TrendMicro Cloud App Security

Use TrendAI™ Cloud App Security integration to protect against ransomware, phishing, malware, and unauthorized transmission of sensitive data for cloud applications, such as Microsoft 365, Box, Dropbox, Google G Suite and Salesforce.

Authentication & Identity Management · TrendAI™ Cloud App Security

Details

IDTrendMicro Cloud App Security
ProviderTrendAI™
CategoryAuthentication & Identity Management
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Use TrendAI™ Cloud App Security integration to protect against ransomware, phishing, malware, and unauthorized transmission of sensitive data for cloud applications, such as Microsoft 365, Box, Dropbox, Google G Suite and Salesforce.

Configure TrendAI™ Cloud App Security in Cortex

Parameter Description Required
serviceURL Service URL True
token Token True
isFetch Fetch incidents False
service Service event to fetch False
event_type Event type to fetch False
max_fetch Maximum number of incidents per fetch False
first_fetch First fetch time False
insecure Trust any certificate (not secure) False
proxy Use system proxy settings False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

trendmicro-cas-security-events-list

Retrieves security event logs of services.

Base Command

trendmicro-cas-security-events-list

Input

Argument Name Description Required
service Name of the protected service whose logs you want to retrieve. Can be: “exchange”, “sharepoint”, “onedrive”, “dropbox”, “box”, “googledrive”, “gmail”, “teams”, or “exchangeserver”. Required
event_type Type of the security event whose logs you want to retrieve. Can be: “securityrisk”, “virtualanalyzer”, “ransomware”, or “dlp”. Required
start The start time to retrieve logs, using the date and time format ISO 8601. For example, 2020-08-01T02:31:20Z or in human-readable format. For example, “in 1 day” or “3 weeks ago”.
The request retrieves logs within a maximum of 72 hours before the request is sent.
If a start time is added, the request retrieves all from the start time.
If a start and end time are added, the request retrieves logs within the configured duration.
If start and end times are not added, the request retrieves logs within 5 minutes before the request is sent.		 Optional
end The end time to retrieve logs, using the date and time format ISO 8601. For example, 2020-08-01T02:31:20Z or in human-readable format. For example, “in 1 day” or “3 weeks ago”.
The request retrieves logs within a maximum of 72 hours before request is sent.
If an end time is added, the request retrieves logs within five minutes before the end time.
If start and end are added, the request retrieves logs within the configured duration. Ensure the end time is no earlier than the start time.
If the start and end times are not added, the request retrieves logs within 5 minutes before the request is sent.		 Optional
limit The maximum number of log items to display. Default is 50 and Maximum is 500. Optional
next_link The URL for the results page if the total number of log items in a previous request exceeds the specified limit. When the maximum log items exceeds the limit, a URL is specified in the response. To retrieve the remaining log items, use the URL from the response. Optional

Context Output

Path Type Description
TrendMicroCAS.Events.last_log_item_generation_time Date The time and date when the last log item in the current request was generated.
TrendMicroCAS.Events.next_link String URL for the follow-up request if the requested logs exceed the specified limit to display at a time. Use this URL to form a second request.
TrendMicroCAS.Events.security_events.event String The type of the requested security event.
TrendMicroCAS.Events.security_events.log_item_id String The ID of a log item.
TrendMicroCAS.Events.security_events.message.action String The action that Cloud App Security took after detecting the security event.
TrendMicroCAS.Events.security_events.message.action_result String The result of the action.
TrendMicroCAS.Events.security_events.message.affected_user String The Mailbox that received an email message triggering the security event, or the user account that uploaded or modified a file triggering the security event.
TrendMicroCAS.Events.security_events.message.detected_by String The technology or method through which the email message or file triggering the security event was detected.
TrendMicroCAS.Events.security_events.message.detection_time Date The time and date when the security event was detected.
TrendMicroCAS.Events.security_events.message.location String The location where the security event was detected.
TrendMicroCAS.Events.security_events.message.log_item_id String The ID of the log item.
TrendMicroCAS.Events.security_events.message.mail_message_delivery_time Date The time and date when the email message triggering the security event was sent.
TrendMicroCAS.Events.security_events.message.mail_message_file_name String The name of the email attachment that triggered the security event.
TrendMicroCAS.Events.security_events.message.mail_message_id String The ID of the email message that triggered the security event.
TrendMicroCAS.Events.security_events.message.mail_message_recipient String The Email address of the recipient.
TrendMicroCAS.Events.security_events.message.mail_message_sender String The Email address of the sender.
TrendMicroCAS.Events.security_events.message.mail_message_subject String The subject of the email message that triggered the security event.
TrendMicroCAS.Events.security_events.message.mail_message_submit_time Date The time and date when the email message triggering the security event was received.
TrendMicroCAS.Events.security_events.message.file_name String The name of the file that triggered the security event.
TrendMicroCAS.Events.security_events.message.file_upload_time Date The time and date when the file triggering the security event was uploaded.
TrendMicroCAS.Events.security_events.message.risk_level String The web reputation risk level assigned to the analyzed URL that triggered the security event.
TrendMicroCAS.Events.security_events.message.scan_type String A real-time scan or manual scan that detected the security event.
TrendMicroCAS.Events.security_events.message.security_risk_name String The name of the security risk detected.
TrendMicroCAS.Events.security_events.message.triggered_policy_name String The name of a configured policy that was violated.
TrendMicroCAS.Events.security_events.message.triggered_security_filter String The name of the security filter that detected the security event.
TrendMicroCAS.Events.security_events.message.virus_name String The name of the detected virus.
TrendMicroCAS.Events.security_events.message.file_sha1 String The SHA-1 hash value of the file that triggered the security event.
TrendMicroCAS.Events.security_events.message.detection_type String The type of the suspicious object that triggered the security event.
TrendMicroCAS.Events.security_events.message.ransomware_name String The name of the detected ransomware.
TrendMicroCAS.Events.security_events.message.triggered_dlp_template String The details of the compliance template that was violated to trigger the security event.
TrendMicroCAS.Events.security_events.service String The name of the requested service.
TrendMicroCAS.Events.traceId String The randomly generated ID to trace the request.

Command Example

!trendmicro-cas-security-events-list service=onedrive event_type=securityrisk start="1 day"

