Menlo Security

Collects web, email, audit, SMTP, attachment, DLP, HEAT, firewall, bandwidth, auth flows, and Menlo Security Client logs from the Menlo Security Isolation Platform (MSIP).

Network Security · Menlo Security

Details

IDMenlo Security
ProviderMenlo Security
CategoryNetwork Security
From Version8.2.0
Docker Imagedemisto/fastapi:0.125.0.10158186
Supported ModulesXSIAM

README

Menlo Security

The cloud-based Menlo Security Isolation Platform (MSIP) eliminates the possibility of malware reaching user devices via compromised or malicious Web sites, Email or documents.

This integration collects logs from the MSIP Logging API and sends them to Cortex.

Configure Menlo Security on Cortex

  1. Navigate to Settings > Configurations > Data Collection > Automations & Feed Integrations.
  2. Search for Menlo Security.
  3. Click Add instance to create and configure a new integration instance.
Parameter Description Required
Server URL The Menlo Security logging API base URL. Default: https://logs.menlosecurity.com True
Auth Token The API authentication token with Log Export API permission. True
Token type Select Admin Token (default) for tokens generated from the Admin UI (uses the v2 API). Select Token for legacy tokens (uses the v1 API). True
Log types The log types to collect. Select one or more from: web, safemail, audit, auth_flows, smtp, attachment, bandwidth, heat, firewall, dlp, ms_client_logs. All log types are selected by default. Note: heat replaces the deprecated isoc log type. True
Fetch events Enable event fetching. False
Maximum number of events per fetch per log type The maximum number of events to fetch per log type per fetch cycle. False
Trust any certificate (not secure) Disable SSL certificate verification. False
Use system proxy settings Use the system proxy for API requests. False
  1. Click Test to validate the connection.

Commands

menlo-security-get-events

Manually fetch events from the Menlo Security Isolation Platform.

Base Command

menlo-security-get-events

Input

Argument Name Description Required
start_time Start time for the event query (e.g., 1 hour, 2024-01-01T00:00:00Z). Default: 1 hour. Optional
end_time End time for the event query (e.g., now, 2024-01-02T00:00:00Z). Default: now. Optional
log_types Comma-separated list of log types to fetch (e.g., web,audit). Defaults to all configured log types. Optional
limit Maximum number of events to return per log type. Default: 100. Optional
should_push_events Set to True to push the fetched events to XSIAM. Set to False to only display them. Required

Context Output

There is no context output for this command.

Notes

  • The API token must have the Log Export API permission.
  • For tenants with extremely large event volumes, configure a separate integration instance per log type. Splitting the load across instances allows each instance to fetch its log type independently and in parallel, improving overall throughput.

Configuration parameters

  • url — Server URL (required)
  • credentials — (required)
  • token_type — Token type (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • log_types — Log types (required)
  • isFetchEvents — Fetch events
  • max_events_per_fetch_per_type — Maximum number of events per fetch per log type

Commands (1)

  • menlo-security-get-events

    Manually fetch events from the Menlo Security Isolation Platform. Use this command to test the integration or retrieve events on demand.

Source

MenloSecurity.py MenloSecurity_test.py MenloSecurity.yml MenloSecurity_description.md
Download History Raw 
## Menlo Security

This integration collects logs from the **Menlo Security Isolation Platform (MSIP)**.

### Authentication

To use this integration, you need an **API Auth Token** with the **Log Export API** permission.