EmailRepIO

Details

ID	`EmailRepIO`
Provider	Sublime Security
Category	Utilities
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

EmailRep.io provides the reputation and reports for email addresses.
This integration was integrated and tested with version EmailRep Alpha API v0.1 of EmailRep.io

Configure EmailRepIO in Cortex

Parameter	Description	Required
url	Server URL (e.g., https://emailrep.io)	True
apikey	API Key	False
insecure	Trust any certificate (not secure)	False
proxy	Use system proxy settings	False
Source Reliability	Reliability of the source providing the intelligence data.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

emailrepio-email-reputation-get

Gets the EmailRepIO reputation for the given email address.

Base Command

emailrepio-email-reputation-get

Input

Argument Name	Description	Required
email_address	The email address to get the reputation for.	Required

Context Output

Path	Type	Description
EmailRepIO.Email.email	String	The email address that was queried.
EmailRepIO.Email.reputation	String	The reputation of the email. Possible values are: “high”, “medium”, “low”, and “none”.
EmailRepIO.Email.suspicious	Boolean	Whether the email address should be treated as suspicious or risky.
EmailRepIO.Email.references	Number	The total number of positive and negative sources of the reputation. Note that these may not all be direct references to the email address, but can include reputation sources for the domain or other related information.
EmailRepIO.Email.details.blacklisted	Boolean	Whether the email is believed to be malicious or spam.
EmailRepIO.Email.details.malicious_activity	Boolean	Whether the email exhibited malicious behavior (e.g., phishing or fraud).
EmailRepIO.Email.details.malicious_activity_recent	Boolean	Whether the email exhibited malicious behavior in the last 90 days (e.g., in the case of temporal account takeovers).
EmailRepIO.Email.details.credentials_leaked	Boolean	Whether the email credentials were ever leaked (e.g., a data breach, pastebin, dark web, etc.).
EmailRepIO.Email.details.credentials_leaked_recent	Boolean	Whether the email credentials were leaked in the last 90 days.
EmailRepIO.Email.details.data_breach	Boolean	Whether the email was ever in a data breach.
EmailRepIO.Email.details.first_seen	Date	The first date the email was observed in a breach, credential leak, or exhibiting malicious or spammy behavior. Displays “never” if the email was never observed in a breach, credential leak, or exhibiting malicious or spammy behavior.
EmailRepIO.Email.details.last_seen	Date	The last date the email was observed in a breach, credential leak, or exhibiting malicious or spammy behavior. Displays “never” if the email was never observed in a breach, credential leak, or exhibiting malicious or spammy behavior.
EmailRepIO.Email.details.domain_exists	Boolean	Whether the domain is a valid domain.
EmailRepIO.Email.details.domain_reputation	String	The reputation of the domain. Possible values are: “high”, “medium”, “low”, and “n/a”. Displays “n/a” if the domain is a free_provider, disposable, or doesn’t exist.
EmailRepIO.Email.details.new_domain	Boolean	Whether the domain was created within the last year.
EmailRepIO.Email.details.days_since_domain_creation	Number	The number of days since the domain was created.
EmailRepIO.Email.details.suspicious_tld	Boolean	Whether the email has a suspicious top level domain (tld).
EmailRepIO.Email.details.spam	Boolean	Whether the email has exhibited spammy behavior (e.g., spam traps, login form abuse).
EmailRepIO.Email.details.free_provider	Boolean	Whether the email uses a free email provider.
EmailRepIO.Email.details.disposable	Boolean	Whether the email uses a temporary or disposable service.
EmailRepIO.Email.details.deliverable	Boolean	Whether the email is deliverable.
EmailRepIO.Email.details.accept_all	Boolean	Whether the mail server has a default accept all policy. Some mail servers return inconsistent responses, so the default may be an accept all policy.
EmailRepIO.Email.details.valid_mx	Boolean	Whether the email has a mail exchanger (MX) record.
EmailRepIO.Email.details.spoofable	Boolean	Whether the email address can be spoofed (e.g., not a strict SPF policy or DMARC is not enforced).
EmailRepIO.Email.details.spf_strict	Boolean	Whether there is a sufficiently strict SPF record to prevent spoofing.
EmailRepIO.Email.details.dmarc_enforced	Boolean	Whether DMARC is configured correctly and enforced.
EmailRepIO.Email.details.profiles	String	The online profiles used by the email.

