Symantec Messaging Gateway
Symantec Messaging Gateway protects against spam, malware, targeted attacks and provides advanced content filtering, data loss prevention, and email encryption.
Email · Symantec Messaging Gateway
Details
| ID | Symantec Messaging Gateway |
|---|---|
| Provider | Broadcom |
| Category | |
| From Version | 5.0.0 |
| Docker Image | demisto/bs4-py3:1.0.0.10120494 |
| Supported Modules | Agentix XSIAM EDR Cortex Cloud Cloud Runtime Security |
README
Use Symantec Messaging Gateway (SMG) to block and unblock domains, email addresses, and IP addresses.
This integration was integrated and tested with Symantec Messaging Gateway v10.6.4.
Use Cases
- Block and unblock domains, email addresses and IP addresses.
- Get blocked domains and blocked IP addresses.
Known limitations
- SMG does not have a REST API, therefore the integration parses HTML response using the Beautiful Soup package. It also sends and gets data through it.
- The integration adds and removes IoCs to the relevant default Bad Sender lists, and not custom ones.
Configure Symantec Messaging Gateway on Cortex XSOAR
- Navigate to Settings > Integrations > Servers & Services.
- Search for Symantec Messaging Gateway.
- Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance
- Server URL (for example, https://192.168.0.1:20013)
- Username
- Do not validate server certificate (not secure)
- Use system proxy settings
- Click Test to validate URLs and connection.
Commands
You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.
- Block an email address: smg-block-email
- Block a domain: smg-block-domain
- Block an IP address: smg-block-ip
- Unblock an email address: smg-unblock-email
- Unblock a domain: smg-unblock-domain
- Unblock an IP address: smg-unblock-ip
- Get blocked Domains: smg-get-blocked-domains
- Get blocked IP addresses: smg-get-blocked-ips
1. Block an email address
Blocks an email address.
Base Command
smg-block-email
Input
| Parameter | Description |
| Email address to block |
Context Output
| Path | Description |
| Email.Address | Email address that was blocked |
| Email.Blocked | True if blocked, False if unblocked |
Raw Output
Email address admin@example.com was blocked successfully.
2. Block a domain
Block a domain.
Base Command
smg-block-domain
Input
| Parameter | Description |
| domain | Domain to block |
Context Output
| Path | Description |
| Domain.Name | Name of the domain that was blocked |
| Domain.Blocked | True if blocked, False if unblocked |
Raw Output
Domain google.com was blocked successfully.
3. Block an IP address
Blocks an IP address.
Base Command
smg-block-ip
Input
| Parameter | Description |
| ip | IP address to block |
Context Output
| Path | Description |
| IP.Address | IP address that was blocked |
| IP.Blocked | True if blocked, False if unblocked |
Raw Output
IP address 8.8.8.8 was blocked successfully.
4. Unblock an email address
Unblock an email address.
Base Command
smg-unblock-email
Input
| Parameter | Description |
| Email address to unblock |
Context Output
| Path | Description |
| Email.Address | Email address that was unblocked |
| Email.Blocked | True if blocked, False if unblocked |
Raw Output
Email address admin@example.com was unblocked successfully.
5. Unblock a domain
Unblock a domain.
Base Command
smg-unblock-domain
Input
| Parameter | Description |
| domain | Domain to unblock |
Context Output
| Path | Description |
| Domain.Name | Name of the domain that was blocked |
| Domain.Blocked | True if blocked, False if unblocked |
Raw Output
Domain google.com was unblocked successfully.
6. Unblock an IP address
Unblock an IP address.
Base Command
smg-unblock-ip
Input
| Parameter | Description |
| ip | IP address to unblock |
Context Output
| Path | Description |
| IP.Address | IP address that was unblocked |
| IP.Blocked | True if blocked, False if unblocked |
Raw Output
IP address 8.8.8.8 was unblocked successfully.
7. Get a list of blocked domains
Returns a list of blocked domains.
