Details

ID	`FireEye ETP`
Provider	Trellix
Category	Network Security
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10404775`
Supported Modules	Agentix XSIAM

README

Trellix Email Security - Cloud

Overview

Use the Trellix Email Security - Cloud integration to import messages as incidents, search for messages with specific attributes, and retrieve alert data.

Use Cases

Search for messages using specific message attributes as indicators.
Import messages as Cortex incidents/issues, using the message status as indicator.

Authentication and Authorization

Configuring API Keys

If the IAM domain you use to access the Trellix UI ends in fireeye.com, follow these steps to configure API keys:

Log in to the Email Security — Cloud Web Portal or IAM console.
Click My Settings in the top navigation bar.
Click the API Keys tab in the IAM console.
Click Create API Key.
On the Manage API Key page, specify the following:

API key name
Expiration time for the API key.
The expiration time should be set as "100d" for 100 days or "1y" for 1 year, for example.
Products
Select both Email Threat Prevention and Identity Access Management.

Select all required entitlements. For any API access, the following entitlements are mandatory:
- iam.users.browse
- iam.orgs.self.read
Alerts APIs

For accessing alerts APIs, the following additional entitlements are required:
- etp.alerts.read
Trace APIs

For accessing trace APIs, the following additional entitlements are required:
- etp.email_trace.read
Quarantine APIs

For accessing quarantine APIs, the following additional entitlements are required:
- etp.quarantine.update
- etp.quar

Authentication Prerequisites

To ensure a successful connection, select the authentication method that matches the Server URL (Instance URL) you are configuring.

Dual Authentication Methods

We support two different authentication methods depending on the endpoint domain:

Domain Used in Server URL	Authentication Method	Required Parameters
Ends in `trellix.com`	OAuth 2.0	Client ID, Client Secret, and OAuth Scopes
Ends in `fireeye.com`	API Key	API Key (only)

Authentication Setup (Choose One)

You must configure only one of the two authentication approaches below based on your Server URL domain.

1. API Key Method (For fireeye.com URLs):
- Configure an API key on the ETP Web portal. Select the product as both Email Threat Prevention and Identity Access Management. Select all entitlements.
2. OAuth 2.0 Method (For trellix.com URLs):
- When creating the Client ID and Client Secret, ensure the corresponding user/role has explicit permission to access the API.
- Note: If API access permissions are not properly set for the user/role, the authentication attempt will fail with a 400 Client Error: Bad Request even if the Client ID and Secret are correct.
Contact Trellix Email Security - Cloud Technical Support to let them know the IP address of your Cortex Server and the URL you are accessing, e.g. https://etp.us.fireeye.com. Trellix will add these details to their Firewall rules so that the bidirectional traffic can be allowed between Cortex and Trellix Email Security - Cloud.

Configure Trellix Email Security - Cloud in Cortex

Parameter	Description	Required
Server URL	Valid URLs (US, EMEA, USGOV): https://us.etp.trellix.com / https://etp.us.fireeye.com, https://eu.etp.trellix.com / https://etp.eu.fireeye.com, https://etp.us.fireeyegov.com	True
Client ID (OAuth)	Use the Client ID and Client Secret for the Trellix base URL.
Client Secret (OAuth)
OAuth Scopes (OAuth)	Space-separated list of OAuth scopes. Note: Only include scopes that your application’s Client ID has already been authorized to use.	False
Token URL	Override the OAuth 2.0 token endpoint base URL. Leave empty to use the default Trellix IAM endpoint. For Trellix GovCloud tenants, set to `https://iam.us.trellix-gov.com`.	False
API Key	Use the Api key for the FireEye base URL.	False
Trust any certificate (not secure)		False
Use system proxy settings		False
Fetch incidents		False
First fetch timestamp.		False
Max incidents per fetch	Input a value between 1 and 59. Values above 59 will be internally capped to avoid exceeding API rate limits.	False
Incident type		False
Alerts statuses to import	All alerts with a status specified here will be imported as incidents. Valid values are: accepted, deleted, delivered, delivered (retroactive), dropped, dropped oob, dropped (oob retroactive), permanent failure, processing quarantined, rejected, temporary failure	False

Fetched Incidents Data

To use Fetch incidents:

Configure a new instance.
Navigate to instance settings, and specify the message status (using the valid values).
Select Fetch incidents option.

The integration will fetch alerts as incidents. It is possible to filter alerts using the specified message status.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

fireeye-etp-search-messages

Search for messages using specific message attributes as indicators.

Search for messages that include specified message attributes that are accessible in the ETP portal.