Context Example

{
    "TrendMicroCAS": {
        "Events": [
            {
                "event": "security_risk_scan",
                "log_item_id": "b4f632b3-f797-45cb-aa28-207e6aa58a8d",
                "message": {
                    "action": "Quarantine",
                    "action_result": "success",
                    "affected_user": "ser@onmicrosoft.com",
                    "detected_by": "",
                    "detection_time": "2020-08-09T21:12:16.000Z",
                    "file_name": "20170813_125133.jpg",
                    "file_upload_time": "2020-08-09T09:11:58.000Z",
                    "location": "https://my.sharepoint.com/personal/onmicrosoft_com/Documents/",
                    "log_item_id": "b4f632b3-f797-45cb-aa28-207e6aa58a8d",
                    "risk_level": "",
                    "scan_type": "Real-time scan",
                    "security_risk_name": "20170813_125133.jpg",
                    "triggered_policy_name": "Default OneDrive Policy ATP",
                    "triggered_security_filter": "File Blocking"
                },
                "service": "OneDrive"
            },
            {
                "event": "security_risk_scan",
                "log_item_id": "e80363c5-29c8-4b0f-a3d0-748bc6bae263",
                "message": {
                    "action": "Quarantine",
                    "action_result": "success",
                    "affected_user": "ser@onmicrosoft.com",
                    "detected_by": "",
                    "detection_time": "2020-08-09T21:12:42.000Z",
                    "file_name": "20180802_144154.jpg",
                    "file_upload_time": "2020-08-09T09:12:19.000Z",
                    "location": "https://my.sharepoint.com/personal/onmicrosoft_com/Documents/",
                    "log_item_id": "e80363c5-29c8-4b0f-a3d0-748bc6bae263",
                    "risk_level": "",
                    "scan_type": "Real-time scan",
                    "security_risk_name": "20180802_144154.jpg",
                    "triggered_policy_name": "Default OneDrive Policy ATP",
                    "triggered_security_filter": "File Blocking"
                },
                "service": "OneDrive"
            },
            {
                "event": "security_risk_scan",
                "log_item_id": "89d50aab-0c34-4ffd-8497-62fbc1d51048",
                "message": {
                    "action": "Quarantine",
                    "action_result": "success",
                    "affected_user": "avishai@demistodev.onmicrosoft.com",
                    "detected_by": "",
                    "detection_time": "2020-08-09T21:12:46.000Z",
                    "file_name": "20180807190412.JPG",
                    "file_upload_time": "2020-08-09T09:12:23.000Z",
                    "location": "https://demistodev-my.sharepoint.com/personal/avishai_demistodev_onmicrosoft_com/Documents/",
                    "log_item_id": "89d50aab-0c34-4ffd-8497-62fbc1d51048",
                    "risk_level": "",
                    "scan_type": "Real-time scan",
                    "security_risk_name": "20180807190412.JPG",
                    "triggered_policy_name": "Default OneDrive Policy ATP",
                    "triggered_security_filter": "File Blocking"
                },
                "service": "OneDrive"
            }
        ]
    }
}

Human Readable Output

securityrisk events in onedrive

log_item_id detection_time security_risk_name affected_user action action_result
b4f632b3-f797-45cb-aa28-207e6aa58a8d 2020-08-09T21:12:16.000Z 20170813_125133.jpg avishai@demistodev.onmicrosoft.com Quarantine success

trendmicro-cas-email-sweep

Searches for email messages in mailboxes, matching search criteria.

Base Command

trendmicro-cas-email-sweep

Input

Argument Name Description Required
mailbox The Email address of the mailbox for which to search.
A non-prefix wildcard is supported. For example, user@gmail.com or user@gmail.com.		 Optional
lastndays The number of days (n × 24 hours) before the request is sent to search.
Do not configure lastndays and start/end at the same time.		 Optional
start The start time to search for email messages using the date and time format ISO 8601. For example, 2020-08-01T02:31:20Z or in human-readable format. For example, “in 1 day” or “3 weeks ago”.
The request searches email messages according to the following settings:
If both start and end are not added, the request searches email messages within seven days (7 × 24 hours) before the request was sent.
If both start and end are added, the request searches email messages within this configured duration. Ensure the end time is no earlier than the start time.
If only start is added, the request searches email messages within seven days (7 × 24 hours) after the start time.
If only end is added, the request searches email messages within seven days (7 × 24 hours) before the end time.
Do not configure lastndays and start/end at the same time.		 Optional
end The end time to search for email messages using the date and time format ISO 8601. For example, 2020-08-01T02:31:20Z or in human-readable format. For example, “in 1 day” or “3 weeks ago”.
Cloud App Security saves the meta information of email messages for 90 days.
The request searches email messages according to the following settings:
If both start and end are not added, the request searches email messages within seven days (7 × 24 hours) before the request was sent.
If both start and end are added, the request searches email messages within this duration. Ensure the end time is no earlier than the start time.
If only start is added, the request searches email messages within seven days (7 × 24 hours) after the start time.
If only end is added, the request searches email messages within seven days (7 × 24 hours) before the end time.
Do not configure lastndays and start/end at the same time.		 Optional
subject The subject of email messages for which to search. Use double quotes to search for an exact phrase, for example, “messageA messageB”
otherwise a partial match based on the phrase is performed. For example,
a search is performed on a subject containing messageA, or messageB, or messageA message B.		 Optional
file_sha1 The SHA-1 hash value of the attachment file for which to search. Optional
file_name The name of the attachment file for which to search, with or without a filename extension. A non-prefix wildcard is supported. For example, me*ssage. Optional
file_extension The filename extension of attachment files for which to search without a period “.”. A non-prefix wildcard is supported. For example, do* Optional
url The URL contained in an email body or in an attachment for which to search. Type the
full URL.		 Optional
sender The email address of the sender for which to search. Type the full email address. A non-prefix wildcard is supported. For example, u*ser@gmail.com. Optional
recipient The email address of the recipient for which to search. Type the full email address. A non-prefix wildcard is supported. For example, u*ser@gmail.com. Optional
message_id The Internet message ID of the email message for which to search. Can be obtained from Microsoft Graph API or EWS API. Optional
source_ip The Source IP address, with or without a subnet mask, of the email message to search. For example, xx.yy.zz.ww or xx.yy.zz.ww/16. Optional
source_domain The Source domain of email messages for which to search. Type a complete domain name. A non-prefix wildcard is supported. For example, gm*ail.com. Optional
limit The maximum number of email messages to display. Maximum is 1,000 email messages. If not specified, default is 20. Optional
next_link The URL for the results page if the total number of email messages in a previous request exceeds the specified limit. When the maximum limit has been exceeded, a URL is specified in the response. To retrieve the remaining email messages, use the URL from the response. Optional

Context Output

Path Type Description
TrendMicroCAS.EmailSweep.next_link String URL for the follow-up request if the requested email messages exceed the specified limit to display at a time. Use this URL to form a second request.
TrendMicroCAS.EmailSweep.traceId String The randomly generated ID to trace the request.
TrendMicroCAS.EmailSweep.value.mail_attachments.file_sha1 String The SHA-1 hash value of the attachment file.
TrendMicroCAS.EmailSweep.value.mail_attachments.file_name String The name of the attachment file.
TrendMicroCAS.EmailSweep.value.mail_internet_headers.HeaderName String The Internet header name of the email address.
TrendMicroCAS.EmailSweep.value.mail_internet_headers.Value String The email address of the sender.
TrendMicroCAS.EmailSweep.value.mail_message_delivery_time Date The time and date when the email message was sent.
TrendMicroCAS.EmailSweep.value.mail_message_id String The Internet message ID of the email message.
TrendMicroCAS.EmailSweep.value.mail_message_recipient String A list of recipient email addresses of the email message.
TrendMicroCAS.EmailSweep.value.mail_message_sender String The email address of the sender.
TrendMicroCAS.EmailSweep.value.mail_message_subject String The subject of the email message.
TrendMicroCAS.EmailSweep.value.mail_unique_id String The ID of the email message.
TrendMicroCAS.EmailSweep.value.mail_urls String The URL contained in the email body or attachment.
TrendMicroCAS.EmailSweep.value.mailbox String The mailbox which contains the email message.
TrendMicroCAS.EmailSweep.value.source_domain String The source domain of the email message.
TrendMicroCAS.EmailSweep.value.source_ip String The source IP address of the email message.