Command Example

!emailrepio-email-reputation-get email_address="test@example.com"

email

Gets the DBot score for the given email address using the EmailRepIO reputation.

Base Command

email

Input

Argument Name	Description	Required
email	The email address to get the reputation for.	Required

Context Output

Path	Type	Description
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Score	Number	The actual DBot score.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.
EmailRepIO.Email.email	String	email address that was queried
EmailRepIO.Email.reputation	String	The reputation of the email. Possible values are: “high”, “medium”, “low”, and “none”.
EmailRepIO.Email.suspicious	Boolean	Whether the email address should be treated as suspicious or risky.
EmailRepIO.Email.references	Number	The total number of positive and negative sources of the reputation. Note that these may not all be direct references to the email address, but can include reputation sources for the domain or other related information.
EmailRepIO.Email.details.blacklisted	Boolean	Whether the email is believed to be malicious or spam.
EmailRepIO.Email.details.malicious_activity	Boolean	Whether the email exhibited malicious behavior (e.g., phishing or fraud).
EmailRepIO.Email.details.malicious_activity_recent	Boolean	Whether the email exhibited malicious behavior in the last 90 days (e.g., in the case of temporal account takeovers).
EmailRepIO.Email.details.credentials_leaked	Boolean	Whether the email credentials were ever leaked (e.g., a data breach, pastebin, dark web, etc.).
EmailRepIO.Email.details.credentials_leaked_recent	Boolean	Whether the email credentials were leaked in the last 90 days.
EmailRepIO.Email.details.data_breach	Boolean	Whether the email was ever in a data breach.
EmailRepIO.Email.details.first_seen	Date	The first date the email was observed in a breach, credential leak, or exhibiting malicious or spammy behavior. Displays “never” if the email was never observed in a breach, credential leak, or exhibiting malicious or spammy behavior.
EmailRepIO.Email.details.last_seen	Date	The last date the email was observed in a breach, credential leak, or exhibiting malicious or spammy behavior. Displays “never” if the email was never observed in a breach, credential leak, or exhibiting malicious or spammy behavior.
EmailRepIO.Email.details.domain_exists	Boolean	Whether the domain is a valid domain.
EmailRepIO.Email.details.domain_reputation	String	The reputation of the domain. Possible values are: “high”, “medium”, “low”, and “n/a”. Displays “n/a” if the domain is a free_provider, disposable, or doesn’t exist.
EmailRepIO.Email.details.new_domain	Boolean	Whether the domain was created within the last year.
EmailRepIO.Email.details.days_since_domain_creation	Number	The number of days since the domain was created.
EmailRepIO.Email.details.suspicious_tld	Boolean	Whether the email has a suspicious top level domain (tld).
EmailRepIO.Email.details.spam	Boolean	Whether the email exhibited spammy behavior (e.g., spam traps, login form abuse).
EmailRepIO.Email.details.free_provider	Boolean	Whether the email uses a free email provider.
EmailRepIO.Email.details.disposable	Boolean	Whether the email uses a temporary or disposable service.
EmailRepIO.Email.details.deliverable	Boolean	Whether the email is deliverable.
EmailRepIO.Email.details.accept_all	Boolean	Whether the mail server has a default accept all policy. Some mail servers return inconsistent responses, so the default may be an accept all policy.
EmailRepIO.Email.details.valid_mx	Boolean	Whether the email has a mail exchanger (MX) record.
EmailRepIO.Email.details.spoofable	Boolean	Whether the email has a mail exchanger (MX) record. (e.g., not a strict SPF policy or DMARC is not enforced).
EmailRepIO.Email.details.spf_strict	Boolean	Whether there is a sufficiently strict SPF record to prevent spoofing.
EmailRepIO.Email.details.dmarc_enforced	Boolean	Whether DMARC is configured correctly and enforced.
EmailRepIO.Email.details.profiles	String	The online profiles used by the email.

Command Example

!email email="test@example.com"

emailrepio-email-address-report

Reports a malicious email address to EmailRepIO. You tag the type of malicious activity associated with the email address. The date of the malicious activity defaults to the current time unless otherwise specified.