Base Command

fireeye-etp-search-messages

Input

Argument Name	Description	Required
from_email	List of ‘From’ email-addresses, max limit of entries is 10.	Optional
from_email_not_in	List of ‘From’ email-addresses not to be included, max limit of entries is 10.	Optional
recipients	List of ‘To’/’Cc’ email-addresses, max limit of entries is 10.	Optional
recipients_not_in	list of ‘To’/’Cc’ email-addresses not to be included, max limit of entries is 10.	Optional
subject	List of strings, max limit of entries is 10.	Optional
from_accepted_date_time	The time stamp of the email-accepted date to specify the beginning of the date range to search, e.g. 2017-10-24T10:48:51.000Z . Specify ‘to_accepted_date_time’ as well to set the complete date range for the search.	Optional
to_accepted_date_time	The time stamp of the email-accepted date to specify the end of the date range to search, e.g. 2017-10-24T10:48:51.000Z . Specify ‘from_accepted_date_time’ as well to set the complete date range for the search.	Optional
rejection_reason	List of ETP rejection reason codes ( “ETP102”, “ETP103”, “ETP104”, “ETP200”, “ETP201”, “ETP203”, “ETP204”, “ETP205”, “ETP300”, “ETP301”, “ETP302”, “ETP401”, “ETP402”, “ETP403”, “ETP404”, “ETP405”).	Optional
sender_ip	List of sender IP addresses, max limit of entries is 10.	Optional
status	List of email status values( “accepted”, “deleted”, “delivered”, “delivered (retroactive)”, “dropped”, “dropped oob”, “dropped (oob retroactive)”, “permanent failure”, “processing”, “quarantined”, “rejected”, “temporary failure”).	Optional
status_not_in	List of email status values not to include( “accepted”, “deleted”, “delivered”, “delivered (retroactive)”, “dropped”, “dropped oob”, “dropped (oob retroactive)”, “permanent failure”, “processing”, “quarantined”, “rejected”, “temporary failure”).	Optional
last_modified_date_time	Date corresponding to last modified date, along with one of the following operators: “>”, “<”, “>=”, “<=”. E.g. use value “<2017-10-24T18:00:00.000Z” to search for messages that were last modified after the specified time stamp.	Optional
domain	List of domain names.	Optional
has_attachments	Boolean value to indicate if the message has attachments. Possible values are: true, false.	Optional
max_message_size	The default value is 20kb and maximum value is 100kb.	Optional

Context Output

Path	Type	Description
FireEyeETP.Message.acceptedDateTime	unknown	Message accepted date.
FireEyeETP.Message.countryCode	unknown	Sender country code.
FireEyeETP.Message.domain	unknown	Domain.
FireEyeETP.Message.emailSize	unknown	Email size in kb.
FireEyeETP.Message.lastModifiedDateTime	unknown	Message last modified date.
FireEyeETP.Message.recipientHeader	unknown	List of message recipients header (includes the display name of the user).
FireEyeETP.Message.recipients	unknown	List of message recipients.
FireEyeETP.Message.senderHeader	unknown	Message sender header (includes the display name of the user).
FireEyeETP.Message.sender	unknown	Message sender address.
FireEyeETP.Message.senderSMTP	unknown	Message sender SMTP.
FireEyeETP.Message.senderIP	unknown	Message sender IP.
FireEyeETP.Message.status	unknown	Message status.
FireEyeETP.Message.subject	unknown	Message subject.
FireEyeETP.Message.verdicts.AS	unknown	pass/fail verdict for AS.
FireEyeETP.Message.verdicts.AV	unknown	pass/fail verdict for AV.
FireEyeETP.Message.verdicts.AT	unknown	pass/fail verdict for AT.
FireEyeETP.Message.verdicts.PV	unknown	pass/fail verdict for PV.
FireEyeETP.Message.id	unknown	Message ID.

Command example 1

!fireeye-etp-search-messages to_accepted_date_time=2017-10-24T10:00:00.000Z from_accepted_date_time=2017-10-24T10:30:00.000Z

Command example 2

!fireeye-etp-search-messages from_email=diana@corp.com,charles@corp.com

Raw Output

{  
   "data": [  
      {  
         "attributes": {  
            "acceptedDateTime": "2018-06-09T10:49:32.000Z",
            "countryCode": "US",
            "domain": "test.com",
            "downStreamMsgID": "250 2.0.0 OK 100041373 d14-v6si970000qtb.70 - gsmtp",
            "emailSize": 9.89,
            "lastModifiedDateTime": "2018-06-09T10:49:33.329Z",
            "recipientHeader": [  
               "Security Operations Center <SOC@corp.com>"
            ],
            "recipientSMTP": [  
               "jason@demisto.com"
            ],
            "senderHeader": "\"soc@demisto.com\" <bot@demisto.com >",
            "senderSMTP": "prvs=691a94fds62a=demisto@demisto.com ",
            "senderIP": "***.***.***.***",
            "status": "delivered",
            "subject": "Attack TCP: SYN Host Sweep (Medium)",
            "verdicts": {  
               "AS": "",
               "AV": "",
               "AT": "pass",
               "PV": ""
            }
         },
         "included": [  
            {  
               "type": "domain",
               "id": 29074,
               "attributes": {  
                  "name": "test.com "
               }
            }
         ],
         "id": "C88B18749AAAAB1B55fc0fa78",
         "type": "trace"
      }
   ],
   "meta": {  
      "total": 85347,
      "copyright": "Copyright 2018 Fireeye Inc",
      "fromLastModifiedOn": {  
         "start": "2018-06-09T10:49:33.329Z",
         "end": "2018-06-09T10:50:59.034Z"
      }
   }
}

fireeye-etp-get-message

Get the data of a specific message.

