Postmark Spamcheck
Postmark's spam API, Spamcheck, is a RESTfull interface to the Spam filter tool SpamAssassin.
Messaging and Conferencing · Postmark Spamcheck
Details
| ID | Postmark Spamcheck |
|---|---|
| Provider | ActiveCampaign |
| Category | Messaging and Conferencing |
| From Version | 6.0.0 |
| Docker Image | demisto/python3:3.12.8.3296088 |
| Supported Modules | Agentix XSIAM |
README
Postmark’s spam API, Spamcheck, is a RESTfull interface to the Spam filter tool SpamAssassin.
Configure Postmark Spamcheck in Cortex
| Parameter | Description | Required |
|---|---|---|
| URL | Postmark Spamcheck API URL | True |
| Trust any certificate (not secure) | When ‘trust any certificate’ is selected, the integration ignores TLS/SSL certificate validation errors. Used to test connection issues or connect to a server without a valid certificate. | False |
| Use system proxy settings | Runs the integration instance using the proxy server (HTTP or HTTPS) that you defined in the server configuration. | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
postmark-spamcheck
Check the spamscore of your email message
Base Command
postmark-spamcheck
Input
| Argument Name | Description | Required |
|---|---|---|
| entryid | Entry ID of mail EML file. | Required |
| short | Only return spam score. Possible values are: True, False. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Postmark.Spamcheck.score | unknown | Value of SpamAssassin score |
| Postmark.Spamcheck.success | unknown | State of SpamAssassin check |
| Postmark.Spamcheck.rules | unknown | List the matched SpamAssassin rules |
| Postmark.Spamcheck.report | unknown | Detailed SpamAssassin report |
Command example
!postmark-spamcheck entryid="654@731f1b54-bdea-4d4a-860f-328527df0cd7"
Context Example
{
"Postmark": {
"Spamcheck": {
"entryid": "654@731f1b54-bdea-4d4a-860f-328527df0cd7",
"report": " pts rule description \n---- ---------------------- --------------------------------------------------\n-0.0 NO_RELAYS Informational: message was not relayed via SMTP \n 0.6 TVD_FW_GRAPHIC_NAME_LONG BODY: Long image attachment name \n 1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words \n 0.0 HTML_MESSAGE BODY: HTML included in message \n 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was \n blocked. See \n http://wiki.apache.org/spamassassin/DnsBlocklists\u2026\n #dnsbl-block for more information. [URIs: \n phpclasses.org] \n-0.0 NO_RECEIVED Informational: message has no Received headers \n-0.0 T_SCC_BODY_TEXT_LINE No description available. ",
"rules": [
{
"description": "Informational: message was not relayed via SMTP",
"score": "-0.0"
},
{
"description": "BODY: Long image attachment name",
"score": "0.6"
},
{
"description": "BODY: HTML: images with 800-1200 bytes of words",
"score": "1.6"
},
{
"description": "BODY: HTML included in message",
"score": "0.0"
},
{
"description": "ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: phpclasses.org]",
"score": "0.0"
},
{
"description": "Informational: message has no Received headers",
"score": "-0.0"
},
{
"description": "No description available.",
"score": "-0.0"
}
],
"score": "2.3",
"success": true
}
}
}
Human Readable Output
Postmark - Spamcheck
Spamcheck completed
entryid report rules score success 654@731f1b54-bdea-4d4a-860f-328527df0cd7 pts rule description
—- ———————- ————————————————–
-0.0 NO_RELAYS Informational: message was not relayed via SMTP
0.6 TVD_FW_GRAPHIC_NAME_LONG BODY: Long image attachment name
1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was
blocked. See
http://wiki.apache.org/spamassassin/DnsBlocklists…
#dnsbl-block for more information. [URIs:
phpclasses.org]
-0.0 NO_RECEIVED Informational: message has no Received headers
-0.0 T_SCC_BODY_TEXT_LINE No description available.{‘score’: ‘-0.0’, ‘description’: ‘Informational: message was not relayed via SMTP’},
{‘score’: ‘0.6’, ‘description’: ‘BODY: Long image attachment name’},
{‘score’: ‘1.6’, ‘description’: ‘BODY: HTML: images with 800-1200 bytes of words’},
{‘score’: ‘0.0’, ‘description’: ‘BODY: HTML included in message’},
