Cisco Email Security Appliance (IronPort)

Details

ID	`Cisco Email Security Appliance (IronPort)`
Provider	Cisco Systems
Category	Network Security
From Version	5.0.0
Supported Modules	Agentix XSIAM

README

Cisco Email Security protects against ransomware, business email compromise, spoofing, and phishing

Configure Cisco Email Security Appliance (IronPort) in Cortex

Parameter	Required
Server URL (e.g. https://192.168.0.1)	True
Port	True
Credentials	True
Password	True
Trust any certificate (not secure)	False
Use system proxy settings	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ironport-report

Retrieve email security appliance statistical reports.

Base Command

ironport-report

Input

Argument Name	Description	Required
time_range	Use this attribute to retrieve report(s) for a specified duration. Must provide either this or duration argument. Possible values are: 1d, 1h.	Optional
report_type	The type of report to fetch. Possible values are: mail_authentication_summary, mail_dlp_outgoing_traffic_summary, mail_incoming_malware_threat_file_detail_summary, mail_incoming_traffic_summary, mail_mailbox_auto_remediation, mail_outgoing_traffic_summary, mail_security_summary, mail_sender_group_summary, mail_system_capacity, mail_authentication_incoming_domain_ip, mail_content_filter_incoming, mail_dmarc_incoming_traffic_summary, mail_env_sender_rate_limit, mail_env_sender_stats, mail_fed_content_filter_incoming, mail_hvm_msg_filter_stats, mail_incoming_hat_connections, mail_incoming_malware_threat_file_detail, mail_incoming_web_interaction_track_malicious_users, mail_incoming_web_interaction_track_urls, mail_md_attachment_incoming_file_type, mail_md_attachment_outgoing_file_type, mail_outgoing_web_interaction_track_malicious_users, mail_outgoing_web_interaction_track_urls, mail_msg_filter_stats, mail_sender_group_detail, mail_subject_stats, mail_url_category_summary, mail_url_domain_summary, mail_url_reputation_summary, mail_vof_threat_summary, mail_vof_threats_by_level, mail_vof_threats_by_threat_type, mail_vof_threats_by_time_threshold, mail_vof_threats_by_type, mail_vof_threats_rewritten_url, mail_authentication_incoming_domain, mail_content_filter_outgoing, mail_destination_domain_detail, mail_dlp_outgoing_policy_detail, mail_incoming_domain_detail, mail_incoming_ip_hostname_detail, mail_incoming_network_detail, mail_sender_domain_detail, mail_sender_ip_hostname_detail, mail_users_detail, mail_virus_type_detail.	Required
max	Use this attribute to limit the number of results returned by the report. n is the number of results that you want the report to return and can assume values from 1 through 1000. Default is 30. Default is 30.	Optional
duration	Aggregate report(s) for the specified duration. Supported values of TZD are Z , +hh:mm , or -hh:mm. Format should be YYYY-MM-DDThh:mmTZD/YYYY-MM-DDThh:mmTZD.	Optional
entity	Use this attribute to retrieve reports based on a specified entity such as email address, IP address, and so on. You can choose whether to exactly match the specified text or look for items starting with the specified text (for instance, starts with “ex” will match “example.com”).	Optional
starts_with	Use this attribute to retrieve items starting with the specified entity value. This attribute must be used in conjunction with the entity attribute and value must be set to true , for example, entity=us&starts_with=true .	Optional

Context Output

There is no context output for this command.

Command Example

!ironport-report report_type=mail_authentication_summary time_range=1d

Context Example

{
    "IronPort": {
        "MailAuthenticationSummary": {
            "ReceivedAuth": 0,
            "ReceivedConnAuthFail": 0,
            "ReceivedConnAuthSuccess": 0,
            "ReceivedConnCertFail": 0,
            "ReceivedConnCertSuccess": 0,
            "ReceivedConnNoauth": 0,
            "ReceivedConnTotal": 0,
            "ReceivedNoauth": 0,
            "ReceivedTotal": 0
        }
    }
}

Human Readable Output

IronPort Report

Received Auth Received Conn Auth Fail Received Conn Auth Success Received Conn Cert Fail Received Conn Cert Success Received Conn Noauth Received Conn Total Received Noauth Received Total

0 0 0 0 0 0 0 0 0

Received Auth	Received Conn Auth Fail	Received Conn Auth Success	Received Conn Cert Fail	Received Conn Cert Success	Received Conn Noauth	Received Conn Total	Received Noauth	Received Total
0	0	0	0	0	0	0	0	0

Configuration parameters

server — Server URL (e.g. https://192.168.0.1) (required)
port — Port (required)
credentials — Credentials (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

ironport-report
Retrieve email security appliance statistical reports.

Source

CiscoEmailSecurityApplianceIronPort.js CiscoEmailSecurityApplianceIronPort.yml

Download History Raw

var host = params.server.replace(/[\/]+$/, '') + ':'+params.port;

var sendRequest = function(url, method) {
    var res = http(
        url,
        {
            Method: method,
            Headers: {
                Accept: ['application/json'],
                Host: [host]
            },
            Username: params.credentials.identifier,
            Password: params.credentials.password
        },
        params.insecure,
        params.proxy
    );
    if (res.StatusCode < 200 || res.StatusCode >= 300) {
        throw 'Request Failed.\nStatus code: ' + res.StatusCode + '.\nBody: ' + JSON.stringify(res) + '.';
    }
    return res;
};

var underscoreToCapital = function(string){
    var ret_string = '_'+string;
    return ret_string.replace(/_([a-z])/g, function (g) { return ' '+g[1].toUpperCase(); });
};

var convertResKeys = function(res){
    var ret = {};
    var keys = Object.keys(res);
    keys.forEach(function(key){
        ret[underscoreToCamelCase(key)] = res[key];
    });
    return ret;
};

function getReport(command, args){
    delete args.report_type;
    requestURL = host+'/api/v1.0/stats/'+command;

    var time_range = args.time_range;
    delete args.time_range;
    var attributes = encodeToURLQuery(args);

    if(time_range){
        attributes += (attributes.length > 0) ? '&'+time_range : '?' + time_range;
    }
    else if(!args.duration){
            throw 'Time range missing. Must provide either time_range or duration arguments.';
    }
    rawResponse = sendRequest(requestURL + attributes, 'GET');
    try{
        res = JSON.parse(rawResponse.Body).data;
    }
    catch (err){
        return rawResponse;
    }
    context = {};
    context['IronPort.'+underscoreToCamelCase(command)] = convertResKeys(res);
    return {
        Type: entryTypes.note,
        Contents: res,
        ContentsFormat: formats.json,
        ReadableContentsFormat : formats.markdown,
        EntryContext : context,
        HumanReadable: tableToMarkdown('IronPort Report', res, undefined, undefined, underscoreToCapital)
    };
}

switch (command) {
    case 'test-module':
        res = getReport('mail_authentication_summary', {time_range: '1d'});
        if(!res.Contents){
            return res;
        }
        return 'ok';
    default:
        return getReport(args.report_type, args);
}

Cisco Email Security Appliance (IronPort) Deprecated