Base Command

fireeye-etp-get-message

Input

Argument Name	Description	Required
message_id	The message ID.	Required

Context Output

Path	Type	Description
FireEyeETP.Message.acceptedDateTime	unknown	Message accepted date.
FireEyeETP.Message.countryCode	unknown	Sender country code.
FireEyeETP.Message.domain	unknown	Domain.
FireEyeETP.Message.emailSize	unknown	Email size in kb.
FireEyeETP.Message.lastModifiedDateTime	unknown	Message last modified date.
FireEyeETP.Message.recipientHeader	unknown	List of message recipients header (includes the display name of the user).
FireEyeETP.Message.recipients	unknown	List of message recipients.
FireEyeETP.Message.senderHeader	unknown	Message sender header (includes the display name of the user).
FireEyeETP.Message.sender	unknown	Message sender address.
FireEyeETP.Message.senderSMTP	unknown	Message sender SMTP.
FireEyeETP.Message.senderIP	unknown	Message sender IP.
FireEyeETP.Message.status	unknown	Message status.
FireEyeETP.Message.subject	unknown	Message subject.
FireEyeETP.Message.verdicts.AS	unknown	pass/fail verdict for AS.
FireEyeETP.Message.verdicts.AV	unknown	pass/fail verdict for AV.
FireEyeETP.Message.verdicts.AT	unknown	pass/fail verdict for AT.
FireEyeETP.Message.verdicts.PV	unknown	pass/fail verdict for PV.
FireEyeETP.Message.id	unknown	Message ID.

Command example

!fireeye-etp-get-message message_id= C88B18749AAAAB1B55fc0fa78

Raw Output

There is no raw output for this command.

fireeye-etp-list-alerts

Get summary format information about the alerts.

Base Command

fireeye-etp-list-alerts

Input

Argument Name	Description	Required
alert_id	The alert ID.	Optional
date_from	Supports ISO format (e.g., 2025-09-02T06:45:01Z) or natural language (“7 days ago”, “now”).	Optional
date_to	Supports ISO format (e.g., 2025-09-02T06:45:01Z) or natural language (“7 days ago”, “now”).	Optional
domain	List of domain names.	Optional
domain_group	List of domain groups names.	Optional
email_header_subject	List of message subject headers.	Optional
is_read	is_read flag.	Optional
is_retro	is_retro flag.	Optional
malwarename	List of malware names.	Optional
malwarestype	List of malware types.	Optional
md5	List of md5.	Optional
mta_msg_id	List of mta_msg_id.	Optional
traffic_type	Traffic type defaults to inbound. To handle outbound traffic, set the traffic_type parameter to outbound. Possible values are: inbound, outbound.	Optional
verdict	List of verdicts.	Optional
limit	Number of alerts to include in response. Valid range: 1-200.	Optional

Context Output

Path	Type	Description
FireEyeETP.Alerts.domain	unknown	Domain.
FireEyeETP.Alerts.report_id	unknown	Report_id.
FireEyeETP.Alerts.id	unknown	The alert unique ID.
FireEyeETP.Alerts.alert_date	unknown	The alert date.

fireeye-etp-download-alert-case-files

Downloads all case files for the specified alert ID as a ZIP file. You can obtain the alert ID from the Alert Summary response, for example: “id”: “AV7zzRy7kvIwrKcfu0I”.
The downloaded zip is password protected, and the password is “infected”.

Base Command

fireeye-etp-download-alert-case-files

Input

Argument Name	Description	Required
alert_id	The alert ID.	Required

Context Output

There is no context output for this command.

fireeye-etp-list-yara-rulesets

Fetch the list of YARA rulesets and return a list with all the rules.

Base Command

fireeye-etp-list-yara-rulesets

Input

Argument Name	Description	Required
policy_uuid	Universally unique identifier (UUID) of the policy. (Can be found in the URL of the ETP Policies).	Required

Context Output

Path	Type	Description
FireEyeETP.Policy	unknown	The policy id.

fireeye-etp-download-yara-file

Downloads a YARA file.

Base Command

fireeye-etp-download-yara-file

Input

Argument Name	Description	Required
policy_uuid	Universally unique identifier (UUID) of the policy. (Can be found in the URL of the ETP Policies).	Required
ruleset_uuid	Universally unique identifier (UUID) of the ruleset.	Required

Context Output

There is no context output for this command.

fireeye-etp-upload-yara-file

Update or replace the YARA rule file in the existing ruleset.