Base Command

emailrepio-email-address-report

Input

Argument Name	Description	Required
email_address	The email address to report.	Required
tags	The tags that should be applied. See detailed descriptions in the EmailRepIO documentation for more information.	Required
description	Additional information and context.	Optional
timestamp	The time the activity occurred in UTC time format. Defaults to now().	Optional
expires	The number of hours the email should be considered risky (suspicious=true and blacklisted=true in the QueryResponse). Defaults to no expiration unless the “account_takeover” tag is specified, in which case the default is 14 days.	Optional

Context Output

There is no context output for this command.

Command Example

!emailrepio-email-address-report email_address="test@example.com" tags="spam"

Configuration parameters

url — Server URL (e.g., https://emailrep.io) (required)
apikey — API Key
credentials —
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
integration_reliability — Source Reliability

Commands (3)

email
Gets the DBot score for the given email address using the EmailRepIO reputation.
emailrepio-email-address-report
Reports a malicious email address to EmailRepIO. You tag the type of malicious activity associated with the email address. The date of the malicious activity defaults to the current time unless otherwise specified.
emailrepio-email-reputation-get
Gets the EmailRepIO reputation for the given email address.

Source

EmailRepIO.py EmailRepIO_test.py EmailRepIO.yml EmailRepIO_description.md

Download History Raw

category: Utilities
provider: Sublime Security
commonfields:
  id: EmailRepIO
  version: -1
configuration:
- defaultvalue: https://emailrep.io
  display: Server URL (e.g., https://emailrep.io)
  name: url
  required: true
  type: 0
- additionalinfo: Mandatory for the emailrepio-email-address-report command
  display: API Key
  name: apikey
  type: 4
  hidden: true
  required: false
- display: ""
  name: credentials
  type: 9
  additionalinfo: Mandatory for the emailrepio-email-address-report command
  displaypassword: API Key
  hiddenusername: true
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: integration_reliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  required: false
description: Provides email address reputation and reports.
display: EmailRep.io
name: EmailRepIO
script:
  commands:
  - arguments:
    - description: The email address to get the reputation for.
      name: email_address
      required: true
    description: Gets the EmailRepIO reputation for the given email address.
    name: emailrepio-email-reputation-get
    outputs:
    - contextPath: EmailRepIO.Email.email
      type: String
      description: The email address that was queried.
    - contextPath: EmailRepIO.Email.reputation
      type: String
      description: 'The reputation of the email. Possible values are: "high", "medium", "low", and "none".'
    - contextPath: EmailRepIO.Email.suspicious
      type: Boolean
      description: Whether the email address should be treated as suspicious or risky.
    - contextPath: EmailRepIO.Email.references
      type: Number
      description: The total number of positive and negative sources of the reputation. Note that these may not all be direct references to the email address, but can include reputation sources for the domain or other related information.
    - contextPath: EmailRepIO.Email.details.blacklisted
      type: Boolean
      description: Whether the email is believed to be malicious or spam.
    - contextPath: EmailRepIO.Email.details.malicious_activity
      type: Boolean
      description: Whether the email exhibited malicious behavior (e.g., phishing or fraud).
    - contextPath: EmailRepIO.Email.details.malicious_activity_recent
      type: Boolean
      description: Whether the email exhibited malicious behavior in the last 90 days (e.g., in the case of temporal account takeovers).
    - contextPath: EmailRepIO.Email.details.credentials_leaked
      type: Boolean
      description: Whether the email credentials were ever leaked (e.g., a data breach, pastebin, dark web, etc.).
    - contextPath: EmailRepIO.Email.details.credentials_leaked_recent
      type: Boolean
      description: Whether the email credentials were leaked in the last 90 days.
    - contextPath: EmailRepIO.Email.details.data_breach
      type: Boolean
      description: Whether the email was ever in a data breach.
    - contextPath: EmailRepIO.Email.details.first_seen
      type: Date
      description: The first date the email was observed in a breach, credential leak, or exhibiting malicious or spammy behavior. Displays "never" if the email was never observed in a breach, credential leak, or exhibiting malicious or spammy behavior.
    - contextPath: EmailRepIO.Email.details.last_seen
      type: Date