Command Example

!trendmicro-cas-email-sweep lastndays=2 limit=2

Context Example

{
    "TrendMicroCAS": {
        "EmailSweep": {
            "current_link": "https://api.tmcas.trendmicro.com/v1/sweeping/mails?lastndays=2&limit=2",
            "next_link": "https://api.tmcas.trendmicro.com/v1/sweeping/mails?lastndays=2&limit=2&skiptoken=WzE1OTY4NjA4MzEwMDAsIkFBTWtBR1kzT1RReU16TXpMV1l4TmprdE5ERTBNeTA1Tm1aaExXUTVNR1kxWWpJeU56QmtOQUJHQUFBQUFBQ1lDS2pXQW5YQlRybmhnV0pDY0xYN0J3RHJ4UndSanEtelRyTjZ2V1N6SzRPV0FBQUFBQUVKQUFEcnhSd1JqcS16VHJONnZXU3pLNE9XQUFPbjlyQzNBQUE9Il0=",
            "traceId": "3bedba23-c4da-47ba-a924-e6eec02d6110",
            "value": [
                {
                    "mail_attachments": [
                        {
                            "file_name": "report_Investigation_Summary_1596856796810442162.pdf",
                            "file_sha1": "53d27b284b324be18b2241f80cbc9ee4efd4684c"
                        }
                    ],
                    "mail_internet_headers": [
                        {
                            "HeaderName": "From",
                            "Value": "Build Tests <ser@onmicrosoft.com>"
                        },
                        {
                            "HeaderName": "Return-Path",
                            "Value": "ser@onmicrosoft.com"
                        },
                        {
                            "HeaderName": "Authentication-Results",
                            "Value": "spf=none (sender IP is 0.0.0.0)\r\n smtp.mailfrom=demisto.int;.onmicrosoft.com; dkim=none (message not\r\n signed) header.d=none;onmicrosoft.com; dmarc=none action=none\r\n header.from=int;compauth=softpass reason=201"
                        }
                    ],
                    "mail_message_delivery_time": "2020-08-08T03:20:53.000Z",
                    "mail_message_id": "<0d25a1993958467e92fe6243427e9c92@WIN-MICMSOEE1BU.demisto.int>",
                    "mail_message_recipient": [
                        "ser@onmicrosoft.com"
                    ],
                    "mail_message_sender": "ser@onmicrosoft.com",
                    "mail_message_subject": "Demisto Incident Summary Report",
                    "mail_unique_id": "AAMkAGY3OTQyMzMzLWYxNjktNDE0My05NmZhLWQ5MGY1YjIyNzBkNABGAAAAAACYCKjWAnXBTrnhgWJCcLX7BwDrxRwRjq-zTrN6vWSzK4OWAAAAAAEMAADrxRwRjq-zTrN6vWSzK4OWAAOn2KLJAAA=",
                    "mail_urls": [],
                    "mailbox": "ser@onmicrosoft.com",
                    "source_domain": "demisto.int",
                    "source_ip": "0.0.0.0"
                },
                {
                    "mail_attachments": [],
                    "mail_internet_headers": [
                        {
                            "HeaderName": "From",
                            "Value": "ser@onmicrosoft.com"
                        },
                        {
                            "HeaderName": "Return-Path",
                            "Value": "ser@onmicrosoft.com"
                        }
                    ],
                    "mail_message_delivery_time": "2020-08-08T04:27:11.000Z",
                    "mail_message_id": "<VI1PR07MB577569FD6DFA9073792BA49399460@VI1PR07MB5775.eurprd07.prod.outlook.com>",
                    "mail_message_recipient": [
                        "ser@onmicrosoft.com"
                    ],
                    "mail_message_sender": "ser@onmicrosoft.com",
                    "mail_message_subject": "Test mail from Demisto",
                    "mail_unique_id": "AAMkAGY3OTQyMzMzLWYxNjktNDE0My05NmZhLWQ5MGY1YjIyNzBkNABGAAAAAACYCKjWAnXBTrnhgWJCcLX7BwDrxRwRjq-zTrN6vWSzK4OWAAAAAAEJAADrxRwRjq-zTrN6vWSzK4OWAAOn9rC3AAA=",
                    "mail_urls": [],
                    "mailbox": "ser@onmicrosoft.com",
                    "source_domain": "onmicrosoft.com",
                    "source_ip": "0.0.0.0"
                }
            ]
        }
    }
}

Human Readable Output

Search Results

mail_message_delivery_time mail_message_id mail_message_sender mail_message_subject mail_unique_id mailbox
2020-08-08T03:20:53.000Z 0d25a1993958467e92fe6243427e9c92@WIN-MICMSOEE1BU.demisto.int buildtests@demisto.int Demisto Incident Summary Report AAMkAGY3OTQyMzMzLWYxNjktNDE0My05NmZhLWQ5MGY1YjIyNzBkNABGAAAAAACYCKjWAnXBTrnhgWJCcLX7BwDrxRwRjq-zTrN6vWSzK4OWAAAAAAEMAADrxRwRjq-zTrN6vWSzK4OWAAOn2KLJAAA= ser@onmicrosoft.com
2020-08-08T04:27:11.000Z VI1PR07MB577569FD6DFA9073792BA49399460@VI1PR07MB5775.eurprd07.prod.outlook.com avishai@demistodev.onmicrosoft.com Test mail from Demisto AAMkAGY3OTQyMzMzLWYxNjktNDE0My05NmZhLWQ5MGY1YjIyNzBkNABGAAAAAACYCKjWAnXBTrnhgWJCcLX7BwDrxRwRjq-zTrN6vWSzK4OWAAAAAAEJAADrxRwRjq-zTrN6vWSzK4OWAAOn9rC3AAA= ser@onmicrosoft.com

trendmicro-cas-user-take-action

Takes action on a batch of specified user accounts, such as disabling users accounts,
requesting multi-factor authentication, and requesting to reset a password for users accounts.
Relevant for office365 exchange only.

Base Command

trendmicro-cas-user-take-action

Input

Argument Name Description Required
action_type Action to take on a user’s account. Can be:
“ACCOUNT_DISABLE”: Disables a user’s account.
“ACCOUNT_ENABLE_MFA”: Enforces a user to perform a multi-factor authentication before being forced to change their password.
“ACCOUNT_RESET_PASSWORD”: Requests to reset the password for a user’s account.
NOTE: Before using ACCOUNT_ENABLE_MFA and ACCOUNT_RESET_PASSWORD, you need to assign the Administrator role to Cloud App Security.
For more information, see https://docs.trendmicro.com/en-us/enterprise/cloud-app-security-integration-api-online-help/supported-cloud-app-_001/threat-mitigation-ap/take-actions-on-user/assigning-the-user-a.aspx.		 Required
account_user_email Comma separated email addresses to take action. Required

Context Output

Path Type Description
TrendMicroCAS.UserTakeAction.action_type String The type of the action.
TrendMicroCAS.UserTakeAction.account_user_email String The list of user accounts for the action.
TrendMicroCAS.UserTakeAction.batch_id String The unique ID of the API request, including all actions to take on user accounts specified within this request.
TrendMicroCAS.UserTakeAction.traceId String Randomly generated ID to uniquely trace the request.

Command Example

!trendmicro-cas-user-take-action action_type=ACCOUNT_DISABLE account_user_email=ser@onmicrosoft.com

Context Example

{
    "TrendMicroCAS": {
        "UserTakeAction": {
            "account_user_email": [
                "ser@onmicrosoft.com"
            ],
            "action_type": "ACCOUNT_DISABLE",
            "batch_id": "84266eaa-fe0b-4071-855d-423317a4c139",
            "traceId": "fb8aacbb-c6ab-4f99-825f-3a6f266cff15"
        }
    }
}

Human Readable Output

Action: ACCOUNT_DISABLE on users: [‘avishai@demistodev.onmicrosoft.com’] was initiated

account_user_email action_type batch_id traceId
ser@onmicrosoft.com ACCOUNT_DISABLE 84266eaa-fe0b-4071-855d-423317a4c139 fb8aacbb-c6ab-4f99-825f-3a6f266cff15

trendmicro-cas-email-take-action

Takes action on a batch of specified email messages, such as deleting and quarantining email messages.
Relevant for office365 exchange only.

