Symantec Messaging Gateway

Symantec Messaging Gateway protects against spam, malware, targeted attacks and provides advanced content filtering, data loss prevention, and email encryption.

Email · Symantec Messaging Gateway

Details

IDSymantec Messaging Gateway
ProviderBroadcom
CategoryEmail
From Version5.0.0
Docker Imagedemisto/bs4-py3:1.0.0.10120494
Supported ModulesAgentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

Use Symantec Messaging Gateway (SMG) to block and unblock domains, email addresses, and IP addresses.

This integration was integrated and tested with Symantec Messaging Gateway v10.6.4.

Use Cases

  • Block and unblock domains, email addresses and IP addresses.
  • Get blocked domains and blocked IP addresses.

Known limitations

  • SMG does not have a REST API, therefore the integration parses HTML response using the Beautiful Soup package. It also sends and gets data through it.
  • The integration adds and removes IoCs to the relevant default Bad Sender lists, and not custom ones.

Configure Symantec Messaging Gateway on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Symantec Messaging Gateway.
  3. Click Add instance to create and configure a new integration instance.
    • Name: a textual name for the integration instance
    • Server URL (for example, https://192.168.0.1:20013)
    • Username
    • Do not validate server certificate (not secure)
    • Use system proxy settings
  4. Click Test to validate URLs and connection. 

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

  1. Block an email address: smg-block-email
  2. Block a domain: smg-block-domain
  3. Block an IP address: smg-block-ip
  4. Unblock an email address: smg-unblock-email
  5. Unblock a domain: smg-unblock-domain
  6. Unblock an IP address: smg-unblock-ip
  7. Get blocked Domains: smg-get-blocked-domains
  8. Get blocked IP addresses: smg-get-blocked-ips

1. Block an email address


Blocks an email address.

Base Command

smg-block-email

Input
Parameter Description
email Email address to block

 

Context Output
Path Description
Email.Address Email address that was blocked
Email.Blocked True if blocked, False if unblocked

 

Raw Output
Email address admin@example.com was blocked successfully.

 

2. Block a domain


Block a domain.

Base Command

smg-block-domain

Input
Parameter Description
domain Domain to block

 

Context Output
Path Description
Domain.Name Name of the domain that was blocked
Domain.Blocked True if blocked, False if unblocked

 

Raw Output
Domain google.com was blocked successfully.

 

3. Block an IP address


Blocks an IP address.

Base Command

smg-block-ip

Input
Parameter Description
ip  IP address to block

 

Context Output
Path Description
IP.Address IP address that was blocked
IP.Blocked True if blocked, False if unblocked

 

Raw Output
IP address 8.8.8.8 was blocked successfully.

 

4. Unblock an email address


Unblock an email address.

Base Command

smg-unblock-email

Input
Parameter Description
email Email address to unblock

 

Context Output
Path Description
Email.Address Email address that was unblocked
Email.Blocked True if blocked, False if unblocked

 

Raw Output
Email address admin@example.com was unblocked successfully.

 

5. Unblock a domain


Unblock a domain.

Base Command

smg-unblock-domain

Input
Parameter Description
domain Domain to unblock

 

Context Output
Path Description
Domain.Name Name of the domain that was blocked
Domain.Blocked True if blocked, False if unblocked

 

Raw Output
Domain google.com was unblocked successfully.

 

6. Unblock an IP address


Unblock an IP address.

Base Command

smg-unblock-ip

Input
Parameter Description
ip  IP address to unblock

 

Context Output
Path Description
IP.Address IP address that was unblocked
IP.Blocked True if blocked, False if unblocked

 

Raw Output

IP address 8.8.8.8 was unblocked successfully.

 


7. Get a list of blocked domains

Returns a list of blocked domains.

Base Command

smg-get-blocked-domains

Input

There is no input.

Context Output

There is no context output for this command.

Raw Output
### SMG Blocked domains:
- abc.net
- abc.org

 


8. Get blocked IP addresses

Get blocked IP addresses.

Base Command

smg-get-blocked-ips

Input

There is no input.