      description: The last date the email was observed in a breach, credential leak, or exhibiting malicious or spammy behavior. Displays "never" if the email was never observed in a breach, credential leak, or exhibiting malicious or spammy behavior.
    - contextPath: EmailRepIO.Email.details.domain_exists
      type: Boolean
      description: Whether the domain is a valid domain.
    - contextPath: EmailRepIO.Email.details.domain_reputation
      type: String
      description: 'The reputation of the domain. Possible values are: "high", "medium", "low", and "n/a". Displays "n/a" if the domain is a free_provider, disposable, or doesn’t exist.'
    - contextPath: EmailRepIO.Email.details.new_domain
      type: Boolean
      description: Whether the domain was created within the last year.
    - contextPath: EmailRepIO.Email.details.days_since_domain_creation
      type: Number
      description: The number of days since the domain was created.
    - contextPath: EmailRepIO.Email.details.suspicious_tld
      type: Boolean
      description: Whether the email has a suspicious top level domain (tld).
    - contextPath: EmailRepIO.Email.details.spam
      type: Boolean
      description: Whether the email has exhibited spammy behavior (e.g., spam traps, login form abuse).
    - contextPath: EmailRepIO.Email.details.free_provider
      type: Boolean
      description: Whether the email uses a free email provider.
    - contextPath: EmailRepIO.Email.details.disposable
      type: Boolean
      description: Whether the email uses a temporary or disposable service.
    - contextPath: EmailRepIO.Email.details.deliverable
      type: Boolean
      description: Whether the email is deliverable.
    - contextPath: EmailRepIO.Email.details.accept_all
      type: Boolean
      description: Whether the mail server has a default accept all policy. Some mail servers return inconsistent responses, so the default may be an accept all policy.
    - contextPath: EmailRepIO.Email.details.valid_mx
      type: Boolean
      description: Whether the email has a mail exchanger (MX) record.
    - contextPath: EmailRepIO.Email.details.spoofable
      type: Boolean
      description: Whether the email address can be spoofed (e.g., not a strict Sender Policy Framework (SPF) policy or Domain-based Message Authentication, Reporting & Conformance (DMARC) is not enforced).
    - contextPath: EmailRepIO.Email.details.spf_strict
      type: Boolean
      description: Whether there is a sufficiently strict SPF record to prevent spoofing.
    - contextPath: EmailRepIO.Email.details.dmarc_enforced
      type: Boolean
      description: Whether DMARC is configured correctly and enforced.
    - contextPath: EmailRepIO.Email.details.profiles
      type: String
      description: The online profiles used by the email.
  - arguments:
    - default: true
      description: The email address to get the reputation for.
      isArray: true
      name: email
      required: true
    description: Gets the DBot score for the given email address using the EmailRepIO reputation.
    name: email
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Reliability
      type: String
      description: Reliability of the source providing the intelligence data.
    - contextPath: EmailRepIO.Email.email
      type: String
      description: 'The email address that was queried.'
    - contextPath: EmailRepIO.Email.reputation
      type: String
      description: 'The reputation of the email. Possible values are: "high", "medium", "low", and "none".'
    - contextPath: EmailRepIO.Email.suspicious
      type: Boolean
      description: Whether the email address should be treated as suspicious or risky.
    - contextPath: EmailRepIO.Email.references
      type: Number
      description: The total number of positive and negative sources of the reputation. Note that these may not all be direct references to the email address, but can include reputation sources for the domain or other related information.
    - contextPath: EmailRepIO.Email.details.blacklisted
      type: Boolean
      description: Whether the email is believed to be malicious or spam.
    - contextPath: EmailRepIO.Email.details.malicious_activity
      type: Boolean
      description: Whether the email exhibited malicious behavior (e.g., phishing or fraud).
    - contextPath: EmailRepIO.Email.details.malicious_activity_recent
      type: Boolean
      description: Whether the email exhibited malicious behavior in the last 90 days (e.g., in the case of temporal account takeovers).
    - contextPath: EmailRepIO.Email.details.credentials_leaked
      type: Boolean
      description: Whether the email credentials were ever leaked (e.g., a data breach, pastebin, dark web, etc.).
    - contextPath: EmailRepIO.Email.details.credentials_leaked_recent
      type: Boolean
