Menlo Security

Collects web, email, audit, SMTP, attachment, DLP, HEAT, firewall, bandwidth, auth flows, and Menlo Security Client logs from the Menlo Security Isolation Platform (MSIP).

Network Security · Menlo Security

Details

ID	`Menlo Security`
Provider	Menlo Security
Category	Network Security
From Version	8.2.0
Docker Image	`demisto/fastapi:0.125.0.10158186`
Supported Modules	XSIAM

README

Menlo Security

The cloud-based Menlo Security Isolation Platform (MSIP) eliminates the possibility of malware reaching user devices via compromised or malicious Web sites, Email or documents.

This integration collects logs from the MSIP Logging API and sends them to Cortex.

Configure Menlo Security on Cortex

Navigate to Settings > Configurations > Data Collection > Automations & Feed Integrations.
Search for Menlo Security.
Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
Server URL	The Menlo Security logging API base URL. Default: `https://logs.menlosecurity.com`	True
Auth Token	The API authentication token with Log Export API permission.	True
Token type	Select `Admin Token` (default) for tokens generated from the Admin UI (uses the v2 API). Select `Token` for legacy tokens (uses the v1 API).	True
Log types	The log types to collect. Select one or more from: `web`, `safemail`, `audit`, `auth_flows`, `smtp`, `attachment`, `bandwidth`, `heat`, `firewall`, `dlp`, `ms_client_logs`. All log types are selected by default. Note: `heat` replaces the deprecated `isoc` log type.	True
Fetch events	Enable event fetching.	False
Maximum number of events per fetch per log type	The maximum number of events to fetch per log type per fetch cycle.	False
Trust any certificate (not secure)	Disable SSL certificate verification.	False
Use system proxy settings	Use the system proxy for API requests.	False

Click Test to validate the connection.

Commands

menlo-security-get-events

Manually fetch events from the Menlo Security Isolation Platform.

Base Command

menlo-security-get-events

Input

Argument Name	Description	Required
start_time	Start time for the event query (e.g., `1 hour`, `2024-01-01T00:00:00Z`). Default: `1 hour`.	Optional
end_time	End time for the event query (e.g., `now`, `2024-01-02T00:00:00Z`). Default: `now`.	Optional
log_types	Comma-separated list of log types to fetch (e.g., `web,audit`). Defaults to all configured log types.	Optional
limit	Maximum number of events to return per log type. Default: `100`.	Optional
should_push_events	Set to `True` to push the fetched events to XSIAM. Set to `False` to only display them.	Required

Context Output

There is no context output for this command.

Notes

The API token must have the Log Export API permission.
For tenants with extremely large event volumes, configure a separate integration instance per log type. Splitting the load across instances allows each instance to fetch its log type independently and in parallel, improving overall throughput.

Configuration parameters

url — Server URL (required)
credentials — (required)
token_type — Token type (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
log_types — Log types (required)
isFetchEvents — Fetch events
max_events_per_fetch_per_type — Maximum number of events per fetch per log type

Commands (1)

menlo-security-get-events
Manually fetch events from the Menlo Security Isolation Platform. Use this command to test the integration or retrieve events on demand.

Source

MenloSecurity.py MenloSecurity_test.py MenloSecurity.yml MenloSecurity_description.md

Download History Raw

commonfields:
  id: Menlo Security
  version: -1
name: Menlo Security
display: Menlo Security
category: Network Security
provider: Menlo Security
sectionorder:
- Connect
- Collect
description: Collects web, email, audit, SMTP, attachment, DLP, HEAT, firewall, bandwidth, auth flows, and Menlo Security Client logs from the Menlo Security Isolation Platform (MSIP).
configuration:
- display: Server URL
  name: url
  type: 0
  defaultvalue: https://logs.menlosecurity.com
  required: true
  section: Connect
- displaypassword: Auth Token
  name: credentials
  type: 9
  required: true
  hiddenusername: true
  section: Connect
- display: Token type
  name: token_type
  type: 15
  required: true
  defaultvalue: Admin Token
  options:
  - Admin Token
  - Token
  section: Connect
  additionalinfo: 'Select "Admin Token" for tokens generated from the Admin UI (recommended, uses the v2 API). Select "Token" for legacy CSV-based tokens (uses the v1 API).'
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Log types
  name: log_types
  type: 16
  required: true
  defaultvalue: web,safemail,audit,auth_flows,smtp,attachment,bandwidth,heat,firewall,dlp,ms_client_logs
  options:
  - web
  - safemail
  - audit
  - auth_flows
  - smtp
  - attachment
  - bandwidth
  - heat
  - firewall
  - dlp
  - ms_client_logs
  section: Collect
  additionalinfo: 'Select the log types to collect. Note: "heat" replaces the deprecated "isoc" log type.'
- display: Fetch events
  name: isFetchEvents
  type: 8
  required: false
  section: Collect
- display: Maximum number of events per fetch per log type
  name: max_events_per_fetch_per_type
  type: 0
  defaultvalue: "10000"
  required: false
  section: Collect
  additionalinfo: "The maximum number of events to fetch per log type per fetch cycle."
script:
  script: ""
  type: python
  commands:
  - name: menlo-security-get-events
    description: Manually fetch events from the Menlo Security Isolation Platform. Use this command to test the integration or retrieve events on demand.
    arguments:
    - name: start_time
      description: Start time for the event query (e.g. "1 hour", "2021-01-01T00:00:00Z"). Defaults to 1 hour ago.
      required: false
      defaultValue: "1 hour"
    - name: end_time
      description: End time for the event query (e.g. "now", "2021-01-02T00:00:00Z"). Defaults to now.
      required: false
      defaultValue: "now"
    - name: log_types
      description: 'Comma-separated list of log types to fetch. Options: web,safemail,audit,auth_flows,smtp,attachment,bandwidth,heat,firewall,dlp, ms_client_logs. Defaults to all configured log types.'
      required: false
      isArray: true
    - name: limit
      description: Maximum number of events to return per log type.
      required: false
      defaultValue: "100"
    - name: should_push_events
      description: Set to True to push the fetched events to XSIAM. Set to False to only display them.
      required: true
      defaultValue: "False"
      auto: PREDEFINED
      predefined:
      - "True"
      - "False"
  dockerimage: demisto/fastapi:0.125.0.10158186
  isfetchevents: true
  subtype: python3
fromversion: 8.2.0
marketplaces:
- marketplacev2
- platform
tests:
- No tests