ETDXsoarConnector

Details

ID	`ETDXsoarConnector`
Provider	Cisco
Category	Analytics & SIEM
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10404775`

README

Fetches Cisco Email Threat Defense (ETD) message events and creates incidents.
This integration was integrated and tested with of ETDXsoarConnector.

Configure Cisco ETD Connector in Cortex

Parameter	Required
ETD Base URL	True
api_key	True
API Key	True
Client ID	True
client_secret	True
Client Secret	True
Use system proxy settings	False
Trust any certificate (not secure)	False
First Fetch Time	False
Fetch incidents
Incidents Fetch Interval
Incident type	False
Max fetch	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cisco-etd-move-message

Reclassifies and remediates an ETD message.

Base Command

cisco-etd-move-message

Input

Argument Name	Description	Required
message_id	The ETD message ID.	Required
verdict	The new verdict.	Required
folder	The new folder action.	Required

Context Output

Path	Type	Description
ETD.Message.ID	String	The message ID.
ETD.Message.Verdict	String	The updated verdict.
ETD.Message.Folder	String	The updated folder.

Command Example

!cisco-etd-move-message message_id="123456789abcdef" verdict="malicious" folder="quarantine"

Context Example

{
  "ETD": {
    "Message": {
      "ID": "123456789abcdef",
      "Verdict": "malicious",
      "Folder": "quarantine"
    }
  }
}

Configuration parameters

etd_base_url — ETD Base URL (required)
api_key — (required)
client_id — Client ID (required)
client_secret — (required)
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)
first_fetch — First Fetch Time
isFetch — Fetch incidents
incidentFetchInterval — Incidents Fetch Interval
incidentType — Incident type
max_fetch — Max fetch

Commands (1)

cisco-etd-move-message
Reclassifies and remediates an ETD message.

Source

ETDXsoarConnector.py ETDXsoarConnector_test.py ETDXsoarConnector.yml ETDXsoarConnector_description.md

Download History Raw

name: ETDXsoarConnector
display: Cisco ETD Connector
category: Analytics & SIEM
commonfields:
  id: ETDXsoarConnector
  version: -1
description: Fetches Cisco Email Threat Defense (ETD) message events and creates incidents.
provider: Cisco
script:
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10404775
  isfetch: true
  commands:
  - name: cisco-etd-move-message
    description: Reclassifies and remediates an ETD message.
    arguments:
    - name: message_id
      description: The ETD message ID.
      required: true
    - name: verdict
      description: The new verdict.
      required: true
    - name: folder
      description: The new folder action.
      required: true
    outputs:
    - contextPath: ETD.Message.ID
      description: The message ID.
      type: String
    - contextPath: ETD.Message.Verdict
      description: The updated verdict.
      type: String
    - contextPath: ETD.Message.Folder
      description: The updated folder.
      type: String
sectionorder:
- Connect
- Collect
configuration:
- display: ETD Base URL
  name: etd_base_url
  type: 0
  required: true
  section: Connect
- displaypassword: API Key
  name: api_key
  type: 9
  required: true
  section: Connect
- display: Client ID
  name: client_id
  type: 0
  required: true
  section: Connect
- displaypassword: Client Secret
  name: client_secret
  type: 9
  required: true
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- name: insecure
  display: Trust any certificate (not secure)
  required: false
  type: 8
  advanced: true
  section: Connect
- display: First Fetch Time
  name: first_fetch
  type: 0
  defaultvalue: 3 days
  required: false
  section: Collect
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  defaultvalue: 15
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  defaultvalue: ETD Malicious Email
  required: false
  section: Collect
- display: Max fetch
  name: max_fetch
  type: 0
  required: false
  defaultvalue: '100'
  section: Collect
fromversion: 6.10.0
marketplaces:
- xsoar
tests:
- Test ETDXsoarConnector