Trellix Email Security - Cloud

Overview

Use the Trellix Email Security - Cloud integration to import messages as incidents, search for messages with specific attributes, and retrieve alert data.

Use Cases

• Search for messages using specific message attributes as indicators.
• Import messages as Cortex incidents/issues, using the message status as indicator.

Authentication and Authorization

Configuring API Keys

If the IAM domain you use to access the Trellix UI ends in fireeye.com, follow these steps to configure API keys:

1. Log in to the Email Security — Cloud Web Portal or IAM console.
2. Click My Settings in the top navigation bar.
3. Click the API Keys tab in the IAM console.
4. Click Create API Key.
5. On the Manage API Key page, specify the following:

• API key name
• Expiration time for the API key.
  The expiration time should be set as "100d" for 100 days or "1y" for 1 year, for example.
• Products
  Select both Email Threat Prevention and Identity Access Management.

1. Select all required entitlements. For any API access, the following entitlements are mandatory:

   • iam.users.browse
   • iam.orgs.self.read

   Alerts APIs

   For accessing alerts APIs, the following additional entitlements are required:

   • etp.alerts.read

   Trace APIs

   For accessing trace APIs, the following additional entitlements are required:

   • etp.email_trace.read

   Quarantine APIs

   For accessing quarantine APIs, the following additional entitlements are required:

   • etp.quarantine.update
   • etp.quar

Authentication Prerequisites

To ensure a successful connection, select the authentication method that matches the Server URL (Instance URL) you are configuring.

Dual Authentication Methods

We support two different authentication methods depending on the endpoint domain:

Authentication Setup (Choose One)

You must configure only one of the two authentication approaches below based on your Server URL domain.

• 1. API Key Method (For fireeye.com URLs):
  • Configure an API key on the ETP Web portal. Select the product as both Email Threat Prevention and Identity Access Management. Select all entitlements.
• 2. OAuth 2.0 Method (For trellix.com URLs):
  • When creating the Client ID and Client Secret, ensure the corresponding user/role has explicit permission to access the API.
  • Note: If API access permissions are not properly set for the user/role, the authentication attempt will fail with a 400 Client Error: Bad Request even if the Client ID and Secret are correct.
• Contact Trellix Email Security - Cloud Technical Support to let them know the IP address of your Cortex Server and the URL you are accessing, e.g. https://etp.us.fireeye.com. Trellix will add these details to their Firewall rules so that the bidirectional traffic can be allowed between Cortex and Trellix Email Security - Cloud.

Configure Trellix Email Security - Cloud in Cortex

Fetched Incidents Data

To use Fetch incidents:

1. Configure a new instance.
2. Navigate to instance settings, and specify the message status (using the valid values).
3. Select Fetch incidents option.

The integration will fetch alerts as incidents. It is possible to filter alerts using the specified message status.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

fireeye-etp-search-messages

Search for messages using specific message attributes as indicators.

Search for messages that include specified message attributes that are accessible in the ETP portal.

Base Command

fireeye-etp-search-messages

Input

Context Output

Command example 1

!fireeye-etp-search-messages to_accepted_date_time=2017-10-24T10:00:00.000Z from_accepted_date_time=2017-10-24T10:30:00.000Z

Command example 2

!fireeye-etp-search-messages from_email=diana@corp.com,charles@corp.com

Raw Output

{  
   "data": [  
      {  
         "attributes": {  
            "acceptedDateTime": "2018-06-09T10:49:32.000Z",
            "countryCode": "US",
            "domain": "test.com",
            "downStreamMsgID": "250 2.0.0 OK 100041373 d14-v6si970000qtb.70 - gsmtp",
            "emailSize": 9.89,
            "lastModifiedDateTime": "2018-06-09T10:49:33.329Z",
            "recipientHeader": [  
               "Security Operations Center <SOC@corp.com>"
            ],
            "recipientSMTP": [  
               "jason@demisto.com"
            ],
            "senderHeader": "\"soc@demisto.com\" <bot@demisto.com >",
            "senderSMTP": "prvs=691a94fds62a=demisto@demisto.com ",
            "senderIP": "***.***.***.***",
            "status": "delivered",
            "subject": "Attack TCP: SYN Host Sweep (Medium)",
            "verdicts": {  
               "AS": "",
               "AV": "",
               "AT": "pass",
               "PV": ""
            }
         },
         "included": [  
            {  
               "type": "domain",
               "id": 29074,
               "attributes": {  
                  "name": "test.com "
               }
            }
         ],
         "id": "C88B18749AAAAB1B55fc0fa78",
         "type": "trace"
      }
   ],
   "meta": {  
      "total": 85347,
      "copyright": "Copyright 2018 Fireeye Inc",
      "fromLastModifiedOn": {  
         "start": "2018-06-09T10:49:33.329Z",
         "end": "2018-06-09T10:50:59.034Z"
      }
   }
}

fireeye-etp-get-message

Get the data of a specific message.

Base Command

fireeye-etp-get-message

Input

Context Output

Command example

!fireeye-etp-get-message message_id= C88B18749AAAAB1B55fc0fa78

Raw Output

There is no raw output for this command.

fireeye-etp-list-alerts

Get summary format information about the alerts.

Base Command

fireeye-etp-list-alerts

Input

Context Output

fireeye-etp-download-alert-case-files

Downloads all case files for the specified alert ID as a ZIP file. You can obtain the alert ID from the Alert Summary response, for example: “id”: “AV7zzRy7kvIwrKcfu0I”.
The downloaded zip is password protected, and the password is “infected”.

Base Command

fireeye-etp-download-alert-case-files

Input

Context Output

There is no context output for this command.

fireeye-etp-list-yara-rulesets

Fetch the list of YARA rulesets and return a list with all the rules.

Base Command

fireeye-etp-list-yara-rulesets

Input

Context Output

fireeye-etp-download-yara-file

Downloads a YARA file.

Base Command

fireeye-etp-download-yara-file

Input

Context Output

There is no context output for this command.

fireeye-etp-upload-yara-file

Update or replace the YARA rule file in the existing ruleset.

Base Command

fireeye-etp-upload-yara-file

Input

Context Output

There is no context output for this command.

fireeye-etp-get-events-data

Returns all events of the alert by the alert ID.

Base Command

fireeye-etp-get-events-data

Input

Context Output

fireeye-etp-quarantine-release

Releases the email file present in the quarantine for the given email. Cloud message ID.

Base Command

fireeye-etp-quarantine-release

Input

Context Output

There is no context output for this command.