FireEye Email Security

FireEye Email Security (EX) series protects against breaches caused by advanced email attacks.

Configuration parameters

url — Your server URL (required)
credentials — Username (required)
isFetch — Fetch incidents
max_fetch — Max incidents to fetch
first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
incidentType — Incident type
info_level — Info level for fetched alerts
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

fireeye-ex-create-allowedlist
Creates allowed sender domain.
fireeye-ex-create-blockedlist
Creates the blocked sender domain.
fireeye-ex-delete-allowedlist
Deletes the allowed sender domain.
fireeye-ex-delete-blockedlist
Deletes the blocked sender domain.
fireeye-ex-delete-quarantined-emails
Deletes quarantined emails. This is not available when Email Security is in Drop mode.
fireeye-ex-download-quarantined-emails
Download quarantined emails.
fireeye-ex-get-alert-details
Searches and retrieves the details of a single alert.
fireeye-ex-get-alerts
Searches and retrieves FireEye EX alerts based on several filters.
fireeye-ex-get-artifacts-by-uuid
Downloads malware artifacts data for the specified UUID as a zip file.
fireeye-ex-get-artifacts-metadata-by-uuid
Gets artifacts metadata for the specified UUID.
fireeye-ex-get-quarantined-emails
Searches and retrieves quarantined emails.
fireeye-ex-get-reports
Returns reports on selected alerts.
fireeye-ex-list-allowedlist
Lists the allowed sender domain by type.
fireeye-ex-list-blockedlist
Lists the blocked sender domain by type.
fireeye-ex-release-quarantined-emails
Releases and deletes quarantined emails. This is not available when Email Security is in Drop mode.
fireeye-ex-update-allowedlist
Updates the allowed sender domain.
fireeye-ex-update-blockedlist
Updates the blocked sender domain.