      description: Whether the email credentials were leaked in the last 90 days.
    - contextPath: EmailRepIO.Email.details.data_breach
      type: Boolean
      description: Whether the email was ever in a data breach.
    - contextPath: EmailRepIO.Email.details.first_seen
      type: Date
      description: The first date the email was observed in a breach, credential leak, or exhibiting malicious or spammy behavior. Displays "never" if the email was never observed in a breach, credential leak, or exhibiting malicious or spammy behavior.
    - contextPath: EmailRepIO.Email.details.last_seen
      type: Date
      description: The last date the email was observed in a breach, credential leak, or exhibiting malicious or spammy behavior. Displays "never" if the email was never observed in a breach, credential leak, or exhibiting malicious or spammy behavior.
    - contextPath: EmailRepIO.Email.details.domain_exists
      type: Boolean
      description: 'Whether the domain is a valid domain.'
    - contextPath: EmailRepIO.Email.details.domain_reputation
      type: String
      description: 'The reputation of the domain. Possible values are: "high", "medium", "low", and "n/a". Displays "n/a" if the domain is a free_provider, disposable, or doesn’t exist.'
    - contextPath: EmailRepIO.Email.details.new_domain
      type: Boolean
      description: Whether the domain was created within the last year.
    - contextPath: EmailRepIO.Email.details.days_since_domain_creation
      type: Number
      description: The number of days since the domain was created.
    - contextPath: EmailRepIO.Email.details.suspicious_tld
      type: Boolean
      description: Whether the email has a suspicious top level domain (tld).
    - contextPath: EmailRepIO.Email.details.spam
      type: Boolean
      description: Whether the email exhibited spammy behavior (e.g., spam traps, login form abuse).
    - contextPath: EmailRepIO.Email.details.free_provider
      type: Boolean
      description: Whether the email uses a free email provider.
    - contextPath: EmailRepIO.Email.details.disposable
      type: Boolean
      description: Whether the email uses a temporary or disposable service.
    - contextPath: EmailRepIO.Email.details.deliverable
      type: Boolean
      description: Whether the email is deliverable.
    - contextPath: EmailRepIO.Email.details.accept_all
      type: Boolean
      description: Whether the mail server has a default accept all policy. Some mail servers return inconsistent responses, so the default may be an accept all policy.
    - contextPath: EmailRepIO.Email.details.valid_mx
      type: Boolean
      description: Whether the email has a mail exchanger (MX) record.
    - contextPath: EmailRepIO.Email.details.spoofable
      type: Boolean
      description: Whether the email address can be spoofed (e.g., not a strict Sender Policy Framework (SPF) policy or Domain-based Message Authentication, Reporting & Conformance (DMARC) is not enforced).
    - contextPath: EmailRepIO.Email.details.spf_strict
      type: Boolean
      description: Whether there is a sufficiently strict SPF record to prevent spoofing.
    - contextPath: EmailRepIO.Email.details.dmarc_enforced
      type: Boolean
      description: Whether DMARC is configured correctly and enforced.
    - contextPath: EmailRepIO.Email.details.profiles
      type: String
      description: The online profiles used by the email.
  - arguments:
    - description: The email address to report.
      name: email_address
      required: true
    - auto: PREDEFINED
      description: The tags to apply to the email. See detailed descriptions in the EmailRepIO documentation for more information.
      isArray: true
      name: tags
      predefined:
      - account_takeover
      - bec
      - brand_impersonation
      - browser_exploit
      - credential_phishing
      - generic_phishing
      - malware
      - scam
      - spam
      - spoofed
      - task_request
      - threat_actor
      required: true
    - description: Additional information and context.
      name: description
    - description: The time the activity occurred in UTC time format. Defaults to now().
      name: timestamp
    - description: The number of hours the email should be considered risky (suspicious=true and blacklisted=true in the QueryResponse). Defaults to no expiration unless the "account_takeover" tag is specified, in which case the default is 14 days.
      name: expires
    description: Reports a malicious email address to EmailRepIO.  You tag the type of malicious activity associated with the email address. The date of the malicious activity defaults to the current time unless otherwise specified.
    name: emailrepio-email-address-report
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 5.0.0
tests:
- No tests (auto formatted)