PerceptionPoint

Loads incidents from Perception Point and releases falsely quarantined emails.

Details

ID	`PerceptionPoint`
Provider	Fortinet
Category	Email
From Version	5.0.0
Docker Image	`demisto/python3:3.12.8.3296088`
Supported Modules	Agentix XSIAM

README

Use the Perception Point integration to resend falsely quarantined emails.

Get your Perception Point API token

To get an API token, contact PerceptionPoint support.

API token use cases

To set the number of results to return, specify the parameter "Number of API loops". Each loop returns a maximum of 20 items.

View and manage your incidents list. This list will be updated automatically in the Incidents dashboard.
Release emails from quarantine and resend them to their recipients, by passing the scan ID as an argument.

Configure PerceptionPoint on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for Perception Point.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- Token to use Perception Point's API
- No. of API loops
- Fetch incidents
- Fetch blocked incidents
- Fetch spam incidents
- Fetch malicious incidents
- Incident type
- Trust any certificate (insecure)
- Use system proxy
Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

Resend a falsely quarantined email: pp-release-email

1. Resend a falsely quarantined email

Resends an email that was falsely quarantined, using the scan ID.

Base Command

pp-release-email

Input

Argument Name	Description	Required
scan_id	The PP scan ID of the email.	Required

Context Output

Path	Type	Description
PP.Released	number	The scan ID of the released email.

Command Example

pp-release-email scan_id="80052041"

Context Example

{
    "PP.Released": "80052041"
}

Human Readable Output

Email with id 80052041 was released Successfully!

Configuration parameters

pp_token — Token to use Perception Point's API (required)
api_loops — Number of API loops
isFetch — Fetch incidents
fetch_blocked — Fetch blocked incidents
fetch_spam — Fetch spam incidents
fetch_malicious — Fetch malicious incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

pp-release-email
Re-sends an email that was falsely quarantined, using the scan ID.

Source

PerceptionPoint.py PerceptionPoint.yml PerceptionPoint_description.md

Download History Raw

commonfields:
  id: PerceptionPoint
  version: -1
name: PerceptionPoint
display: PerceptionPoint
category: Email
sectionorder:
- Connect
- Collect
provider: Fortinet
description: Loads incidents from Perception Point and releases falsely quarantined emails.
configuration:
- display: Token to use Perception Point's API
  name: pp_token
  defaultvalue: ""
  type: 4
  required: true
  section: Connect
- display: Number of API loops
  name: api_loops
  defaultvalue: "1"
  type: 0
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Fetch blocked incidents
  name: fetch_blocked
  type: 8
  required: false
  section: Collect
- display: Fetch spam incidents
  name: fetch_spam
  type: 8
  required: false
  section: Collect
- display: Fetch malicious incidents
  name: fetch_malicious
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
script:
  script: '-'
  type: python
  subtype: python3
  commands:
  - name: pp-release-email
    arguments:
    - name: scan_id
      required: true
      description: The PP scan ID of the email.
    outputs:
    - contextPath: PP.Released
      description: The scan ID of the released email.
      type: number
    description: Re-sends an email that was falsely quarantined, using the scan ID.
  dockerimage: demisto/python3:3.12.8.3296088
  isfetch: true
tests:
- PerceptionPoint Test
fromversion: 5.0.0