Context Output

There is no context output for this command..

Raw Output
### SMG Blocked IP addresses:
- 1.2.3.4
- 8.8.8.8

Configuration parameters

  • server — Server URL (e.g. https://192.168.0.1:20013) (required)
  • credentials — Username (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (8)

  • smg-block-domain

    Adds domain to the Local Bad Sender Domains group.

  • smg-block-email

    Adds email address to the Local Bad Sender Domains.

  • smg-block-ip

    Adds IP address to the Local Bad Sender IPs group.

  • smg-get-blocked-domains

    Returns a list of all blocked email addresses.

  • smg-get-blocked-ips

    Returns a list of all blocked IP addresses.

  • smg-unblock-domain

    Removes domain from the Local Bad Sender Domains group.

  • smg-unblock-email

    Removes email address from the Local Bad Sender Domains.

  • smg-unblock-ip

    Removes IP address from the Local Bad Sender IPs group.

commonfields:
  id: Symantec Messaging Gateway
  version: -1
name: Symantec Messaging Gateway
display: Symantec Messaging Gateway
category: Email
provider: Broadcom
description: Symantec Messaging Gateway protects against spam, malware, targeted attacks and provides advanced content filtering, data loss prevention, and email encryption.
configuration:
- display: Server URL (e.g. https://192.168.0.1:20013)
  name: server
  defaultvalue: ""
  type: 0
  required: true
- display: Username
  name: credentials
  defaultvalue: ""
  type: 9
  required: true
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
script:
  script: ''
  type: python
  subtype: python3
  commands:
  - name: smg-block-email
    arguments:
    - name: email
      required: true
      default: true
      description: Email address to block.
    outputs:
    - contextPath: Email.Address
      description: Email address that was blocked.
      type: string
    - contextPath: Email.Blocked
      description: True if blocked, False if unblocked.
      type: boolean
    description: Adds email address to the Local Bad Sender Domains.
    execution: true
  - name: smg-unblock-email
    arguments:
    - name: email
      required: true
      default: true
      description: Email address to unblock.
    outputs:
    - contextPath: Email.Address
      description: Email address that was unblocked.
      type: string
    - contextPath: Email.Blocked
      description: True if blocked, False if unblocked.
      type: boolean
    description: Removes email address from the Local Bad Sender Domains.
    execution: true
  - name: smg-block-domain
    arguments:
    - name: domain
      required: true
      default: true
      description: Domain to block.
    outputs:
    - contextPath: Domain.Name
      description: Domain name that was blocked.
      type: string
    - contextPath: Domain.Blocked
      description: True if blocked, False if unblocked.
      type: boolean
    description: Adds domain to the Local Bad Sender Domains group.
    execution: true
  - name: smg-block-ip
    arguments:
    - name: ip
      required: true
      default: true
      description: IP address to block.
    outputs:
    - contextPath: IP.Address
      description: IP address that was blocked.
      type: string
    - contextPath: IP.Blocked
      description: True if blocked, False if unblocked.
      type: boolean
    description: Adds IP address to the Local Bad Sender IPs  group.
    execution: true
  - name: smg-unblock-ip
    arguments:
    - name: ip
      required: true
      default: true
      description: IP address to unblock.
    description: Removes IP address from the Local Bad Sender IPs  group.
    execution: true
  - name: smg-unblock-domain
    arguments:
    - name: domain
      required: true
      default: true
      description: Domain to unblock.
    outputs:
    - contextPath: Domain.Name
      description: Domain name that was unblocked.
      type: string
    - contextPath: Domain.Blocked
      description: True if blocked, False if unblocked.
      type: boolean
    description: Removes domain from the Local Bad Sender Domains group.
    execution: true
  - name: smg-get-blocked-domains
    arguments: []
    description: Returns a list of all blocked email addresses.
  - name: smg-get-blocked-ips
    arguments: []
    description: Returns a list of all blocked IP addresses.
  dockerimage: demisto/bs4-py3:1.0.0.10120494
fromversion: 5.0.0
tests:
- No tests (auto formatted)