{‘score’: ‘0.0’, ‘description’: ‘ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: phpclasses.org]’},
{‘score’: ‘-0.0’, ‘description’: ‘Informational: message has no Received headers’},
{‘score’: ‘-0.0’, ‘description’: ‘No description available.’}2.3 true
Command example
!postmark-spamcheck entryid="654@731f1b54-bdea-4d4a-860f-328527df0cd7" short=True
Context Example
{
"Postmark": {
"Spamcheck": {
"entryid": "654@731f1b54-bdea-4d4a-860f-328527df0cd7",
"score": "2.3",
"success": true
}
}
}
Human Readable Output
Postmark - Spamcheck
Spamcheck completed
entryid score success 654@731f1b54-bdea-4d4a-860f-328527df0cd7 2.3 true
Configuration parameters
base_url— URL (required)insecure— Trust any certificate (not secure)proxy— Use system proxy settings
Commands (1)
-
postmark-spamcheckCheck the spamscore of your email message
import traceback import demistomock as demisto # noqa: F401 # Disable insecure warnings import urllib3 from CommonServerPython import * # noqa: F401 urllib3.disable_warnings() """ CLIENT CLASS """ class Client(BaseClient): """Client class to interact with the Postmark Spamcheck API""" def __init__(self, base_url: str, proxy: bool, verify: bool): super().__init__(base_url=base_url, proxy=proxy, verify=verify) def spamcheck(self, email: bytes, options: str) -> dict: """Get spam score of EML file Returns the spam score result returned by the Postmark Spamcheck API as a dictionary. :type email: ``str`` :param email: EML file to be sent to the Postmark Spamcheck API :type options: ``str`` :param options: Must either be "long" for a full report of processing rules, or "short" for a score request. :return: Spam score result returned by the Postmark Spamcheck API as dict :rtype: ``dict`` """ return self._http_request( method="POST", url_suffix="filter", data={"email": email, "options": options}, resp_type="json", ok_codes=(200,) ) """ COMMAND FUNCTIONS """ def test_module_command(client): """ Tests Postmark Spamcheck API connectivity """ result = client.spamcheck(email="", options="short") if result: # noqa: RET503 return "ok" def spamcheck_command(client: Client, file_path: str, args: dict) -> dict: """Returns the spam score result returned by the Postmark Spamcheck API as a dictionary. :type client: ``Client`` :param client: Instance of Client class to interact with the Postmark Spamcheck API :type file_path: ``str`` :param file_path: File path to EML file in XSOAR :type args: ``dict`` :param args: Command arguments :return: Spam score result returned by the Postmark Spamcheck API as dict :rtype: ``dict`` """ if not file_path: raise ValueError("entry file path not found") email = open(file_path, "rb").read() short = args.get("short", False) if short: options = "short" else: options = "long" response = client.spamcheck(email=email, options=options) if not response and not response.get("success"): raise Exception(f"Failed submitting mail to Postmark Spamcheck API: {file_path}\n") else: return response """ MAIN FUNCTION """ def main() -> None: """main function, parses params and runs command functions""" params = demisto.params() args = demisto.args() command = demisto.command() base_url = params.get("base_url") verify = not params.get("insecure", False) proxy = params.get("proxy", False) try: client = Client(base_url=base_url, verify=verify, proxy=proxy) if command == "test-module": return_results(test_module_command(client)) elif command == "postmark-spamcheck": entry_id = args.get("entryid") file_path = demisto.getFilePath(entry_id).get("path") result = spamcheck_command(client=client, file_path=file_path, args=args) result["entryid"] = entry_id command_results = CommandResults( readable_output=tableToMarkdown("Postmark - Spamcheck", result, metadata="Spamcheck completed", removeNull=True), outputs_prefix="Postmark.Spamcheck", outputs_key_field="entryid", outputs=result, ) return_results(command_results) except Exception as e: demisto.error(traceback.format_exc()) # print the traceback return_error(f"Failed to execute {demisto.command()} command. Error: {e!s}") """ ENTRY POINT """ if __name__ in ("__main__", "builtin", "builtins"): main()