Base Command

fireeye-etp-upload-yara-file

Input

Argument Name	Description	Required
policy_uuid	Universally unique identifier (UUID) of the policy. (Can be found in the URL of the ETP Policies).	Required
ruleset_uuid	Universally unique identifier (UUID) of the ruleset.	Required
entryID	Entry ID of yara file to upload.	Required

Context Output

There is no context output for this command.

fireeye-etp-get-events-data

Returns all events of the alert by the alert ID.

Base Command

fireeye-etp-get-events-data

Input

Argument Name	Description	Required
message_id	Message ID of alert.	Required

Context Output

Path	Type	Description
FireEyeETP.Events	unknown	The events of the alert.
FireEyeETP.Events.Delivered_msg	unknown	Display if event is delivered successfully or not.
FireEyeETP.Events.Delivered_status	unknown	The status of the message.
FireEyeETP.Events.InternetMessageId	unknown	The internet message ID of the alert.
FireEyeETP.Events.Logs	unknown	The logs of the alert.

fireeye-etp-quarantine-release

Releases the email file present in the quarantine for the given email. Cloud message ID.

Base Command

fireeye-etp-quarantine-release

Input

Argument Name	Description	Required
message_id	The message ID.	Optional

Context Output

There is no context output for this command.

Configuration parameters

server — Server URL (required)
credentials — Client ID (OAuth)
oauth_scopes — OAuth Scopes (OAuth)
token_url — Token URL
api_key — API key
credentials_api_key —
unsecure — Trust any certificate (not secure)
proxy — Use system proxy settings
isFetch — Fetch incidents
fetch_time — First fetch timestamp.
incidentFetchInterval — Incidents Fetch Interval
incidents_per_fetch — Max incidents per fetch
incidentType — Incident type
message_status — Alerts statuses to import

Commands (12)

fireeye-etp-download-alert-artifact Deprecated
Downloads all case files of the alert specified by the alert ID, in a zip file. You can obtain the ID from the Alert Summary response, for example "id": "AV7zzRy7kvIwrKcfu0I". Deprecated. Use the fireeye-etp-download-alert-case-files instead.
fireeye-etp-download-alert-case-files
Downloads all case files of the alert specified by the alert ID, in a zip file. You can obtain the ID from the Alert Summary response, for example "id": "AV7zzRy7kvIwrKcfu0I". The downloaded zip is password protected, and the password is "infected".
fireeye-etp-download-yara-file
Downloads a YARA file.
fireeye-etp-get-alert Deprecated
Detailed information from any particular alert. Alerts more than 90 days old are not available. Deprecated. Use the fireeye-etp-list-alerts instead.
fireeye-etp-get-alerts Deprecated
Get summary format information about the alerts. Deprecated. Use the fireeye-etp-list-alerts instead.
fireeye-etp-get-events-data
Returns all events of the alert by the alert ID.
fireeye-etp-get-message
Get the data of a specific message.
fireeye-etp-list-alerts
Get summary format information about the alerts.
fireeye-etp-list-yara-rulesets
Fetch the list of YARA rulesets and return a list with all the rules.
fireeye-etp-quarantine-release
Releases the email file present in the quarantine for the given email. Cloud message ID.
fireeye-etp-search-messages
Search for messages that include specified message attributes that are accessible in the ETP portal.
fireeye-etp-upload-yara-file
Update or replace the YARA rule file in the existing ruleset.

