Ironscales Event Collector

Details

ID	`Ironscales Event Collector`
Provider	Ironscales
Category	Email
From Version	8.2.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	XSIAM

README

Use this integration to fetch email security incidents from Ironscales as XSIAM events.

Configure Ironscales Event Collector in Cortex

Parameter	Description	Required
Server URL (e.g., https://appapi.ironscales.com)		True
API Key		True
Company ID		True
Scopes (e.g., “company.all”)		True
Maximum number of events per fetch		False
First fetch		False
Collect all events	Fetch all events instead of only open events.	False
Fetch mailbox mitigation details	Whether to fetch the affected mailbox mitigation details as part of the event data.	False
Trust any certificate (not secure)		False
Use system proxy settings		False

Scopes

partner.all
company.all
partner.company.view
company.view

Collect All Events

Checking this box will fetch all events, not just open ones.
Note: Currently, ATO and MTS event types are not supported.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ironscales-get-events

Gets events from Ironscales. This command is intended for development and debugging purposes and is to be used with caution as it may create duplicate events, exceed API request rate limits, and disrupt the fetch events mechanism.

Base Command

ironscales-get-events

Input

Argument Name	Description	Required
limit	The number of events to return. Default is 10.	Optional
since_time	The start time by which to filter events. Date format will be the same as in the first_fetch parameter. Default is 3 days.	Optional
mailbox_enrichment	Set this argument to True in order to include the affected mailboxes mitigation details in the event data. Possible values are: true, false. Default is false.	Optional
should_push_events	Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: true, false. Default is false.	Required

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (e.g., https://appapi.ironscales.com) (required)
apikey — (required)
company_id — Company ID (required)
scopes — Scopes (e.g., "company.all") (required)
max_fetch — Maximum number of events per fetch
first_fetch — First fetch
collect_all_events — Collect all events
mailbox_enrichment — Fetch mailbox mitigation details
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

ironscales-get-events
Gets events from Ironscales. This command is intended for development and debugging purposes and is to be used with caution as it may create duplicate events, exceed API request rate limits, and disrupt the fetch events mechanism.

Source

IronscalesEventCollector.py IronscalesEventCollector_test.py IronscalesEventCollector.yml IronscalesEventCollector_description.md

Download History Raw

display: Ironscales Event Collector
name: Ironscales Event Collector
category: Email
provider: Ironscales
sectionorder:
- Connect
- Collect
commonfields:
  id: Ironscales Event Collector
  version: -1
configuration:
- defaultvalue: https://appapi.ironscales.com
  display: Server URL (e.g., https://appapi.ironscales.com)
  name: url
  required: true
  type: 0
  section: Connect
- displaypassword: API Key
  name: apikey
  required: true
  hiddenusername: true
  type: 9
  section: Connect
- display: Company ID
  name: company_id
  required: true
  type: 0
  section: Connect
- display: Scopes (e.g., "company.all")
  name: scopes
  required: true
  type: 0
  section: Connect
- defaultvalue: '1000'
  display: Maximum number of events per fetch
  name: max_fetch
  type: 0
  section: Collect
  required: false
- defaultvalue: 3 days
  display: First fetch
  name: first_fetch
  type: 0
  section: Collect
  required: false
- display: Collect all events
  name: collect_all_events
  type: 8
  section: Collect
  required: false
  additionalinfo: Fetch all events instead of only open events.
- display: Fetch mailbox mitigation details
  name: mailbox_enrichment
  defaultvalue: 'false'
  type: 8
  section: Collect
  required: false
  additionalinfo: Whether to fetch the affected mailbox mitigation details as part of the event data.
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
description: Use this integration to fetch email security incidents from Ironscales as XSIAM events.
script:
  commands:
  - arguments:
    - description: The number of events to return.
      name: limit
      defaultValue: 10
    - defaultValue: 3 days
      description: The start time by which to filter events. Date format will be the same as in the first_fetch parameter.
      name: since_time
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Set this argument to True in order to include the affected mailboxes mitigation details in the event data.
      name: mailbox_enrichment
      predefined:
      - 'true'
      - 'false'
      required: false
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Set this argument to True in order to create events, otherwise the command will only display them.
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
      required: true
    description: Gets events from Ironscales. This command is intended for development and debugging purposes and is to be used with caution as it may create duplicate events, exceed API request rate limits, and disrupt the fetch events mechanism.
    name: ironscales-get-events
  dockerimage: demisto/python3:3.12.13.10116658
  isfetchevents: true
  script: ''
  subtype: python3
  type: python
fromversion: 8.2.0
marketplaces:
- marketplacev2
- platform
tests:
- No tests (auto formatted)
supportedModules:
- xsiam