Cyren Inbox Security

Details

ID	`Cyren Inbox Security`
Provider	Data443
Category	Utilities
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Cyren Inbox Security is an innovative solution that safeguards Office 365 mailboxes in your organization against evasive phishing, business email compromise (BEC), and fraud. This integration imports incidents from Cyren Inbox Security into XSOAR, and includes a playbook for incident resolution.
This integration was integrated and tested with version 1.0 of Cyren Inbox Security

Configure Cyren Inbox Security in Cortex

Parameter	Description	Required
Server URL	The endpoint provided by your Cyren Representative. (use “sample” to test)	True
Client ID	The client iD provided by your Cyren Representative. (use “sample” to test)	True
Client Secret	The client secret provided by your Cyren Representative. (use “sample” to test)	True
First fetch time	1 day, 2 days, etc…	False
Maximum number of incidents per fetch		False
Incident type		False
Fetch incidents		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cyren-resolve-and-remediate

resolve a case and remediate incidents

Base Command

cyren-resolve-and-remediate

Input

Argument Name	Description	Required
case_id	case ID.	Required
resolution	resolution. Possible values are: phishing, malware, clean, other.	Optional
resolution_reason	the reason of the resolution. Possible values are: Identified phishing URL, Identified suspicious sender, Other, Scam, Spam.	Optional
resolution_reason_text	free text for resolution reason.	Optional
actions	remediation actions to perform. Possible values are: MOVE_TO_SPAM, MOVE_TO_DELETED, ADD_BANNER, SOFT_DELETE, MOVE_TO_INBOX, REMOVE_BANNER.	Optional

Context Output

Path	Type	Description
Cyren.data.status	string	status of actions performed

Command Example

!cyren-resolve-and-remediate resolution=phishing resolution_reason="Identified suspicious sender" case_id="62877980-6ac7-4944-b3fa-62ddf628a0fe" resolution_reason_text="I think it is phishing" actions=ADD_BANNER,MOVE_TO_DELETED

Context Example

{
    "Cyren": {
        "data": {
            "status": "ok"
        }
    }
}

Human Readable Output

cyren-resolve-and-remediate results

status

ok

end of results

status
ok

cyren-reset-sample-fetch

resets integration to fetch a sample incident

Base Command

cyren-reset-sample-fetch

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

Command Example

!cyren-reset-sample-fetch

Human Readable Output

A sample incident will be created on the next execution of system fetch-incidents command

Configuration parameters

url — Server URL (required)
client_id — Client ID (required)
client_secret — Client Secret (required)
first_fetch — First fetch time
max_fetch — Maximum number of incidents per fetch
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
isFetch — Fetch incidents

Commands (1)

cyren-resolve-and-remediate
resolve a case and remediate incidents.

Source

CyrenInboxSecurity.py CyrenInboxSecurity_test.py CyrenInboxSecurity.yml CyrenInboxSecurity_description.md

Download History Raw

"""Cyren Inbox Security Integration for Cortex XSOAR - Unit Tests file"""

import datetime
import json


def util_load_json(path):
    with open(path, encoding="utf-8") as f:
        return json.loads(f.read())


def test_simulate_fetch():
    from CyrenInboxSecurity import simulate_fetch

    # fetch
    incidents = simulate_fetch()

    assert incidents[0]["name"] == "Cyren Inbox Security Sample - phishing (admin@sample.com)"


def test_test_module(requests_mock):
    """Tests the test function."""

    from CyrenInboxSecurity import Client, test_module

    requests_mock.post("https://test.com/v1/token", json="ok")

    client = Client(base_url="https://test.com/", verify=False)

    # test
    results = test_module(
        client=client,
        client_id="sample",
        client_secret="sample",
    )

    assert results == "ok"


def test_resolve_and_remediate_command(requests_mock):
    """Tests the cyren-resolve-and-remediate command function."""
    from CyrenInboxSecurity import Client, resolve_and_remediate_command

    requests_mock.patch("https://test.com/v1/cases", json={"data": {"status": "ok"}})

    requests_mock.post("https://test.com/v1/token", json={"data": {"access_token": "sample"}})

    client = Client(base_url="https://test.com/", verify=False)

    # resolve and remediate
    cmd_results = resolve_and_remediate_command(
        client=client,
        args={
            "case_id": "123",
            "resolution": "phishing",
            "resolution_reason_text": "",
            "actions": [],
        },
        client_id="sample",
        client_secret="sample",
    )

    attrs = vars(cmd_results)
    assert attrs["raw_response"]["data"]["status"] == "ok"


def test_fetch_incidents(requests_mock):
    """Tests the fetch-incidents command function.

    Configures requests_mock instance to generate the appropriate
    get_alert API response, loaded from a local JSON file. Checks
    the output of the command function with the expected output.
    """
    from CyrenInboxSecurity import Client, fetch_incidents

    mock_response = util_load_json("test_data/sample-incidents.json")

    requests_mock.get("https://test.com/v1/incidents", json=mock_response)

    requests_mock.post("https://test.com/v1/token", json={"data": {"access_token": "sample"}})

    client = Client(base_url="https://test.com/", verify=False)

    last_run = {}

    # fetch
    incidents = fetch_incidents(
        client=client,
        client_id="sample",
        client_secret="sample",
        last_run=last_run,
        first_fetch_time=datetime.datetime.now(),
        max_fetch=10,
    )

    assert incidents[0]["name"] == "Cyren Inbox Security - phishing (System)"