Base Command
smg-get-blocked-domains
Input
There is no input.
Context Output
There is no context output for this command.
Raw Output
### SMG Blocked domains: - abc.net - abc.org
8. Get blocked IP addresses
Get blocked IP addresses.
Base Command
smg-get-blocked-ips
Input
There is no input.
Context Output
There is no context output for this command..
Raw Output
### SMG Blocked IP addresses: - 1.2.3.4 - 8.8.8.8
Configuration parameters
server— Server URL (e.g. https://192.168.0.1:20013) (required)credentials— Username (required)insecure— Trust any certificate (not secure)proxy— Use system proxy settings
Commands (8)
-
smg-block-domainAdds domain to the Local Bad Sender Domains group.
-
smg-block-emailAdds email address to the Local Bad Sender Domains.
-
smg-block-ipAdds IP address to the Local Bad Sender IPs group.
-
smg-get-blocked-domainsReturns a list of all blocked email addresses.
-
smg-get-blocked-ipsReturns a list of all blocked IP addresses.
-
smg-unblock-domainRemoves domain from the Local Bad Sender Domains group.
-
smg-unblock-emailRemoves email address from the Local Bad Sender Domains.
-
smg-unblock-ipRemoves IP address from the Local Bad Sender IPs group.
commonfields: id: Symantec Messaging Gateway version: -1 name: Symantec Messaging Gateway display: Symantec Messaging Gateway category: Email provider: Broadcom description: Symantec Messaging Gateway protects against spam, malware, targeted attacks and provides advanced content filtering, data loss prevention, and email encryption. configuration: - display: Server URL (e.g. https://192.168.0.1:20013) name: server defaultvalue: "" type: 0 required: true - display: Username name: credentials defaultvalue: "" type: 9 required: true - display: Trust any certificate (not secure) name: insecure type: 8 required: false - display: Use system proxy settings name: proxy type: 8 required: false script: script: '' type: python subtype: python3 commands: - name: smg-block-email arguments: - name: email required: true default: true description: Email address to block. outputs: - contextPath: Email.Address description: Email address that was blocked. type: string - contextPath: Email.Blocked description: True if blocked, False if unblocked. type: boolean description: Adds email address to the Local Bad Sender Domains. execution: true - name: smg-unblock-email arguments: - name: email required: true default: true description: Email address to unblock. outputs: - contextPath: Email.Address description: Email address that was unblocked. type: string - contextPath: Email.Blocked description: True if blocked, False if unblocked. type: boolean description: Removes email address from the Local Bad Sender Domains. execution: true - name: smg-block-domain arguments: - name: domain required: true default: true description: Domain to block. outputs: - contextPath: Domain.Name description: Domain name that was blocked. type: string - contextPath: Domain.Blocked description: True if blocked, False if unblocked. type: boolean description: Adds domain to the Local Bad Sender Domains group. execution: true - name: smg-block-ip arguments: - name: ip required: true default: true description: IP address to block. outputs: - contextPath: IP.Address description: IP address that was blocked. type: string - contextPath: IP.Blocked description: True if blocked, False if unblocked. type: boolean description: Adds IP address to the Local Bad Sender IPs group. execution: true - name: smg-unblock-ip arguments: - name: ip required: true default: true description: IP address to unblock. description: Removes IP address from the Local Bad Sender IPs group. execution: true - name: smg-unblock-domain arguments: - name: domain required: true default: true description: Domain to unblock. outputs: - contextPath: Domain.Name description: Domain name that was unblocked. type: string - contextPath: Domain.Blocked description: True if blocked, False if unblocked. type: boolean description: Removes domain from the Local Bad Sender Domains group. execution: true - name: smg-get-blocked-domains arguments: [] description: Returns a list of all blocked email addresses. - name: smg-get-blocked-ips arguments: [] description: Returns a list of all blocked IP addresses. dockerimage: demisto/bs4-py3:1.0.0.10120494 fromversion: 5.0.0 tests: - No tests (auto formatted)