FireEye ETP

Trellix Email Security - Cloud is a cloud-based platform that protects against advanced email attacks.

Category

Network Security

Pack

FireEyeETP

Configuration parameters

• server — Server URL (required)
• credentials — Client ID (OAuth)
• oauth_scopes — OAuth Scopes (OAuth)
• token_url — Token URL
• api_key — API key
• credentials_api_key —
• unsecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• isFetch — Fetch incidents
• fetch_time — First fetch timestamp.
• incidentFetchInterval — Incidents Fetch Interval
• incidents_per_fetch — Max incidents per fetch
• incidentType — Incident type
• message_status — Alerts statuses to import

Commands (12)

• fireeye-etp-download-alert-artifact — Downloads all case files of the alert specified by the alert ID, in a zip file. You can obtain the ID from the Alert Summary response, for example "id": "AV7zzRy7kvIwrKcfu0I". Deprecated. Use the fireeye-etp-download-alert-case-files instead.
• fireeye-etp-download-alert-case-files — Downloads all case files of the alert specified by the alert ID, in a zip file. You can obtain the ID from the Alert Summary response, for example "id": "AV7zzRy7kvIwrKcfu0I". The downloaded zip is password protected, and the password is "infected".
• fireeye-etp-download-yara-file — Downloads a YARA file.
• fireeye-etp-get-alert — Detailed information from any particular alert. Alerts more than 90 days old are not available. Deprecated. Use the fireeye-etp-list-alerts instead.
• fireeye-etp-get-alerts — Get summary format information about the alerts. Deprecated. Use the fireeye-etp-list-alerts instead.
• fireeye-etp-get-events-data — Returns all events of the alert by the alert ID.
• fireeye-etp-get-message — Get the data of a specific message.
• fireeye-etp-list-alerts — Get summary format information about the alerts.
• fireeye-etp-list-yara-rulesets — Fetch the list of YARA rulesets and return a list with all the rules.
• fireeye-etp-quarantine-release — Releases the email file present in the quarantine for the given email. Cloud message ID.
• fireeye-etp-search-messages — Search for messages that include specified message attributes that are accessible in the ETP portal.
• fireeye-etp-upload-yara-file — Update or replace the YARA rule file in the existing ruleset.