Base Command

trendmicro-cas-email-take-action

Input

Argument Name Description Required
action_type The action to take on an email message, such as delete or quarantine. Can be:
“MAIL_DELETE”, or “MAIL_QUARANTINE”.		 Required
mailbox The email address of an email message for which to take action. Required
mail_message_id The Internet message ID of an email message for which to take action.
To retrieve the ID, use the “trendmicro-cas-email-sweep” command.		 Required
mail_unique_id The unique ID of an email message for which to take action.
To retrieve the ID, use the “trendmicro-cas-email-sweep” command.		 Required
mail_message_delivery_time The time and date when an email message sent
To retrieve the information, use the “trendmicro-cas-email-sweep” command.		 Required

Context Output

Path Type Description
TrendMicroCAS.EmailTakeAction.action_type String The type of action taken on an email message.
TrendMicroCAS.EmailTakeAction.batch_id String The unique ID of the API request.
TrendMicroCAS.EmailTakeAction.mailbox String The email address to take action.
TrendMicroCAS.EmailTakeAction.traceId String Randomly generated ID to trace the request.

Command Example

!trendmicro-cas-email-take-action action_type=MAIL_DELETE mail_message_delivery_time=2020-08-08T03:20:53.000Z mail_message_id=<0d25a1993958467e92fe6243427e9c92@WIN-MICMSOEE1BU.demisto.int> mail_unique_id=AAMkAGY3OTQyMzMzLWYxNjktNDE0My05NmZhLWQ5MGY1YjIyNzBkNABGAAAAAACYCKjWAnXBTrnhgWJCcLX7BwDrxRwRjq-zTrN6vWSzK4OWAAAAAAEMAADrxRwRjq-zTrN6vWSzK4OWAAOn2KLJAAA= mailbox=ser@onmicrosoft.com

Context Example

{
    "TrendMicroCAS": {
        "EmailTakeAction": {
            "action_type": "MAIL_DELETE",
            "batch_id": "73534edc-011b-4318-a8ca-942af948434e",
            "mailbox": "ser@onmicrosoft.com",
            "traceId": "63c5ee4e-ec52-4124-9052-852e9f894f33"
        }
    }
}

Human Readable Output

Action: MAIL_DELETE on mailbox: avishai@demistodev.onmicrosoft.com was initiated

action_type batch_id mailbox traceId
MAIL_DELETE 73534edc-011b-4318-a8ca-942af948434e ser@onmicrosoft.com 63c5ee4e-ec52-4124-9052-852e9f894f33

trendmicro-cas-user-action-result-query

Queries the results of actions taken on a user’s account.

Base Command

trendmicro-cas-user-action-result-query

Input

Argument Name Description Required
batch_id The unique ID of the action taken. Retrieve the ID from the “trendmicro-cas-email-take-action” command. Optional
start The start time to retrieve action results within a time period, using the date and time format ISO 8601. For example, 2020-08-01T02:31:20Z or in human-readable format. For example, “in 1 day” or “3 weeks ago”.
If using start, end is required.		 Optional
end The end time to retrieve action results within a time period, using the date and time format ISO 8601. For example, 2020-08-01T02:31:20Z or in human-readable format. For example, “in 1 day” or “3 weeks ago”.
If using end, start is required. Ensure the end time is not earlier than the start time.		 Optional
limit The Maximum number of action results to display. Default (and maximum) is 500. Optional

Context Output

Path Type Description
TrendMicroCAS.UserActionResult.account_provider String The supplier of the protected service.
TrendMicroCAS.UserActionResult.account_user_email String The email address on which the action was taken.
TrendMicroCAS.UserActionResult.action_executed_at Date The time and date when the action was processed.
TrendMicroCAS.UserActionResult.action_id String The unique ID of a threat mitigation task.
TrendMicroCAS.UserActionResult.action_requested_at Date The time and date when the API request was received.
TrendMicroCAS.UserActionResult.action_type String The action taken on a user’s account.
TrendMicroCAS.UserActionResult.batch_id String The unique ID of a Threat Mitigation API request.
TrendMicroCAS.UserActionResult.error_code Number The result code of the action.
TrendMicroCAS.UserActionResult.error_message String The string of the result code. For example, 0: success.
TrendMicroCAS.UserActionResult.service String The name of the protected service.
TrendMicroCAS.UserActionResult.status String The status of the action. Can be: “Created”: The API request was received. “Executing”: The action is executing. “Success”: The action was successful. “Skipped”: The action was skipped. “Failed”: The action failed.

Command Example

!trendmicro-cas-user-action-result-query batch_id=e9397872-9f6c-4c92-9bdc-45cc7fefaa86

Context Example

{
    "TrendMicroCAS": {
        "UserActionResult": {
            "account_provider": "office365",
            "account_user_email": "ser@onmicrosoft.com",
            "action_executed_at": "2020-08-09T23:27:15.620Z",
            "action_id": "56222d76-5a49-4b73-aadd-7e8e439c7f10",
            "action_requested_at": "2020-08-09T23:27:12.216Z",
            "action_type": "ACCOUNT_DISABLE",
            "batch_id": "e9397872-9f6c-4c92-9bdc-45cc7fefaa86",
            "error_code": -999,
            "error_message": "graph api exception, message=One or more errors occurred.",
            "service": "exchange",
            "status": "Failed"
        }
    }
}

Human Readable Output

Action Result

action_id status action_type account_user_email action_executed_at error_message
56222d76-5a49-4b73-aadd-7e8e439c7f10 Failed ACCOUNT_DISABLE ser@onmicrosoft.com 2020-08-09T23:27:15.620Z graph api exception, message=One or more errors occurred.

trendmicro-cas-email-action-result-query

Queries the results of actions taken for email messages.

Base Command

trendmicro-cas-email-action-result-query

Input

Argument Name Description Required
batch_id The unique ID of the action taken. Retrieve the ID from the “trendmicro-cas-email-take-action” command. Optional
start The start time to retrieve action results within a time period, using the date and time format ISO 8601. For example, 2020-08-01T02:31:20Z or in human-readable format. For example, “in 1 day” or “3 weeks ago”.
If using start, end is required.		 Optional
end The end time to retrieve action results within a time period, using the date and time format ISO 8601. For example, 2020-08-01T02:31:20Z or in human-readable format. For example, “in 1 day” or “3 weeks ago”.
If using end, start is required. Ensure the end time is not earlier than the start time.		 Optional
limit The maximum number of action results to display. Default (and maximum) is 500. Optional

Context Output

Path Type Description
TrendMicroCAS.EmailActionResult.account_provider String The supplier of the protected service.
TrendMicroCAS.EmailActionResult.account_user_email String The email address on which the action was taken.
TrendMicroCAS.EmailActionResult.action_executed_at Date The time and date when the action was processed.
TrendMicroCAS.EmailActionResult.action_id String The unique ID of a threat mitigation task.
TrendMicroCAS.EmailActionResult.action_requested_at Date The time and date when the API request was received.
TrendMicroCAS.EmailActionResult.action_type String The action taken on an email message.
TrendMicroCAS.EmailActionResult.batch_id String The unique ID of a Threat Mitigation API request.
TrendMicroCAS.EmailActionResult.error_code Number The result code of the action.
TrendMicroCAS.EmailActionResult.error_message String The string of the result code. For example, 0: success.
TrendMicroCAS.EmailActionResult.service String The name of the protected service,
TrendMicroCAS.EmailActionResult.status String The status of the action. Can be: “Created”: The API request was received. “Executing”: The action is executing. “Success”: The action was successful. “Skipped”: The action was skipped. “Failed”: The action failed.
TrendMicroCAS.EmailActionResult.mail_unique_id String The unique ID of an email message on which an action was taken.
TrendMicroCAS.EmailActionResult.mail_message_id String The Internet message ID of an email message on which an action was taken.
TrendMicroCAS.EmailActionResult.mailbox String The email address of an email message on which an action was taken.