Source

FireEyeETP.py FireEyeETP_test.py FireEyeETP.yml FireEyeETP_description.md

Download History Raw

commonfields:
  id: FireEye ETP
  version: -1
name: FireEye ETP
display: Trellix Email Security - Cloud
category: Network Security
provider: Trellix
sectionorder:
- Connect
- Collect
description: 'Trellix Email Security - Cloud is a cloud-based platform that protects against advanced email attacks.'
configuration:
- display: 'Server URL'
  name: server
  defaultvalue: https://etp.us.fireeye.com
  type: 0
  required: true
  additionalinfo: "Valid URLs (US, EMEA, USGOV): https://us.etp.trellix.com / https://etp.us.fireeye.com, https://eu.etp.trellix.com / https://etp.eu.fireeye.com, https://etp.us.fireeyegov.com"
  section: Connect
- display: Client ID (OAuth)
  name: credentials
  displaypassword: Client Secret (OAuth)
  type: 9
  additionalinfo: Use the Client ID and Client Secret for the Trellix base URL.
  section: Connect
- display: OAuth Scopes (OAuth)
  name: oauth_scopes
  defaultvalue: etp.conf.ro etp.trce.rw etp.admn.ro etp.domn.ro etp.accs.rw etp.quar.rw etp.domn.rw etp.rprt.rw etp.accs.ro etp.quar.ro etp.alrt.rw etp.rprt.ro etp.conf.rw etp.trce.ro etp.alrt.ro etp.admn.rw
  type: 0
  required: false
  additionalinfo: "Space-separated list of OAuth scopes. Note: Only include scopes that your application's Client ID has already been authorized to use."
  section: Connect
- display: Token URL
  name: token_url
  type: 0
  required: false
  additionalinfo: "The OAuth 2.0 token endpoint base URL override. Leave empty to use the default Trellix IAM endpoint. For Trellix GovCloud tenants, set to https://iam.us.trellix-gov.com."
  section: Connect
  advanced: true
- display: API key
  name: api_key
  defaultvalue: ""
  type: 4
  hidden: true
  required: false
  section: Connect
- displaypassword: API Key
  name: credentials_api_key
  hiddenusername: true
  type: 9
  required: false
  additionalinfo: Use the Api key for the FireEye base URL.
  section: Connect
- display: Trust any certificate (not secure)
  name: unsecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- defaultvalue: 1 minutes
  display: First fetch timestamp.
  name: fetch_time
  type: 0
  section: Collect
  required: false
- display: Incidents Fetch Interval
  defaultvalue: '1'
  name: incidentFetchInterval
  type: 19
  section: Collect
  advanced: true
  required: false
- display: Max incidents per fetch
  name: incidents_per_fetch
  type: 0
  section: Collect
  required: false
  defaultvalue: '59'
  additionalinfo: Input a value between 1 and 59. Values above 59 will be internally capped to avoid exceeding API rate limits.
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Alerts statuses to import
  additionalinfo: All alerts with a status specified here will be imported as incidents.
  name: message_status
  defaultvalue: delivered (retroactive)
  type: 16
  options:
  - accepted
  - deleted
  - delivered
  - delivered (retroactive)
  - dropped
  - dropped oob
  - dropped (oob retroactive)
  - permanent failure
  - processing
  - quarantined
  - rejected
  - temporary failure
  required: false
  section: Collect
script:
  script: '-'
  type: python
  commands:
  - name: fireeye-etp-search-messages
    arguments:
    - name: from_email
      description: 'List of ''From'' email-addresses, max limit of entries is 10. '
    - name: from_email_not_in
      description: 'List of ''From'' email-addresses not to be included, max limit of entries is 10. '
    - name: recipients
      description: List of 'To'/'Cc' email-addresses, max limit of entries is 10.
    - name: recipients_not_in
      description: 'list of ''To''/''Cc'' email-addresses not to be included, max limit of entries is 10. '
    - name: subject
      description: List of strings, max limit of entries is 10.
    - name: from_accepted_date_time
      description: ' The time stamp of the email-accepted date to specify the beginning of the date range to search, e.g. 2017-10-24T10:48:51.000Z . Specify ''to_accepted_date_time''  as well to set the complete date range for the search.'
    - name: to_accepted_date_time
      description: ' The time stamp of the email-accepted date to specify the end of the date range to search, e.g. 2017-10-24T10:48:51.000Z . Specify ''from_accepted_date_time''  as well to set the complete date range for the search.'
    - name: rejection_reason
      description: 'List of ETP rejection reason codes ( "ETP102", "ETP103", "ETP104", "ETP200", "ETP201", "ETP203", "ETP204", "ETP205", "ETP300", "ETP301", "ETP302", "ETP401", "ETP402", "ETP403", "ETP404", "ETP405"). '
    - name: sender_ip
      description: List of sender IP addresses, max limit of entries is 10.
    - name: status
      description: List of email status values( "accepted", "deleted", "delivered", "delivered (retroactive)", "dropped", "dropped oob", "dropped (oob retroactive)", "permanent failure", "processing", "quarantined", "rejected", "temporary failure").
    - name: status_not_in
      description: List of email status values not to include( "accepted", "deleted", "delivered", "delivered (retroactive)", "dropped", "dropped oob", "dropped (oob retroactive)", "permanent failure", "processing", "quarantined", "rejected", "temporary failure").
    - name: last_modified_date_time
      description: 'Date corresponding to last modified date, along with one of the following operators: ">", "<", ">=", "<=".  E.g. use value "<2017-10-24T18:00:00.000Z" to search for messages that were last modified after the specified time stamp.'
