GreatHorn

The only cloud-native security platform that stops targeted social engineering and phishing attacks on cloud email platforms like Office 365 and G Suite.
This integration was integrated and tested with version 2.0 of GreatHorn

Configure GreatHorn in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

gh-get-message

Return message details for the specified event

Base Command

gh-get-message

Input

Context Output

Command Example

!gh-get-message id="12345" includeheaders="true"

Context Example

{}

Human Readable Output

GreatHorn event not found

gh-search-message

Search for message based on filtering input

Base Command

gh-search-message

Input

Context Output

Command Example

!gh-search-message filters="[{\"targets\": [\"penguin@scuftysails.com\"], \"origin\": [\"action@ifttt.com\"]}]"

Context Example

{
    "GreatHorn": {
        "Message": {
            "Message": [],
            "SearchCount": 0
        }
    }
}

Human Readable Output

Events

No entries.

gh-remediate-message

Perform the specified remediation action on message

Base Command

gh-remediate-message

Input

Context Output

Command Example

!gh-remediate-message action="banner" message="This email may be a phishing attempt" eventId="20128"

Context Example

{
    "GreatHorn": {
        "Remediation": {
            "action": "banner",
            "eventId": "20128",
            "reason": "completed",
            "success": true
        }
    }
}

Human Readable Output

Remediate action banner applied successfully to message 20128

gh-revert-remediate-message

Revert the specified remediation action on the given message

Base Command

gh-revert-remediate-message

Input

Context Output

Command Example

!gh-revert-remediate-message action="banner" eventId="20128"

Context Example

{
    "GreatHorn": {
        "Remediation": {
            "action": "banner",
            "eventId": "20128",
            "reason": "completed",
            "success": true
        }
    }
}

Human Readable Output

Revert action banner applied successfully to message 20128

gh-get-policy

Retrieve details about the policy specified

Base Command

gh-get-policy

Input

Context Output

Command Example

!gh-get-policy policyid="16567"

Context Example

{
    "GreatHorn": {
        "Policy": {
            "actions": [
                {
                    "addresses": [
                        ""
                    ],
                    "quarantineNotification": false,
                    "releaseNotification": false,
                    "type": "quarantine"
                }
            ],
            "config": [
                "or",
                [
                    "and",
                    {
                        "opt": "from",
                        "type": "regex",
                        "values": [
                            "asdf2@asdf2.com",
                            "asdf@asdf.com"
                        ]
                    }
                ]
            ],
            "description": "",
            "enabled": true,
            "id": 16567,
            "name": "Penalty box policy"
        }
    }
}

Human Readable Output

Policy

ID	Name	Enabled	Description	Actions
16567	Penalty box policy	true		quarantine

gh-set-policy

Retrieve details about the policy specified.

Base Command

gh-set-policy

Input

Context Output

Command Example

!gh-set-policy policyid="16567" updatemethod="patch" policyjson="{\"config\": [\"or\", [\"and\", {\"opt\": \"from\", \"values\": [\"asdf@asdf.com\",\"asdf2@asdf2.com\"], \"type\": \"regex\"}]]}"

Context Example

{
    "GreatHorn": {
        "Policy": {
            "id": "16567",
            "success": true
        }
    }
}

Human Readable Output

Update applied successfully to policy 16567