Command Example

!trendmicro-cas-email-action-result-query batch_id=c3fba8cb-3736-4208-bf8b-a09e1aea9d9f

Context Example

{
    "TrendMicroCAS": {
        "EmailActionResult": {
            "account_provider": "office365",
            "account_user_email": "ser@onmicrosoft.com",
            "action_executed_at": "2020-08-09T23:25:13.973Z",
            "action_id": "1c46ef63-04d8-46dc-a17d-653223c40728",
            "action_requested_at": "2020-08-09T23:25:12.943Z",
            "action_type": "MAIL_DELETE",
            "batch_id": "c3fba8cb-3736-4208-bf8b-a09e1aea9d9f",
            "error_code": 0,
            "error_message": "",
            "mail_message_id": "<0d25a1993958467e92fe6243427e9c92@WIN-MICMSOEE1BU.demisto.int>",
            "mail_unique_id": "AAMkAGY3OTQyMzMzLWYxNjktNDE0My05NmZhLWQ5MGY1YjIyNzBkNABGAAAAAACYCKjWAnXBTrnhgWJCcLX7BwDrxRwRjq-zTrN6vWSzK4OWAAAAAAEMAADrxRwRjq-zTrN6vWSzK4OWAAOn2KLJAAA=",
            "mailbox": "ser@onmicrosoft.com",
            "service": "exchange",
            "status": "Success"
        }
    }
}

Human Readable Output

Action Result

action_id status action_type account_user_email action_executed_at error_message
1c46ef63-04d8-46dc-a17d-653223c40728 Success MAIL_DELETE ser@onmicrosoft.com 2020-08-09T23:25:13.973Z  

trendmicro-cas-blocked-lists-get

Retrieves all blocked senders, URLs, and SHA-1 hash values that have been configured to quarantine Exchange Online email messages.

Base Command

trendmicro-cas-blocked-lists-get

Input

There are no input arguments for this command.

Context Output

Path Type Description
TrendMicroCAS.BlockedList.filehashes String A list of blocked configured SHA-1 hash values.
TrendMicroCAS.BlockedList.senders String A list of configured blocked senders.
TrendMicroCAS.BlockedList.urls String A list of blocked configured URLs.

Command Example


#### Context Example

{
“TrendMicroCAS”: {
“BlockedList”: {
“filehashes”: [
“f3cdddb37f6a933d6a256bd98b4bc703a448c621”
],
“senders”: [
“456@gmail.com”,
“123@gmail.com”
],
“urls”: [
“fttg.com/”,
“ubb.com/”,
“ggyu.com/”
]
}
}
}


#### Human Readable Output

>### Blocked List
>
>|filehashes|senders|urls|
>|---|---|---|
>| f3cdddb37f6a933d6a256bd98b4bc703a448c621 | 456@gmail.com,<br/>123@gmail.com | fttg.com/,<br/>ubb.com/,<br/>ggyu.com/ |

### trendmicro-cas-blocked-lists-update

***
Adds or removes senders, URLs, SHA-1 hash values to or from blocked lists. You must specify one of senders, urls, or filehashes.

#### Base Command

`trendmicro-cas-blocked-lists-update`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| action_type | The type of the action to take. Can be: "create", to add to the blocked lists, or<br/>"delete", to remove from the blocked lists. | Required |
| senders | Comma separated email addresses from which the email message is sent to update.         | Optional |
| urls | Comma separated URLs included in an email message to update.         | Optional |
| filehashes | Comma separated SHA-1 hash values of an email attachment to update.         | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| TrendMicroCAS.BlockedList.filehashes | String | A list of blocked SHA\-1 hash values. |
| TrendMicroCAS.BlockedList.senders | String | A list of blocked senders. |
| TrendMicroCAS.BlockedList.urls | String | A list of blocked URLs. |

#### Command Example

```!trendmicro-cas-blocked-lists-update action_type=create urls=ubb.com,ggyu.com filehashes=f3cdddb37f6a933d6a256bd98b4bc703a448c621 senders=123@gmail.com,456@gmail.com```

#### Context Example

{
“TrendMicroCAS”: {
“BlockedList”: {
“filehashes”: [
“f3cdddb37f6a933d6a256bd98b4bc703a448c621”
],
“senders”: [
“123@gmail.com”,
“456@gmail.com”
],
“urls”: [
“ubb.com”,
“ggyu.com”
]
}
}
}
```

Human Readable Output

Add rules successfully

filehashes senders urls
f3cdddb37f6a933d6a256bd98b4bc703a448c621 123@gmail.com,
456@gmail.com		 ubb.com,
ggyu.com

Configuration parameters

  • serviceURL — Service URL (required)
  • token — Token
  • credentials_token —
  • service — Service event to fetch
  • event_type — Event type to fetch
  • max_fetch — Maximum number of incidents per fetch
  • first_fetch — First fetch time
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • isFetch — Fetch incidents

Commands (8)

  • trendmicro-cas-blocked-lists-get

    Retrieves all blocked senders, URLs, and SHA-1 hash values that have been configured to quarantine Exchange Online email messages.

  • trendmicro-cas-blocked-lists-update

    Adds or removes senders, URLs, SHA-1 hash values to or from blocked lists. You must specify one of senders, urls, or filehashes.

  • trendmicro-cas-email-action-result-query

    Queries the results of actions taken for email messages.

  • trendmicro-cas-email-sweep

    Searches for email messages in mailboxes, matching search criteria.

  • trendmicro-cas-email-take-action

    Takes action on a batch of specified email messages, such as deleting and quarantining email messages. Relevant for office365 exchange only.

  • trendmicro-cas-security-events-list

    Retrieves security event logs of services.

  • trendmicro-cas-user-action-result-query

    Queries the results of actions taken on a user's account.

  • trendmicro-cas-user-take-action

    Takes action on a batch of specified user accounts, such as disabling users accounts, requesting multi-factor authentication, and requesting to reset a password for users accounts. Relevant for office365 exchange only.