    - name: domain
      description: List of domain names.
    - name: has_attachments
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Boolean value to indicate if the message has attachments.
    - name: max_message_size
      description: The default value is 20kb and maximum value is 100kb.
    outputs:
    - contextPath: FireEyeETP.Message.acceptedDateTime
      description: Message accepted date.
    - contextPath: FireEyeETP.Message.countryCode
      description: Sender country code.
    - contextPath: FireEyeETP.Message.domain
      description: Domain.
    - contextPath: FireEyeETP.Message.emailSize
      description: Email size in kb.
    - contextPath: FireEyeETP.Message.lastModifiedDateTime
      description: Message last modified date.
    - contextPath: FireEyeETP.Message.recipientHeader
      description: List of message recipients header (includes the display name of the user).
    - contextPath: FireEyeETP.Message.recipients
      description: List of message recipients.
    - contextPath: FireEyeETP.Message.senderHeader
      description: Message sender header (includes the display name of the user).
    - contextPath: FireEyeETP.Message.sender
      description: Message sender address.
    - contextPath: FireEyeETP.Message.senderSMTP
      description: Message sender SMTP.
    - contextPath: FireEyeETP.Message.senderIP
      description: Message sender IP.
    - contextPath: FireEyeETP.Message.status
      description: Message status.
    - contextPath: FireEyeETP.Message.subject
      description: Message subject.
    - contextPath: FireEyeETP.Message.verdicts.AS
      description: pass/fail verdict for AS.
    - contextPath: FireEyeETP.Message.verdicts.AV
      description: pass/fail verdict for AV.
    - contextPath: FireEyeETP.Message.verdicts.AT
      description: pass/fail verdict for AT.
    - contextPath: FireEyeETP.Message.verdicts.PV
      description: pass/fail verdict for PV.
    - contextPath: FireEyeETP.Message.id
      description: Message ID.
    description: Search for messages that include specified message attributes that are accessible in the ETP portal.
  - name: fireeye-etp-get-message
    arguments:
    - name: message_id
      required: true
      description: The message ID.
    outputs:
    - contextPath: FireEyeETP.Message.acceptedDateTime
      description: Message accepted date.
    - contextPath: FireEyeETP.Message.countryCode
      description: Sender country code.
    - contextPath: FireEyeETP.Message.domain
      description: Domain.
    - contextPath: FireEyeETP.Message.emailSize
      description: Email size in kb.
    - contextPath: FireEyeETP.Message.lastModifiedDateTime
      description: Message last modified date.
    - contextPath: FireEyeETP.Message.recipientHeader
      description: List of message recipients header (includes the display name of the user).
    - contextPath: FireEyeETP.Message.recipients
      description: List of message recipients.
    - contextPath: FireEyeETP.Message.senderHeader
      description: Message sender header (includes the display name of the user).
    - contextPath: FireEyeETP.Message.sender
      description: Message sender address.
    - contextPath: FireEyeETP.Message.senderSMTP
      description: Message sender SMTP.
    - contextPath: FireEyeETP.Message.senderIP
      description: Message sender IP.
    - contextPath: FireEyeETP.Message.status
      description: Message status.
    - contextPath: FireEyeETP.Message.subject
      description: Message subject.
    - contextPath: FireEyeETP.Message.verdicts.AS
      description: pass/fail verdict for AS.
    - contextPath: FireEyeETP.Message.verdicts.AV
      description: pass/fail verdict for AV.
    - contextPath: FireEyeETP.Message.verdicts.AT
      description: pass/fail verdict for AT.
    - contextPath: FireEyeETP.Message.verdicts.PV
      description: pass/fail verdict for PV.
    - contextPath: FireEyeETP.Message.id
      description: Message ID.
    description: Get the data of a specific message.
  - name: fireeye-etp-get-alerts
    arguments:
    - name: legacy_id
      description: Alert ID as shown in ETP Web Portal.
    - name: from_last_modified_on
      description: Datetime in yyy-mm-ddThh:mm:ss.fff format. Default last 90 days.
    - name: etp_message_id
      description: Email message id.
    - name: size
      description: Number of alerts intended in response. Default 20. Valid range 1-100 .
    outputs:
    - contextPath: FireEyeETP.Alerts.meta.read
      description: Email read flag.
    - contextPath: FireEyeETP.Alerts.meta.last_modified_on
      description: Last modified timestamp.
    - contextPath: FireEyeETP.Alerts.meta.legacy_id
      description: Alert ID as shown in ETP Web Portal.
    - contextPath: FireEyeETP.Alerts.alert.product
      description: Product alerted.
    - contextPath: FireEyeETP.Alerts.alert.timestamp
      description: Alert timestamp.
    - contextPath: FireEyeETP.Alerts.alert.malware_md5
      description: md5 of file attached.
    - contextPath: FireEyeETP.Alerts.email.status
      description: The email status.
    - contextPath: FireEyeETP.Alerts.email.source_ip
      description: Email source IP.
    - contextPath: FireEyeETP.Alerts.email.smtp.rcpt_to
      description: Recipient SMTP.
    - contextPath: FireEyeETP.Alerts.email.smtp.mail_from
