Ironscales

Details

ID	`Ironscales`
Provider	PSG Equity
Category	Email
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.8160132`
Supported Modules	Agentix XSIAM

README

IRONSCALES, a self-learning email security platform integration

Configure Ironscales in Cortex

Parameter	Required
Server URL (e.g. https://appapi.ironscales.com)	True
API Key	True
Company Id	True
Scopes (e.g. “company.all”)	True
Trust any certificate (not secure)	False
Use system proxy settings	False
Fetch incidents	False
Incident type	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ironscales-get-incident

Get incident data by ID.

Base Command

ironscales-get-incident

Input

Argument Name	Description	Required
incident_id	Incident ID.	Required
company_id	Company ID.	Optional

Context Output

Path	Type	Description
Ironscales.Incident.incident_id	string	Incident id.
Ironscales.Incident.attachments	string	Email attachments
Ironscales.Incident.banner_displayed	string	Email banners.
Ironscales.Incident.classification	string	Current classification(FP,Phishing,Spam,Report).
Ironscales.Incident.company_id	string	Company ID.
Ironscales.Incident.company_name	string	Company name.
Ironscales.Incident.federation	string	Federation data.
Ironscales.Incident.first_reported_by	string	First reporter.
Ironscales.Incident.first_reported_date	string	Reported date.
Ironscales.Incident.links	string	Links.
Ironscales.Incident.mail_server	string	Mail server.
Ironscales.Incident.reply_to	string	Reply to.
Ironscales.Incident.reports	string	Reports data.
Ironscales.Incident.sender_email	string	Sender email.
Ironscales.Incident.sender_is_internal	boolean
Ironscales.Incident.sender_reputation	string	Sender reputation.
Ironscales.Incident.spf_result	unknown
Ironscales.Incident.themis_proba	number	Themis proba.
Ironscales.Incident.themis_verdict	string	Themis verdict.

ironscales-classify-incident

Classify incident by ID.

Base Command

ironscales-classify-incident

Input

Argument Name	Description	Required
incident_id	Incident ID.	Optional
classification	Classification. Possible values are: Attack, Spam, False Positive.	Optional
prev_classification	Current incident classification. Possible values are: Attack, Spam, False Positive, Report.	Optional
email	Your Email Address.	Optional

Context Output

Path	Type	Description
Ironscales.classifyincident	boolean	Classification succeeded

ironscales-get-open-incidents

Get open incident ids.

Base Command

ironscales-get-open-incidents

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path	Type	Description
Ironscales.OpenIncidents.incident_ids	unknown	List of open incidents IDs.

Configuration parameters

url — Server URL (e.g. https://appapi.ironscales.com) (required)
apikey — API Key (required)
company_id — Company Id (required)
scopes — Scopes (e.g. "company.all") (required)
max_fetch — Maximum number of incidents per fetch
first_fetch — First fetch
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval

Commands (3)

ironscales-classify-incident
Classify incident by ID.
ironscales-get-incident
Get incident data by ID.
ironscales-get-open-incidents
Get open incident ids.

Source

Ironscales.py Ironscales_test.py Ironscales.yml Ironscales_description.md

Download History Raw

category: Email
provider: PSG Equity
sectionorder:
- Connect
- Collect
commonfields:
  id: Ironscales
  version: -1
configuration:
- defaultvalue: https://appapi.ironscales.com
  display: Server URL (e.g. https://appapi.ironscales.com)
  name: url
  required: true
  type: 0
  section: Connect
- display: API Key
  name: apikey
  required: true
  type: 4
  section: Connect
- display: Company Id
  name: company_id
  required: true
  type: 0
  section: Connect
- display: Scopes (e.g. "company.all")
  name: scopes
  required: true
  type: 0
  section: Connect
- defaultvalue: '50'
  display: Maximum number of incidents per fetch
  name: max_fetch
  type: 0
  section: Collect
  required: false
- display: First fetch
  name: first_fetch
  type: 0
  section: Collect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: Incident type
  defaultvalue: Ironscales
  name: incidentType
  type: 13
  section: Connect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
description: IRONSCALES, a self-learning email security platform integration.
display: Ironscales
name: Ironscales
defaultmapperin: Ironscales - Incoming Mapper
script:
  commands:
  - arguments:
    - description: Incident ID.
      name: incident_id
      required: true
    - description: Company Id - If empty, the Company Id from the instance configuration is used.
      name: company_id
    description: Get incident data by ID.
    name: ironscales-get-incident
    outputs:
    - contextPath: Ironscales.Incident.incident_id
      description: Incident id.
      type: string
    - contextPath: Ironscales.Incident.attachments
      description: Email attachments.
      type: string
    - contextPath: Ironscales.Incident.banner_displayed
      description: Email banners.
      type: string
    - contextPath: Ironscales.Incident.classification
      description: Current classification(FP,Phishing,Spam,Report).
      type: string
    - contextPath: Ironscales.Incident.company_id
      description: Company ID.
      type: string
    - contextPath: Ironscales.Incident.company_name
      description: Company name.
      type: string
    - contextPath: Ironscales.Incident.federation
      description: Federation data.
      type: string
    - contextPath: Ironscales.Incident.first_reported_by
      description: First reporter.
      type: string
    - contextPath: Ironscales.Incident.first_reported_date
      description: Reported date.
      type: string
    - contextPath: Ironscales.Incident.links
      description: Links.
      type: string
    - contextPath: Ironscales.Incident.mail_server
      description: Mail server.
      type: string
    - contextPath: Ironscales.Incident.reply_to
      description: Reply to.
      type: string
    - contextPath: Ironscales.Incident.reports
      description: Reports data.
      type: string
    - contextPath: Ironscales.Incident.sender_email
      description: Sender email.
      type: string
    - contextPath: Ironscales.Incident.sender_is_internal
      description: True is the email sender is internal, False otherwise.
      type: boolean
    - contextPath: Ironscales.Incident.sender_reputation
      description: Sender reputation.
      type: string
    - contextPath: Ironscales.Incident.spf_result
      description: spf results.
      type: unknown
    - contextPath: Ironscales.Incident.themis_proba
      description: Themis proba.
      type: number
    - contextPath: Ironscales.Incident.themis_verdict
      description: Themis verdict.
      type: string
  - arguments:
    - description: Incident ID.
      name: incident_id
      required: true
    - auto: PREDEFINED
      description: Classification.
      name: classification
      required: true
      predefined:
      - Attack
      - Spam
      - False Positive
    - auto: PREDEFINED
      description: Current incident classification.
      name: prev_classification
      required: true
      predefined:
      - Attack
      - Spam
      - False Positive
      - Report
    - description: Your Email Address.
      name: email
      required: true
    description: Classify incident by ID.
    name: ironscales-classify-incident
    outputs:
    - contextPath: Ironscales.classifyincident
      description: Classification succeeded.
      type: boolean
  - arguments: []
    description: Get open incident ids.
    name: ironscales-get-open-incidents
    outputs:
    - contextPath: Ironscales.OpenIncidents.incident_ids
      description: List of open incidents IDs.
  dockerimage: demisto/python3:3.12.13.8160132
  isFetchSamples: true
  isfetch: true
  script: ''
  subtype: python3
  type: python
fromversion: 6.0.0
tests:
- No tests (auto formatted)