Source

TrendMicroCAS.py TrendMicroCAS_test.py TrendMicroCAS.yml TrendMicroCAS_description.md
Download History Raw 
category: Authentication & Identity Management
provider: TrendAI™
sectionorder:
- Connect
- Collect
commonfields:
  id: TrendMicro Cloud App Security
  version: -1
configuration:
- additionalinfo: The place where your Cloud App Security service is hosted
  defaultvalue: U.S.A
  display: Service URL
  name: serviceURL
  options:
  - U.S.A
  - EU
  - Japan
  - Australia and New Zealand
  - UK
  - Canada
  - India
  - Singapore
  - Middle East (UAE)
  required: true
  type: 15
  section: Connect
- display: Token
  name: token
  required: false
  type: 4
  section: Connect
  hidden: true
- displaypassword: Token
  name: credentials_token
  required: false
  hiddenusername: true
  type: 9
  section: Connect
- display: Service event to fetch
  name: service
  options:
  - exchange
  - sharepoint
  - onedrive
  - dropbox
  - box
  - googledrive
  - gmail
  - teams
  - exchangeserver
  type: 16
  section: Collect
  required: false
- display: Event type to fetch
  name: event_type
  options:
  - securityrisk
  - virtualanalyzer
  - ransomware
  - dlp
  type: 16
  section: Collect
  required: false
- defaultvalue: '50'
  display: Maximum number of incidents per fetch
  name: max_fetch
  type: 0
  section: Collect
  required: false
- defaultvalue: 3 days
  display: First fetch time
  name: first_fetch
  type: 0
  section: Collect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Incident type
  name: incidentType
  section: Collect
  required: false
  type: 13
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- display: Fetch incidents
  name: isFetch
  required: false
  section: Collect
  type: 8
description: 'Use TrendAI™ Cloud App Security integration to protect against ransomware, phishing, malware, and unauthorized transmission of sensitive data for cloud applications, such as Microsoft 365, Box, Dropbox, Google G Suite and Salesforce.'
display: TrendAI™ Cloud App Security
name: TrendMicro Cloud App Security
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      description: 'Name of the protected service whose logs you want to retrieve. Can be: "exchange", "sharepoint", "onedrive", "dropbox", "box", "googledrive", "gmail", "teams", or "exchangeserver".'
      name: service
      predefined:
      - exchange
      - sharepoint
      - onedrive
      - dropbox
      - box
      - googledrive
      - gmail
      - teams
      - exchangeserver
      required: true
    - auto: PREDEFINED
      description: 'Type of the security event whose logs you want to retrieve. Can be: "securityrisk", "virtualanalyzer", "ransomware", or "dlp".'
      name: event_type
      predefined:
      - securityrisk
      - virtualanalyzer
      - ransomware
      - dlp
      required: true
    - description: |-
        The start time to retrieve logs, using the date and time format ISO 8601. For example, 2020-08-01T02:31:20Z or in human-readable format. For example, "in 1 day" or "3 weeks ago".
        The request retrieves logs within a maximum of 72 hours before the request is sent.
        If a start time is added, the request retrieves all from the start time.
        If a start and end time are added, the request retrieves logs within the configured duration.
        If start and end times are not added, the request retrieves logs within 5 minutes before the request is sent.        
      name: start
    - description: |-
        The end time to retrieve logs, using the date and time format ISO 8601. For example, 2020-08-01T02:31:20Z or in human-readable format. For example, "in 1 day" or "3 weeks ago".
        The request retrieves logs within a maximum of 72 hours before request is sent.
        If an end time is added, the request retrieves logs within five minutes before the end time.
        If start and end are added, the request retrieves logs within the configured duration. Ensure the end time is no earlier than the start time.
        If the start and end times are not added, the request retrieves logs within 5 minutes before the request is sent.        
      name: end
    - description: The maximum number of log items to display. Default is 50 and Maximum is 500.
      name: limit
    - description: The URL for the results page if the total number of log items in a previous request exceeds the specified limit. When the maximum log items exceeds the limit, a URL is specified in the response. To retrieve the remaining log items, use the URL from the response.
      name: next_link
    description: Retrieves security event logs of services.
    name: trendmicro-cas-security-events-list
    outputs:
    - contextPath: TrendMicroCAS.Events.last_log_item_generation_time
      description: The time and date when the last log item in the current request was generated.
      type: Date
    - contextPath: TrendMicroCAS.Events.next_link
      description: URL for the follow-up request if the requested logs exceed the specified limit to display at a time. Use this URL to form a second request.
      type: String
    - contextPath: TrendMicroCAS.Events.security_events.event
      description: The type of the requested security event.
      type: String
    - contextPath: TrendMicroCAS.Events.security_events.log_item_id
      description: The ID of a log item.
      type: String
    - contextPath: TrendMicroCAS.Events.security_events.message.action
      description: The action that Cloud App Security took after detecting the security event.
      type: String
    - contextPath: TrendMicroCAS.Events.security_events.message.action_result
      description: The result of the action.
      type: String
    - contextPath: TrendMicroCAS.Events.security_events.message.affected_user
      description: The Mailbox that received an email message triggering the security event, or the user account that uploaded or modified a file triggering the security event.
      type: String
    - contextPath: TrendMicroCAS.Events.security_events.message.detected_by
      description: The technology or method through which the email message or file triggering the security event was detected.
      type: String
    - contextPath: TrendMicroCAS.Events.security_events.message.detection_time
      description: The time and date when the security event was detected.
      type: Date
    - contextPath: TrendMicroCAS.Events.security_events.message.location
      description: The location where the security event was detected.
      type: String
    - contextPath: TrendMicroCAS.Events.security_events.message.log_item_id
      description: The ID of the log item.
      type: String
    - contextPath: TrendMicroCAS.Events.security_events.message.mail_message_delivery_time
      description: The time and date when the email message triggering the security event was sent.
      type: Date
    - contextPath: TrendMicroCAS.Events.security_events.message.mail_message_file_name
      description: The name of the email attachment that triggered the security event.
      type: String
    - contextPath: TrendMicroCAS.Events.security_events.message.mail_message_id
      description: The ID of the email message that triggered the security event.
      type: String
    - contextPath: TrendMicroCAS.Events.security_events.message.mail_message_recipient
      description: The Email address of the recipient.
      type: String
    - contextPath: TrendMicroCAS.Events.security_events.message.mail_message_sender
      description: The Email address of the sender.
      type: String
    - contextPath: TrendMicroCAS.Events.security_events.message.mail_message_subject
      description: The subject of the email message that triggered the security event.
      type: String
    - contextPath: TrendMicroCAS.Events.security_events.message.mail_message_submit_time
      description: The time and date when the email message triggering the security event was received.
      type: Date
    - contextPath: TrendMicroCAS.Events.security_events.message.file_name
      description: The name of the file that triggered the security event.
      type: String
    - contextPath: TrendMicroCAS.Events.security_events.message.file_upload_time
      description: The time and date when the file triggering the security event was uploaded.
      type: Date
    - contextPath: TrendMicroCAS.Events.security_events.message.risk_level
      description: The web reputation risk level assigned to the analyzed URL that triggered the security event.
      type: String
    - contextPath: TrendMicroCAS.Events.security_events.message.scan_type
      description: A real-time scan or manual scan that detected the security event.
      type: String
    - contextPath: TrendMicroCAS.Events.security_events.message.security_risk_name
      description: The name of the security risk detected.
      type: String
    - contextPath: TrendMicroCAS.Events.security_events.message.triggered_policy_name
      description: The name of a configured policy that was violated.
      type: String
    - contextPath: TrendMicroCAS.Events.security_events.message.triggered_security_filter
      description: The name of the security filter that detected the security event.
      type: String
    - contextPath: TrendMicroCAS.Events.security_events.message.virus_name
      description: The name of the detected virus.
      type: String
    - contextPath: TrendMicroCAS.Events.security_events.message.file_sha1
      description: The SHA-1 hash value of the file that triggered the security event.
      type: String
    - contextPath: TrendMicroCAS.Events.security_events.message.detection_type
      description: The type of the suspicious object that triggered the security event.
      type: String
    - contextPath: TrendMicroCAS.Events.security_events.message.ransomware_name
      description: The name of the detected ransomware.
      type: String
