ETDXsoarConnector

Details

ID	`ETDXsoarConnector`
Provider	Cisco
Category	Analytics & SIEM
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10404775`

README

Fetches Cisco Email Threat Defense (ETD) message events and creates incidents.
This integration was integrated and tested with of ETDXsoarConnector.

Configure Cisco ETD Connector in Cortex

Parameter	Required
ETD Base URL	True
api_key	True
API Key	True
Client ID	True
client_secret	True
Client Secret	True
Use system proxy settings	False
Trust any certificate (not secure)	False
First Fetch Time	False
Fetch incidents
Incidents Fetch Interval
Incident type	False
Max fetch	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cisco-etd-move-message

Reclassifies and remediates an ETD message.

Base Command

cisco-etd-move-message

Input

Argument Name	Description	Required
message_id	The ETD message ID.	Required
verdict	The new verdict.	Required
folder	The new folder action.	Required

Context Output

Path	Type	Description
ETD.Message.ID	String	The message ID.
ETD.Message.Verdict	String	The updated verdict.
ETD.Message.Folder	String	The updated folder.

Command Example

!cisco-etd-move-message message_id="123456789abcdef" verdict="malicious" folder="quarantine"

Context Example

{
  "ETD": {
    "Message": {
      "ID": "123456789abcdef",
      "Verdict": "malicious",
      "Folder": "quarantine"
    }
  }
}

Configuration parameters

etd_base_url — ETD Base URL (required)
api_key — (required)
client_id — Client ID (required)
client_secret — (required)
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)
first_fetch — First Fetch Time
isFetch — Fetch incidents
incidentFetchInterval — Incidents Fetch Interval
incidentType — Incident type
max_fetch — Max fetch

Commands (1)

cisco-etd-move-message
Reclassifies and remediates an ETD message.

Source

ETDXsoarConnector.py ETDXsoarConnector_test.py ETDXsoarConnector.yml ETDXsoarConnector_description.md

Download History Raw

## Cisco Email Threat Defense (ETD) Configuration

To configure this integration, you need API credentials from your Cisco Email Threat Defense (ETD) tenant.

### Prerequisites

- Cisco Email Threat Defense (ETD) tenant
- API Key
- Client ID
- Client Secret
- ETD Base URL

### Obtain API Credentials

1. Sign in to the Cisco Email Threat Defense administrator portal.
2. Navigate to **Administration** > **API Applications**.
3. Create a new API application or select an existing application.
4. Copy the following credentials:
   - API Key
   - Client ID
   - Client Secret
5. Enter these values in the Cortex XSOAR integration configuration.

### Configure the Integration

Configure the following parameters when creating the integration instance:

- **ETD Base URL** – Base URL of your Cisco Email Threat Defense (ETD) tenant (for example, `https://api.<region>.emailthreatdefense.com`).
- **API Key** – API key used to authenticate requests.
- **Client ID** – OAuth client identifier.
- **Client Secret** – OAuth client secret.
- **First Fetch Time** – Time from which incidents are fetched during the initial execution.
- **Max Fetch** – Maximum number of incidents to fetch during each polling cycle.
- **Fetch Incidents** – Enable to automatically fetch ETD message events and create incidents in Cortex XSOAR.
- **Use system proxy settings** – Use the proxy configured on the Cortex XSOAR server.
- **Trust any certificate (not secure)** – Disable SSL certificate validation. Enable this option only when required for testing or trusted environments.

### Notes

- This integration retrieves **ETD message events** and creates incidents in Cortex XSOAR.
- Incident polling runs according to the configured **Incident Fetch Interval**.
- Ensure the configured API application has permission to access ETD message logs and perform message remediation operations.