FireEye Email Security

FireEye Email Security (EX) series protects against breaches caused by advanced email attacks.

Configuration parameters

url — Your server URL (required)
credentials — Username (required)
isFetch — Fetch incidents
max_fetch — Max incidents to fetch
first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
info_level — Info level for fetched alerts
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

fireeye-ex-create-allowedlist — Creates allowed sender domain.
fireeye-ex-create-blockedlist — Creates the blocked sender domain.
fireeye-ex-delete-allowedlist — Deletes the allowed sender domain.
fireeye-ex-delete-blockedlist — Deletes the blocked sender domain.
fireeye-ex-delete-quarantined-emails — Deletes quarantined emails. This is not available when Email Security is in Drop mode.
fireeye-ex-download-quarantined-emails — Download quarantined emails.
fireeye-ex-get-alert-details — Searches and retrieves the details of a single alert.
fireeye-ex-get-alerts — Searches and retrieves FireEye EX alerts based on several filters.
fireeye-ex-get-artifacts-by-uuid — Downloads malware artifacts data for the specified UUID as a zip file.
fireeye-ex-get-artifacts-metadata-by-uuid — Gets artifacts metadata for the specified UUID.
fireeye-ex-get-quarantined-emails — Searches and retrieves quarantined emails.
fireeye-ex-get-reports — Returns reports on selected alerts.
fireeye-ex-list-allowedlist — Lists the allowed sender domain by type.
fireeye-ex-list-blockedlist — Lists the blocked sender domain by type.
fireeye-ex-release-quarantined-emails — Releases and deletes quarantined emails. This is not available when Email Security is in Drop mode.
fireeye-ex-update-allowedlist — Updates the allowed sender domain.
fireeye-ex-update-blockedlist — Updates the blocked sender domain.