    - contextPath: TrendMicroCAS.Events.security_events.message.triggered_dlp_template
      description: The details of the compliance template that was violated to trigger the security event.
      type: String
    - contextPath: TrendMicroCAS.Events.security_events.service
      description: The name of the requested service.
      type: String
    - contextPath: TrendMicroCAS.Events.traceId
      description: The randomly generated ID to trace the request.
      type: String
  - arguments:
    - description: |-
        The Email address of the mailbox for which to search.
        A non-prefix wildcard is supported. For example, u*ser@gmail.com or user@gm*ail.com.
      name: mailbox
    - description: |-
        The number of days (n × 24 hours) before the request is sent to search.
        Do not configure lastndays and start/end at the same time.
      name: lastndays
    - description: |-
        The start time to search for email messages using the date and time format ISO 8601. For example, 2020-08-01T02:31:20Z or in human-readable format. For example, "in 1 day" or "3 weeks ago".
        The request searches email messages according to the following settings:
        If both start and end are not added, the request searches email messages within seven days (7 × 24 hours) before the request was sent.
        If both start and end are added, the request searches email messages within this configured duration. Ensure the end time is no earlier than the start time.
        If only start is added, the request searches email messages within seven days (7 × 24 hours) after the start time.
        If only end is added, the request searches email messages within seven days (7 × 24 hours) before the end time.
        Do not configure lastndays and start/end at the same time.
      name: start
    - description: |-
        The end time to search for email messages using the date and time format ISO 8601. For example, 2020-08-01T02:31:20Z or in human-readable format. For example, "in 1 day" or "3 weeks ago".
        Cloud App Security saves the meta information of email messages for 90 days.
        The request searches email messages according to the following settings:
        If both start and end are not added, the request searches email messages within seven days (7 × 24 hours) before the request was sent.
        If both start and end are added, the request searches email messages within this duration. Ensure the end time is no earlier than the start time.
        If only start is added, the request searches email messages within seven days (7 × 24 hours) after the start time.
        If only end is added, the request searches email messages within seven days (7 × 24 hours) before the end time.
        Do not configure lastndays and start/end at the same time.
      name: end
    - description: |-
        The subject of email messages for which to search. Use double quotes to search for an exact phrase, for example, "messageA messageB"
        otherwise a partial match based on the phrase is performed. For example, 
        a search is performed on a subject containing messageA, or messageB, or messageA message B.
      name: subject
    - description: The SHA-1 hash value of the attachment file for which to search.
      name: file_sha1
    - description: 'The name of the attachment file for which to search, with or without a filename extension. A non-prefix wildcard is supported. For example, me*ssage.'
      name: file_name
    - description: 'The filename extension of attachment files for which to search without a period ".". A non-prefix wildcard is supported. For example, do*.'
      name: file_extension
    - description: |-
        The URL contained in an email body or in an attachment for which to search. Type the
        full URL. 
      name: url
    - description: 'The email address of the sender for which to search. Type the full email address. A non-prefix wildcard is supported. For example, u*ser@gmail.com.'
      name: sender
    - description: 'The email address of the recipient for which to search. Type the full email address. A non-prefix wildcard is supported. For example, u*ser@gmail.com.'
      name: recipient
    - description: The Internet message ID of the email message for which to search.  Can be obtained from Microsoft Graph API or EWS API.
      name: message_id
    - description: 'The Source IP address, with or without a subnet mask, of the email message to search. For example, xx.yy.zz.ww or xx.yy.zz.ww/16.'
      name: source_ip
    - description: The Source domain of email messages for which to search. Type a complete domain name. A non-prefix wildcard is supported. For example, gm*ail.com.
      name: source_domain
    - description: The maximum number of email messages to display. Maximum is 1,000 email messages. If not specified, default is 20.
      name: limit
    - description: The URL for the results page if the total number of email messages in a previous request exceeds the specified limit. When the maximum limit has been exceeded, a URL is specified in the response. To retrieve the remaining email messages, use the URL from the response.
      name: next_link
    description: Searches for email messages in mailboxes, matching search criteria.
    name: trendmicro-cas-email-sweep
    outputs:
    - contextPath: TrendMicroCAS.EmailSweep.next_link
      description: URL for the follow-up request if the requested email messages exceed the specified limit to display at a time. Use this URL to form a second request.
      type: String
    - contextPath: TrendMicroCAS.EmailSweep.traceId
      description: The randomly generated ID to trace the request.
      type: String
    - contextPath: TrendMicroCAS.EmailSweep.value.mail_attachments.file_sha1
      description: The SHA-1 hash value of the attachment file.
      type: String
    - contextPath: TrendMicroCAS.EmailSweep.value.mail_attachments.file_name
      description: The name of the attachment file.
      type: String
    - contextPath: TrendMicroCAS.EmailSweep.value.mail_internet_headers.HeaderName
      description: The Internet header name of the email address.
      type: String
    - contextPath: TrendMicroCAS.EmailSweep.value.mail_internet_headers.Value
      description: The email address of the sender.
      type: String
    - contextPath: TrendMicroCAS.EmailSweep.value.mail_message_delivery_time
      description: The time and date when the email message was sent.
      type: Date
    - contextPath: TrendMicroCAS.EmailSweep.value.mail_message_id
      description: The Internet message ID of the email message.
      type: String
    - contextPath: TrendMicroCAS.EmailSweep.value.mail_message_recipient
      description: A list of recipient email addresses of the email message.
      type: String
    - contextPath: TrendMicroCAS.EmailSweep.value.mail_message_sender
      description: The email address of the sender.
      type: String
    - contextPath: TrendMicroCAS.EmailSweep.value.mail_message_subject
      description: The subject of the email message.
      type: String
    - contextPath: TrendMicroCAS.EmailSweep.value.mail_unique_id
      description: The ID of the email message.
      type: String
    - contextPath: TrendMicroCAS.EmailSweep.value.mail_urls
      description: The URL contained in the email body or attachment.
      type: String
    - contextPath: TrendMicroCAS.EmailSweep.value.mailbox
      description: The mailbox which contains the email message.
      type: String
    - contextPath: TrendMicroCAS.EmailSweep.value.source_domain
      description: The source domain of the email message.
      type: String
    - contextPath: TrendMicroCAS.EmailSweep.value.source_ip
      description: The source IP address of the email message.
      type: String
  - arguments:
    - auto: PREDEFINED
      description: |-
        Action to take on a user's account. Can be: 
        "ACCOUNT_DISABLE": Disables a user's account.
        "ACCOUNT_ENABLE_MFA": Enforces a user to perform a multi-factor authentication before being forced to change their password.
        "ACCOUNT_RESET_PASSWORD": Requests to reset the password for a user's account.
        NOTE: Before using ACCOUNT_ENABLE_MFA and ACCOUNT_RESET_PASSWORD, you need to assign the Administrator role to Cloud App Security.
        For more information, see https://docs.trendmicro.com/en-us/enterprise/cloud-app-security-integration-api-online-help/supported-cloud-app-_001/threat-mitigation-ap/take-actions-on-user/assigning-the-user-a.aspx.
      name: action_type
      predefined:
      - ACCOUNT_DISABLE
      - ACCOUNT_ENABLE_MFA
      - ACCOUNT_RESET_PASSWORD
      required: true
    - description: Comma separated email addresses to take action.
      isArray: true
      name: account_user_email
      required: true
    description: |-
      Takes action on a batch of specified user accounts, such as disabling users accounts, 
      requesting multi-factor authentication, and requesting to reset a password for users accounts.
      Relevant for office365 exchange only.
    name: trendmicro-cas-user-take-action
    outputs:
    - contextPath: TrendMicroCAS.UserTakeAction.action_type
      description: The type of the action.
      type: String
    - contextPath: TrendMicroCAS.UserTakeAction.account_user_email
      description: The list of user accounts for the action.
      type: String
    - contextPath: TrendMicroCAS.UserTakeAction.batch_id
      description: The unique ID of the API request, including all actions to take on user accounts specified within this request.
      type: String
    - contextPath: TrendMicroCAS.UserTakeAction.traceId
      description: Randomly generated ID to uniquely trace the request.
      type: String
  - arguments:
    - auto: PREDEFINED
      description: |-
        The action to take on an email message, such as delete or quarantine. Can be:
        "MAIL_DELETE", or "MAIL_QUARANTINE".
      name: action_type
      predefined:
      - MAIL_DELETE
      - MAIL_QUARANTINE
      required: true
    - description: The email address of an email message for which to take action.
      name: mailbox
      required: true
    - description: |-
        The Internet message ID of an email message for which to take action. 
        To retrieve the ID, use the "trendmicro-cas-email-sweep" command.
      name: mail_message_id
      required: true
    - description: |-
        The unique ID of an email message for which to take action.
        To retrieve the ID, use the "trendmicro-cas-email-sweep" command.
      name: mail_unique_id
      required: true
    - description: |-
        The time and date when an email message sent
        To retrieve the information, use the "trendmicro-cas-email-sweep" command.
      name: mail_message_delivery_time
      required: true
    description: |-
      Takes action on a batch of specified email messages, such as deleting and quarantining email messages.
      Relevant for office365 exchange only.
    name: trendmicro-cas-email-take-action
    outputs:
    - contextPath: TrendMicroCAS.EmailTakeAction.action_type
      description: The type of action taken on an email message.
      type: String
    - contextPath: TrendMicroCAS.EmailTakeAction.batch_id
      description: The unique ID of the API request.
      type: String
    - contextPath: TrendMicroCAS.EmailTakeAction.mailbox
      description: The email address to take action.
      type: String
    - contextPath: TrendMicroCAS.EmailTakeAction.traceId
      description: Randomly generated ID to trace the request.
      type: String
  - arguments:
    - description: The unique ID of the action taken. Retrieve the ID from the "trendmicro-cas-email-take-action" command.
      name: batch_id
    - description: |-
        The start time to retrieve action results within a time period, using the date and time format ISO 8601. For example, 2020-08-01T02:31:20Z or in human-readable format. For example, "in 1 day" or "3 weeks ago".
        If using start, end is required.
      name: start
    - description: |-
        The end time to retrieve action results within a time period, using the date and time format ISO 8601. For example, 2020-08-01T02:31:20Z or in human-readable format. For example, "in 1 day" or "3 weeks ago".
        If using end, start is required. Ensure the end time is not earlier than the start time.
      name: end
    - description: The Maximum number of action results to display. Default (and maximum) is 500.
      name: limit
    description: Queries the results of actions taken on a user's account.
    name: trendmicro-cas-user-action-result-query
    outputs:
    - contextPath: TrendMicroCAS.UserActionResult.account_provider
      description: The supplier of the protected service.
      type: String
    - contextPath: TrendMicroCAS.UserActionResult.account_user_email
      description: The email address on which the action was taken.
      type: String
    - contextPath: TrendMicroCAS.UserActionResult.action_executed_at
      description: The time and date when the action was processed.
      type: Date
    - contextPath: TrendMicroCAS.UserActionResult.action_id
      description: The unique ID of a threat mitigation task.
      type: String
    - contextPath: TrendMicroCAS.UserActionResult.action_requested_at
      description: The time and date when the API request was received.
      type: Date
    - contextPath: TrendMicroCAS.UserActionResult.action_type
      description: The action taken on a user's account.
      type: String
    - contextPath: TrendMicroCAS.UserActionResult.batch_id
      description: The unique ID of a Threat Mitigation API request.
      type: String
    - contextPath: TrendMicroCAS.UserActionResult.error_code
      description: The result code of the action.
      type: Number
    - contextPath: TrendMicroCAS.UserActionResult.error_message
      description: 'The string of the result code. For example, 0: success.'
      type: String
    - contextPath: TrendMicroCAS.UserActionResult.service
      description: The name of the protected service.
      type: String
    - contextPath: TrendMicroCAS.UserActionResult.status
      description: 'The status of the action. Can be: "Created": The API request was received. "Executing": The action is executing. "Success": The action was successful. "Skipped": The action was skipped. "Failed": The action failed.'
      type: String
  - arguments:
    - description: The unique ID of the action taken. Retrieve the ID from the "trendmicro-cas-email-take-action" command.
      name: batch_id
    - description: |-
        The start time to retrieve action results within a time period, using the date and time format ISO 8601. For example, 2020-08-01T02:31:20Z or in human-readable format. For example, "in 1 day" or "3 weeks ago".
        If using start, end is required.         
      name: start
    - description: |-
        The end time to retrieve action results within a time period, using the date and time format ISO 8601. For example, 2020-08-01T02:31:20Z or in human-readable format. For example, "in 1 day" or "3 weeks ago".
        If using end, start is required. Ensure the end time is not earlier than the start time.
      name: end
    - description: The maximum number of action results to display. Default (and maximum) is 500.
      name: limit
    description: Queries the results of actions taken for email messages.
    name: trendmicro-cas-email-action-result-query
    outputs:
    - contextPath: TrendMicroCAS.EmailActionResult.account_provider
      description: The supplier of the protected service.
      type: String
    - contextPath: TrendMicroCAS.EmailActionResult.account_user_email
      description: The email address on which the action was taken.
      type: String
    - contextPath: TrendMicroCAS.EmailActionResult.action_executed_at
      description: The time and date when the action was processed.
      type: Date
    - contextPath: TrendMicroCAS.EmailActionResult.action_id
      description: The unique ID of a threat mitigation task.
      type: String
    - contextPath: TrendMicroCAS.EmailActionResult.action_requested_at
      description: The time and date when the API request was received.
      type: Date
    - contextPath: TrendMicroCAS.EmailActionResult.action_type
      description: The action taken on an email message.
      type: String
    - contextPath: TrendMicroCAS.EmailActionResult.batch_id
      description: The unique ID of a Threat Mitigation API request.
      type: String
    - contextPath: TrendMicroCAS.EmailActionResult.error_code
      description: The result code of the action.
      type: Number
    - contextPath: TrendMicroCAS.EmailActionResult.error_message
      description: 'The string of the result code. For example, 0: success.'
      type: String
    - contextPath: TrendMicroCAS.EmailActionResult.service
      description: The name of the protected service.
      type: String
    - contextPath: TrendMicroCAS.EmailActionResult.status
      description: 'The status of the action. Can be: "Created": The API request was received. "Executing": The action is executing. "Success": The action was successful. "Skipped": The action was skipped. "Failed": The action failed.'
      type: String
    - contextPath: TrendMicroCAS.EmailActionResult.mail_unique_id
      description: The unique ID of an email message on which an action was taken.
      type: String
    - contextPath: TrendMicroCAS.EmailActionResult.mail_message_id
      description: The Internet message ID of an email message on which an action was taken.
      type: String
    - contextPath: TrendMicroCAS.EmailActionResult.mailbox
      description: The email address of an email message on which an action was taken.
      type: String
  - description: Retrieves all blocked senders, URLs, and SHA-1 hash values that have been configured to quarantine Exchange Online email messages.
    name: trendmicro-cas-blocked-lists-get
    outputs:
    - contextPath: TrendMicroCAS.BlockedList.filehashes
      description: A list of blocked configured SHA-1 hash values.
      type: String
    - contextPath: TrendMicroCAS.BlockedList.senders
      description: A list of configured blocked senders.
      type: String
    - contextPath: TrendMicroCAS.BlockedList.urls
      description: A list of blocked configured URLs.
      type: String
  - arguments:
    - auto: PREDEFINED
      description: |-
        The type of the action to take. Can be: "create", to add to the blocked lists, or
        "delete", to remove from the blocked lists.
      name: action_type
      predefined:
      - create
      - delete
      required: true
    - description: |-
        Comma separated email addresses from which the email message is sent to update.        
      isArray: true
      name: senders
    - description: |-
        Comma separated URLs included in an email message to update.        
      isArray: true
      name: urls
    - description: |-
        Comma separated SHA-1 hash values of an email attachment to update.        
      isArray: true
      name: filehashes
    description: Adds or removes senders, URLs, SHA-1 hash values to or from blocked lists. You must specify one of senders, urls, or filehashes.
    name: trendmicro-cas-blocked-lists-update
    outputs:
    - contextPath: TrendMicroCAS.BlockedList.filehashes
      description: A list of blocked SHA-1 hash values.
      type: String
    - contextPath: TrendMicroCAS.BlockedList.senders
      description: A list of blocked senders.
      type: String
    - contextPath: TrendMicroCAS.BlockedList.urls
      description: A list of blocked URLs.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests (auto formatted)
fromversion: 5.0.0