      description: Sender SMTP.
    - contextPath: FireEyeETP.Alerts.email.etp_message_id
      description: The message ID.
    - contextPath: FireEyeETP.Alerts.email.headers.cc
      description: Email 'cc' recipients.
    - contextPath: FireEyeETP.Alerts.email.headers.to
      description: Email recipients.
    - contextPath: FireEyeETP.Alerts.email.headers.from
      description: Email sender.
    - contextPath: FireEyeETP.Alerts.email.headers.subject
      description: Email subject.
    - contextPath: FireEyeETP.Alerts.email.attachment
      description: File name or URL pointing to file.
    - contextPath: FireEyeETP.Alerts.email.timestamp.accepted
      description: Email accepted time.
    - contextPath: FireEyeETP.Alerts.id
      description: The alert ID.
    description: 'Get summary format information about the alerts.
      Deprecated. Use the fireeye-etp-list-alerts instead.'
    deprecated: true
  - name: fireeye-etp-list-alerts
    arguments:
    - name: alert_id
      description: The alert ID.
    - name: date_from
      description: Supports ISO format (e.g., 2025-09-02T06:45:01Z) or natural language ("7 days ago", "now").
    - name: date_to
      description: Supports ISO format (e.g., 2025-09-02T06:45:01Z) or natural language ("7 days ago", "now").
    - name: domain
      isArray: true
      description: List of domain names.
    - name: domain_group
      isArray: true
      description: List of domain groups names.
    - name: email_header_subject
      isArray: true
      description: List of message subject headers.
    - name: is_read
      type: boolean
      description: is_read flag.
    - name: is_retro
      type: boolean
      description: is_retro flag.
    - name: malwarename
      isArray: true
      description: List of malware names.
    - name: malwarestype
      isArray: true
      description: List of malware types.
    - name: md5
      isArray: true
      description: List of md5.
    - name: mta_msg_id
      isArray: true
      description: List of mta_msg_id.
    - name: traffic_type
      auto: PREDEFINED
      predefined:
      - inbound
      - outbound
      description: 'Traffic type defaults to inbound. To handle outbound traffic, set the traffic_type parameter to outbound. Possible values are: inbound, outbound.'
    - name: verdict
      isArray: true
      description: List of verdicts.
    - name: limit
      description: 'Number of alerts to include in response. Valid range: 1-200.'
    outputs:
    - contextPath: FireEyeETP.Alerts.domain
      description: Domain.
    - contextPath: FireEyeETP.Alerts.report_id
      description: Report_id.
    - contextPath: FireEyeETP.Alerts.id
      description: The alert unique ID.
    - contextPath: FireEyeETP.Alerts.alert_date
      description: The alert date.
    description: 'Get summary format information about the alerts.'
  - name: fireeye-etp-get-alert
    arguments:
    - name: alert_id
      required: true
      description: The alert ID.
    outputs:
    - contextPath: FireEyeETP.Alerts.meta.read
      description: Email read flag.
    - contextPath: FireEyeETP.Alerts.meta.last_modified_on
      description: Last modified timestamp.
    - contextPath: FireEyeETP.Alerts.meta.legacy_id
      description: Alert ID as shown in ETP Web Portal.
    - contextPath: FireEyeETP.Alerts.meta.acknowledged
      description: Acknowledged.
    - contextPath: FireEyeETP.Alerts.alert.product
      description: Product generate the alert.
    - contextPath: FireEyeETP.Alerts.alert.alert_type
      description: Alert type code.
    - contextPath: FireEyeETP.Alerts.alert.severity
      description: Severity code.
    - contextPath: FireEyeETP.Alerts.alert.explanation.analysis
      description: Analysis.
    - contextPath: FireEyeETP.Alerts.alert.explanation.anomaly
      description: Anomaly.
    - contextPath: FireEyeETP.Alerts.alert.explanation.malware_detected.malware.domain
      description: Malware domain.
    - contextPath: FireEyeETP.Alerts.alert.explanation.malware_detected.malware.downloaded_at
      description: Malware downloaded at timestamp.
    - contextPath: FireEyeETP.Alerts.alert.explanation.malware_detected.malware.executed_at
      description: Malware executed at timestamp.
    - contextPath: FireEyeETP.Alerts.alert.explanation.malware_detected.malware.name
      description: Malware name.
    - contextPath: FireEyeETP.Alerts.alert.explanation.malware_detected.malware.sid
      description: Malware SID.
    - contextPath: FireEyeETP.Alerts.alert.explanation.malware_detected.malware.stype
      description: Malware type.
    - contextPath: FireEyeETP.Alerts.alert.explanation.malware_detected.malware.submitted_at
      description: Malware submitted at.
    - contextPath: FireEyeETP.Alerts.alert.explanation.protocol
      description: Protocol.
    - contextPath: FireEyeETP.Alerts.alert.explanation.timestamp
      description: Explanation timestamp.
    - contextPath: FireEyeETP.Alerts.alert.timestamp
      description: Alert timestamp.
    - contextPath: FireEyeETP.Alerts.alert.action
      description: Alert action.
    - contextPath: FireEyeETP.Alerts.alert.name
      description: Alert name.
    - contextPath: FireEyeETP.Alerts.email.status
      description: The email status.
    - contextPath: FireEyeETP.Alerts.email.source_ip
      description: Email source IP.
    - contextPath: FireEyeETP.Alerts.email.smtp.rcpt_to
