Cyren Inbox Security

Details

ID	`Cyren Inbox Security`
Provider	Data443
Category	Utilities
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Cyren Inbox Security is an innovative solution that safeguards Office 365 mailboxes in your organization against evasive phishing, business email compromise (BEC), and fraud. This integration imports incidents from Cyren Inbox Security into XSOAR, and includes a playbook for incident resolution.
This integration was integrated and tested with version 1.0 of Cyren Inbox Security

Configure Cyren Inbox Security in Cortex

Parameter	Description	Required
Server URL	The endpoint provided by your Cyren Representative. (use “sample” to test)	True
Client ID	The client iD provided by your Cyren Representative. (use “sample” to test)	True
Client Secret	The client secret provided by your Cyren Representative. (use “sample” to test)	True
First fetch time	1 day, 2 days, etc…	False
Maximum number of incidents per fetch		False
Incident type		False
Fetch incidents		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cyren-resolve-and-remediate

resolve a case and remediate incidents

Base Command

cyren-resolve-and-remediate

Input

Argument Name	Description	Required
case_id	case ID.	Required
resolution	resolution. Possible values are: phishing, malware, clean, other.	Optional
resolution_reason	the reason of the resolution. Possible values are: Identified phishing URL, Identified suspicious sender, Other, Scam, Spam.	Optional
resolution_reason_text	free text for resolution reason.	Optional
actions	remediation actions to perform. Possible values are: MOVE_TO_SPAM, MOVE_TO_DELETED, ADD_BANNER, SOFT_DELETE, MOVE_TO_INBOX, REMOVE_BANNER.	Optional

Context Output

Path	Type	Description
Cyren.data.status	string	status of actions performed

Command Example

!cyren-resolve-and-remediate resolution=phishing resolution_reason="Identified suspicious sender" case_id="62877980-6ac7-4944-b3fa-62ddf628a0fe" resolution_reason_text="I think it is phishing" actions=ADD_BANNER,MOVE_TO_DELETED

Context Example

{
    "Cyren": {
        "data": {
            "status": "ok"
        }
    }
}

Human Readable Output

cyren-resolve-and-remediate results

status

ok

end of results

status
ok

cyren-reset-sample-fetch

resets integration to fetch a sample incident

Base Command

cyren-reset-sample-fetch

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

Command Example

!cyren-reset-sample-fetch

Human Readable Output

A sample incident will be created on the next execution of system fetch-incidents command

Configuration parameters

url — Server URL (required)
client_id — Client ID (required)
client_secret — Client Secret (required)
first_fetch — First fetch time
max_fetch — Maximum number of incidents per fetch
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
isFetch — Fetch incidents

Commands (1)

cyren-resolve-and-remediate
resolve a case and remediate incidents.

Source

CyrenInboxSecurity.py CyrenInboxSecurity_test.py CyrenInboxSecurity.yml CyrenInboxSecurity_description.md

Download History Raw

category: Utilities
sectionorder:
- Connect
- Collect
provider: Data443
commonfields:
  id: Cyren Inbox Security
  version: -1
configuration:
- additionalinfo: The endpoint  provided by your Cyren Representative. (use "sample" to test)
  display: Server URL
  name: url
  required: true
  type: 0
  section: Connect
- additionalinfo: The client iD provided by your Cyren Representative. (use "sample" to test)
  display: Client ID
  name: client_id
  required: true
  type: 0
  section: Connect
- additionalinfo: The client secret provided by your Cyren Representative. (use "sample" to test)
  display: Client Secret
  name: client_secret
  required: true
  type: 4
  section: Connect
- additionalinfo: 1 day, 2 days, etc...
  defaultvalue: 3 days
  display: First fetch time
  name: first_fetch
  type: 0
  required: false
  section: Collect
- defaultvalue: "10"
  display: Maximum number of incidents per fetch
  name: max_fetch
  type: 0
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
description: Cyren Inbox Security is an innovative solution that safeguards Office 365 mailboxes in your organization against evasive phishing, business email compromise (BEC), and fraud. This integration imports incidents from Cyren Inbox Security into XSOAR, and includes a playbook for incident resolution.
display: Cyren Inbox Security
name: Cyren Inbox Security
script:
  commands:
  - arguments:
    - description: case ID.
      name: case_id
      required: true
    - auto: PREDEFINED
      default: true
      description: resolution.
      name: resolution
      predefined:
      - phishing
      - malware
      - clean
      - other
    - auto: PREDEFINED
      description: the reason of the resolution.
      name: resolution_reason
      predefined:
      - Identified phishing URL
      - Identified suspicious sender
      - Other
      - Scam
      - Spam
    - description: free text for resolution reason.
      name: resolution_reason_text
    - auto: PREDEFINED
      description: remediation actions to perform.
      isArray: true
      name: actions
      predefined:
      - MOVE_TO_SPAM
      - MOVE_TO_DELETED
      - ADD_BANNER
      - SOFT_DELETE
      - MOVE_TO_INBOX
      - REMOVE_BANNER
    description: resolve a case and remediate incidents.
    name: cyren-resolve-and-remediate
    outputs:
    - contextPath: Cyren.data.status
      description: status of actions performed.
      type: string
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  script: ''
  subtype: python3
  type: python
fromversion: 6.0.0
tests:
- No tests (auto formatted)
defaultclassifier: 2b2c9b9d-cfb4-46d6-8b0c-55e02bf9f62c
defaultmapperin: Cyren Inbox Security Mapper