggered policy IDs.
      type: Unknown
    - contextPath: AgariPhishingDefense.Message.sender_approval_state
      description: Sender approval state.
      type: String
    - contextPath: AgariPhishingDefense.Message.sender_type
      description: Sender type.
      type: String
    - contextPath: AgariPhishingDefense.Message.spf_result
      description: SPF result.
      type: String
  - arguments:
    - description: The primary identifier to remediate a message (UUID). To retrieve the ID execute the apd-list-message-data command.
      name: id
      required: true
    - auto: PREDEFINED
      description: An operation to remediate a message. Remediation operation is either 'delete' or 'move'.
      name: operation
      predefined:
      - delete
      - move
      required: true
    description: Remediate suspected message.
    name: apd-remediate-message
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests (auto formatted)
fromversion: 5.0.0