      description: Recipient SMTP.
    - contextPath: FireEyeETP.Alerts.email.smtp.mail_from
      description: Sender SMTP.
    - contextPath: FireEyeETP.Alerts.email.etp_message_id
      description: FE ETP unique message ID.
    - contextPath: FireEyeETP.Alerts.email.headers.cc
      description: Email cc recipients.
    - contextPath: FireEyeETP.Alerts.email.headers.to
      description: Email recipients.
    - contextPath: FireEyeETP.Alerts.email.headers.from
      description: Email sender.
    - contextPath: FireEyeETP.Alerts.email.headers.subject
      description: Email subject.
    - contextPath: FireEyeETP.Alerts.email.attachment
      description: File name or URL pointing to file.
    - contextPath: FireEyeETP.Alerts.email.timestamp.accepted
      description: Email eccepted time.
    - contextPath: FireEyeETP.Alerts.id
      description: The alert unique ID.
    description: 'Detailed information from any particular alert. Alerts more than 90 days old are not available.
      Deprecated. Use the fireeye-etp-list-alerts instead.'
    deprecated: true
  - name: fireeye-etp-download-alert-artifact
    deprecated: true
    arguments:
    - name: alert_id
      required: true
      description: The alert ID.
    description: 'Downloads all case files of the alert specified by the alert ID, in
      a zip file. You can obtain the ID from the Alert Summary response, for example
      "id": "AV7zzRy7kvIwrKcfu0I".
      Deprecated. Use the fireeye-etp-download-alert-case-files instead.'
  - name: fireeye-etp-download-alert-case-files
    arguments:
    - name: alert_id
      required: true
      description: The alert ID.
    description: 'Downloads all case files of the alert specified by the alert ID, in
      a zip file. You can obtain the ID from the Alert Summary response, for example
      "id": "AV7zzRy7kvIwrKcfu0I". The downloaded zip is password protected, and the password is "infected".'
  - name: fireeye-etp-list-yara-rulesets
    arguments:
    - name: policy_uuid
      required: true
      description: Universally unique identifier (UUID) of the policy. (Can be found
        in the URL of the ETP Policies).
    outputs:
    - contextPath: FireEyeETP.Policy
      description: The policy id.
    description: Fetch the list of YARA rulesets and return a list with all the rules.
  - name: fireeye-etp-download-yara-file
    arguments:
    - name: policy_uuid
      required: true
      description: Universally unique identifier (UUID) of the policy. (Can be found
        in the URL of the ETP Policies).
    - name: ruleset_uuid
      required: true
      description: Universally unique identifier (UUID) of the ruleset.
    description: Downloads a YARA file.
  - name: fireeye-etp-upload-yara-file
    arguments:
    - name: policy_uuid
      required: true
      description: Universally unique identifier (UUID) of the policy. (Can be found
        in the URL of the ETP Policies).
    - name: ruleset_uuid
      required: true
      description: Universally unique identifier (UUID) of the ruleset.
    - name: entryID
      required: true
      description: Entry ID of yara file to upload.
    description: Update or replace the YARA rule file in the existing ruleset.
  - name: fireeye-etp-get-events-data
    arguments:
    - name: message_id
      required: true
      description: Message ID of alert.
    outputs:
    - contextPath: FireEyeETP.Events
      description: The events of the alert.
    - contextPath: FireEyeETP.Events.Delivered_msg
      description: Display if event is delivered successfully or not.
    - contextPath: FireEyeETP.Events.Delivered_status
      description: The status of the message.
    - contextPath: FireEyeETP.Events.InternetMessageId
      description: The internet message ID of the alert.
    - contextPath: FireEyeETP.Events.Logs
      description: The logs of the alert.
    description: Returns all events of the alert by the alert ID.
  - name: fireeye-etp-quarantine-release
    arguments:
    - name: message_id
      description: The message ID.
    description: Releases the email file present in the quarantine for the given email.
      Cloud message ID.
  isfetch: true
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10404775
tests:
- No Test
defaultclassifier: Trellix Incident Classifier
defaultmapperin: Trellix Mapper
fromversion: 5.0.0

FireEye ETP

Details

README

Trellix Email Security - Cloud

Overview

Use Cases

Authentication and Authorization

Configuring API Keys

Alerts APIs

Trace APIs

Quarantine APIs

Authentication Prerequisites

Dual Authentication Methods

Authentication Setup (Choose One)

Configure Trellix Email Security - Cloud in Cortex

Fetched Incidents Data

Commands

fireeye-etp-search-messages

Base Command

Input

Context Output

Command example 1

Command example 2

Raw Output

fireeye-etp-get-message

Base Command

Input

Context Output

Command example

Raw Output

fireeye-etp-list-alerts

Base Command

Input

Context Output

fireeye-etp-download-alert-case-files

Base Command

Input

Context Output

fireeye-etp-list-yara-rulesets

Base Command

Input

Context Output

fireeye-etp-download-yara-file

Base Command

Input

Context Output

fireeye-etp-upload-yara-file

Base Command

Input

Context Output

fireeye-etp-get-events-data

Base Command

Input

Context Output

fireeye-etp-quarantine-release

Base Command

Input

Context Output

Configuration parameters

Commands (12)

Source