Trellix Email Security Cloud - Indicators Hunting

This playbook queries Trellix Email Security - Cloud for indicators such as domains, IP addresses, sender and recipient email addresses. Separate searches are conducted for each type of indicator in the playbook. Note that multiple search values should be separated by commas only (without spaces or any special characters).

Pack

FireEyeETP

Tasks

21

Inputs

• IPAddress — A single or multiple IP address to search for within Trellix Email Security - Cloud logs. Used for both source and destination IP addresses. Separate multiple search values by commas only (without spaces or any special characters).
• Domain — Single or multiple domains to search for within Trellix Email Security - Cloud logs. By default, the 'contains' clause is used. Separate multiple search values by commas only (without spaces or any special characters).
• EmailAddress — A single or multiple email addresses to search for within Trellix Email Security - Cloud logs. Used for both recipient and sender email addresses. Separate multiple search values by commas only (without spaces or any special characters).
• from_email_not_in — List of sender email addresses to be excluded. The max limit of entries is 10. Separate multiple search values by commas only (without spaces or any special characters).
• recipients_not_in — List of recipient email addresses to be excluded (including "cc"). The max limit of entries is 10. Separate multiple search values by commas only (without spaces or any special characters).
• has_attachments — Boolean value filter to indicate if the message has attachments. Values can be only 'true' or 'false'.
• max_message_size — Select the message size (in KB) based on which you wish to retrieve messages from the Trellix Email Security - Cloud server. The default value is 20 and the maximum value is 100.
• from_accepted_date_time — The start date and time from which you would like to retrieve messages from the Trellix Email Security - Cloud server, e.g. 2017-10-24T10:48:51.000Z. For a complete date range, specify 'to_accepted_date_time' as well.
• to_accepted_date_time — The end date and time specify the period of time in which messages should be retrieved from the Trellix Email Security - Cloud server, e.g. 2017-10-24T10:48:51.000Z. For a complete date range, specify 'from_accepted_date_time' as well.
• last_modified_date_time — The last date and time messages were modified in order to retrieve them from the Trellix Email Security - Cloud server. Dates and times should be accompanied by one of the following operators: ">", "<", ">=", "<=". E.g. use value "<2017-10-24T18:00:00.000Z" to search for messages that were last modified after the specified time stamp.
• status — Filter messages to be retrieved from the Trellix Email Security - Cloud server based on their email message status. Possible values are: "accepted", "deleted", "delivered", "delivered (retroactive)", "dropped", "dropped oob", "dropped (oob retroactive)", "permanent failure", "processing", "quarantined", "rejected", "temporary failure". Separate multiple search values by commas only (without spaces or any special characters).
• status_not_in — Exclude messages from being retrieved from the Trellix Email Security - Cloud server based on the email message status. Possible values are: "accepted", "deleted", "delivered", "delivered (retroactive)", "dropped", "dropped oob", "dropped (oob retroactive)", "permanent failure", "processing", "quarantined", "rejected", "temporary failure". Separate multiple search values by commas only (without spaces or any special characters).
• rejection_reason — Filter messages that should be retrieved from the Trellix Email Security - Cloud server based on the email rejection reason. Possible values are: "ETP102", "ETP103", "ETP104", "ETP200", "ETP201", "ETP203", "ETP204", "ETP205", "ETP300", "ETP301", "ETP302", "ETP401", "ETP402", "ETP403", "ETP404", "ETP405". Separate multiple search values by commas only (without spaces or any special characters).
• subject — Filter messages that should be retrieved from the Trellix Email Security - Cloud server based on the email subject (string). The max limit of entries is 10. Separate multiple search values by commas only (without spaces or any special characters).

Outputs

• FireEyeETP.HuntingResults — Email message objects and fields that were retrieved from Trellix Email Security - Cloud.
• FireEyeETP.HuntingResults.acceptedDateTime — Message accepted date.
• FireEyeETP.HuntingResults.lastModifiedDateTime — Message last modified date.
• FireEyeETP.HuntingResults.countryCode — Sender country code.
• FireEyeETP.HuntingResults.domain — Domain.
• FireEyeETP.HuntingResults.recipientHeader — List of message recipients header (includes the display name of the user).
• FireEyeETP.HuntingResults.recipients — List of message recipients.
• FireEyeETP.HuntingResults.senderHeader — Message sender header (includes the display name of the user).
• FireEyeETP.HuntingResults.sender — Message sender address.
• FireEyeETP.HuntingResults.senderSMTP — Message sender SMTP.
• FireEyeETP.HuntingResults.senderIP — Message sender IP.
• FireEyeETP.HuntingResults.status — Message status.
• FireEyeETP.HuntingResults.subject — Message subject
• FireEyeETP.HuntingResults.id — Message ID.

Commands used

• fireeye-etp-search-messages