Details
| ID | Ironscales |
|---|---|
| Provider | PSG Equity |
| Category | |
| From Version | 6.0.0 |
| Docker Image | demisto/python3:3.12.13.8160132 |
| Supported Modules | Agentix XSIAM |
README
IRONSCALES, a self-learning email security platform integration
Configure Ironscales in Cortex
| Parameter | Required |
|---|---|
| Server URL (e.g. https://appapi.ironscales.com) | True |
| API Key | True |
| Company Id | True |
| Scopes (e.g. “company.all”) | True |
| Trust any certificate (not secure) | False |
| Use system proxy settings | False |
| Fetch incidents | False |
| Incident type | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
ironscales-get-incident
Get incident data by ID.
Base Command
ironscales-get-incident
Input
| Argument Name | Description | Required |
|---|---|---|
| incident_id | Incident ID. | Required |
| company_id | Company ID. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Ironscales.Incident.incident_id | string | Incident id. |
| Ironscales.Incident.attachments | string | Email attachments |
| Ironscales.Incident.banner_displayed | string | Email banners. |
| Ironscales.Incident.classification | string | Current classification(FP,Phishing,Spam,Report). |
| Ironscales.Incident.company_id | string | Company ID. |
| Ironscales.Incident.company_name | string | Company name. |
| Ironscales.Incident.federation | string | Federation data. |
| Ironscales.Incident.first_reported_by | string | First reporter. |
| Ironscales.Incident.first_reported_date | string | Reported date. |
| Ironscales.Incident.links | string | Links. |
| Ironscales.Incident.mail_server | string | Mail server. |
| Ironscales.Incident.reply_to | string | Reply to. |
| Ironscales.Incident.reports | string | Reports data. |
| Ironscales.Incident.sender_email | string | Sender email. |
| Ironscales.Incident.sender_is_internal | boolean | |
| Ironscales.Incident.sender_reputation | string | Sender reputation. |
| Ironscales.Incident.spf_result | unknown | |
| Ironscales.Incident.themis_proba | number | Themis proba. |
| Ironscales.Incident.themis_verdict | string | Themis verdict. |
ironscales-classify-incident
Classify incident by ID.
Base Command
ironscales-classify-incident
Input
| Argument Name | Description | Required |
|---|---|---|
| incident_id | Incident ID. | Optional |
| classification | Classification. Possible values are: Attack, Spam, False Positive. | Optional |
| prev_classification | Current incident classification. Possible values are: Attack, Spam, False Positive, Report. | Optional |
| Your Email Address. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Ironscales.classifyincident | boolean | Classification succeeded |
ironscales-get-open-incidents
Get open incident ids.
Base Command
ironscales-get-open-incidents
Input
| Argument Name | Description | Required |
| — | — | — |
Context Output
| Path | Type | Description |
|---|---|---|
| Ironscales.OpenIncidents.incident_ids | unknown | List of open incidents IDs. |
Configuration parameters
url— Server URL (e.g. https://appapi.ironscales.com) (required)apikey— API Key (required)company_id— Company Id (required)scopes— Scopes (e.g. "company.all") (required)max_fetch— Maximum number of incidents per fetchfirst_fetch— First fetchinsecure— Trust any certificate (not secure)proxy— Use system proxy settingsisFetch— Fetch incidentsincidentType— Incident typeincidentFetchInterval— Incidents Fetch Interval
Commands (3)
-
ironscales-classify-incidentClassify incident by ID.
-
ironscales-get-incidentGet incident data by ID.
-
ironscales-get-open-incidentsGet open incident ids.
import json from Ironscales import fetch_incidents, get_open_incidents_command def util_load_json(path): with open(path, encoding="utf-8") as f: return json.loads(f.read()) def test_ironscales_fetch_incident(mocker): incidents_mocked_data = util_load_json("test_data/test_get_open_incidents.json") last_run = {"data": [0]} mocked_client = mocker.Mock() mocked_client.get_open_incidents.return_value = {"incident_ids": [0, 1]} mocked_client.get_incident.return_value = incidents_mocked_data result = fetch_incidents(mocked_client, last_run) result_to_compare = [ { "name": "Ironscales incident: IS-1", "occurred": "2021-07-06T06:34:00.070Z", "rawJSON": json.dumps(incidents_mocked_data), } ] assert result == ([0, 1], result_to_compare) def test_ironscales_get_open_incidents_empty(mocker): mocked_client = mocker.Mock() mocked_client.get_open_incidents.return_value = {"incident_ids": []} result = get_open_incidents_command(mocked_client, {}) assert result == "No open incidents were found"