Cyren Inbox Security

Details

ID	`Cyren Inbox Security`
Provider	Data443
Category	Utilities
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Cyren Inbox Security is an innovative solution that safeguards Office 365 mailboxes in your organization against evasive phishing, business email compromise (BEC), and fraud. This integration imports incidents from Cyren Inbox Security into XSOAR, and includes a playbook for incident resolution.
This integration was integrated and tested with version 1.0 of Cyren Inbox Security

Configure Cyren Inbox Security in Cortex

Parameter	Description	Required
Server URL	The endpoint provided by your Cyren Representative. (use “sample” to test)	True
Client ID	The client iD provided by your Cyren Representative. (use “sample” to test)	True
Client Secret	The client secret provided by your Cyren Representative. (use “sample” to test)	True
First fetch time	1 day, 2 days, etc…	False
Maximum number of incidents per fetch		False
Incident type		False
Fetch incidents		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cyren-resolve-and-remediate

resolve a case and remediate incidents

Base Command

cyren-resolve-and-remediate

Input

Argument Name	Description	Required
case_id	case ID.	Required
resolution	resolution. Possible values are: phishing, malware, clean, other.	Optional
resolution_reason	the reason of the resolution. Possible values are: Identified phishing URL, Identified suspicious sender, Other, Scam, Spam.	Optional
resolution_reason_text	free text for resolution reason.	Optional
actions	remediation actions to perform. Possible values are: MOVE_TO_SPAM, MOVE_TO_DELETED, ADD_BANNER, SOFT_DELETE, MOVE_TO_INBOX, REMOVE_BANNER.	Optional

Context Output

Path	Type	Description
Cyren.data.status	string	status of actions performed

Command Example

!cyren-resolve-and-remediate resolution=phishing resolution_reason="Identified suspicious sender" case_id="62877980-6ac7-4944-b3fa-62ddf628a0fe" resolution_reason_text="I think it is phishing" actions=ADD_BANNER,MOVE_TO_DELETED

Context Example

{
    "Cyren": {
        "data": {
            "status": "ok"
        }
    }
}

Human Readable Output

cyren-resolve-and-remediate results

status

ok

end of results

status
ok

cyren-reset-sample-fetch

resets integration to fetch a sample incident

Base Command

cyren-reset-sample-fetch

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

Command Example

!cyren-reset-sample-fetch

Human Readable Output

A sample incident will be created on the next execution of system fetch-incidents command

Configuration parameters

url — Server URL (required)
client_id — Client ID (required)
client_secret — Client Secret (required)
first_fetch — First fetch time
max_fetch — Maximum number of incidents per fetch
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
isFetch — Fetch incidents

Commands (1)

cyren-resolve-and-remediate
resolve a case and remediate incidents.

Source

CyrenInboxSecurity.py CyrenInboxSecurity_test.py CyrenInboxSecurity.yml CyrenInboxSecurity_description.md

Download History Raw

# Cyren Inbox Security Integration

Utilize this integration to import Cyren Inbox Security incidents into XSOAR where they can be filtered through playbooks to help automate extended processing and analysis of these incidents.

Requirements for execution in a production environment include a Cyren Inbox Security ("CIS") license. Please contact [https://www.cyren.com/inbox-security-free-trial](https://www.cyren.com/inbox-security-free-trial) to get your free trial today.

You may test this integration without a license by utilizing "sample" as a parameter value as shown in the integration's parameter instructions. Refer to *Sample Mode* for more information regarding this configuration.

## Configuration

To configure your instance of a Cyren inbox Security Integration, please configure the following:

* **Fetches Incidents**:  must be selected in order to retrieve incidents from Cyren
* **Classifier**:  must be "Cyren Inbox Security Classifier"
* **Mapper (incoming)**:  must be "Cyren Inbox Security Mapper"

* **Server URL**: The endpoint  provided by your Cyren Representative or "sample" to try it.
* **Client ID**: The client ID provided by your Cyren Representative or "sample" to try it.
* **Client Secret**: The client secret provided by your Cyren Representative or "sample" to try it.

## Sample Mode

Use Sample mode to generate a test or sample incident. This mode is useful to preview layouts and playbooks in action without a Cyren Inbox Security license. To configure the integration in sample mode, set the parameters of the integration as follows:  

* **Fetches Incidents**:  must be selected in order to generate a sample incident
* **Classifier**:  must be "Cyren Inbox Security Classifier"
* **Mapper (incoming)**:  must be "Cyren Inbox Security Mapper"

* **Server URL**: "sample"
* **Client ID**: "sample"
* **Client Secret**: "sample"

Under sample mode, only one incident will be generated when the system invokes the fetch-incident command, regardless of other parameter settings.

To generate another incident, click *Reset the "last run" timestamp* configuration option for this integration.

Please refer to [https://www.cyren.com/cyren-inbox-security](https://www.cyren.com/cyren-inbox-security) for more information regarding Cyren Inbox Security.