Trellix Email Security Cloud - Indicators Hunting
This playbook queries Trellix Email Security - Cloud for indicators such as domains, IP addresses, sender and recipient email addresses. Separate searches are conducted for each type of indicator in the playbook. Note that multiple search values should be separated by commas only (without spaces or any special characters).
Trellix Email Security - Cloud · 21 tasks · 14 inputs · 14 outputs
Details
| ID | FireEye ETP - Indicators Hunting |
|---|---|
| From Version | 6.5.0 |
| Tasks | 21 |
README
This playbook queries Trellix Email Security - Cloud for indicators such as domains, IP addresses, sender and recipient email addresses.
Separate searches are conducted for each type of indicator in the playbook.
Note that multiple search values should be separated by commas only (without spaces or any special characters).
Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks
This playbook does not use any sub-playbooks.
Integrations
- Trellix Email Security - Cloud
Scripts
- SetAndHandleEmpty
- IsIntegrationAvailable
Commands
- fireeye-etp-search-messages
Playbook Inputs
| Name | Description | Default Value | Required |
|---|---|---|---|
| IPAddress | A single or multiple IP address to search for within Trellix Email Security - Cloud logs. Used for both source and destination IP addresses. Separate multiple search values by commas only (without spaces or any special characters). |
Optional | |
| Domain | Single or multiple domains to search for within Trellix Email Security - Cloud logs. By default, the ‘contains’ clause is used. Separate multiple search values by commas only (without spaces or any special characters). |
Optional | |
| EmailAddress | A single or multiple email addresses to search for within Trellix Email Security - Cloud logs. Used for both recipient and sender email addresses. Separate multiple search values by commas only (without spaces or any special characters). |
Optional | |
| from_email_not_in | List of sender email addresses to be excluded. The max limit of entries is 10. Separate multiple search values by commas only (without spaces or any special characters). |
Optional | |
| recipients_not_in | List of recipient email addresses to be excluded (including “cc”). The max limit of entries is 10. Separate multiple search values by commas only (without spaces or any special characters). |
Optional | |
| has_attachments | Boolean value filter to indicate if the message has attachments. Values can be only ‘true’ or ‘false’. |
Optional | |
| max_message_size | Select the message size (in KB) based on which you wish to retrieve messages from the Trellix Email Security - Cloud server. The default value is 20 and the maximum value is 100. |
Optional | |
| from_accepted_date_time | The start date and time from which you would like to retrieve messages from the Trellix Email Security - Cloud server, e.g. 2017-10-24T10:48:51.000Z. For a complete date range, specify ‘to_accepted_date_time’ as well. |
Required | |
| to_accepted_date_time | The end date and time specify the period of time in which messages should be retrieved from the Trellix Email Security - Cloud server, e.g. 2017-10-24T10:48:51.000Z. For a complete date range, specify ‘from_accepted_date_time’ as well. |
Required | |
| last_modified_date_time | The last date and time messages were modified in order to retrieve them from the Trellix Email Security - Cloud server. Dates and times should be accompanied by one of the following operators: “>”, “<”, “>=”, “<=”. E.g. use value “<2017-10-24T18:00:00.000Z” to search for messages that were last modified after the specified time stamp. |
Optional | |
| status | Filter messages to be retrieved from the Trellix Email Security - Cloud server based on their email message status. Possible values are: “accepted”, “deleted”, “delivered”, “delivered (retroactive)”, “dropped”, “dropped oob”, “dropped (oob retroactive)”, “permanent failure”, “processing”, “quarantined”, “rejected”, “temporary failure”. Separate multiple search values by commas only (without spaces or any special characters). |
Optional | |
| status_not_in | Exclude messages from being retrieved from the Trellix Email Security - Cloud server based on the email message status. Possible values are: “accepted”, “deleted”, “delivered”, “delivered (retroactive)”, “dropped”, “dropped oob”, “dropped (oob retroactive)”, “permanent failure”, “processing”, “quarantined”, “rejected”, “temporary failure”. Separate multiple search values by commas only (without spaces or any special characters). |
Optional | |
| rejection_reason | Filter messages that should be retrieved from the Trellix Email Security - Cloud server based on the email rejection reason. Possible values are: “ETP102”, “ETP103”, “ETP104”, “ETP200”, “ETP201”, “ETP203”, “ETP204”, “ETP205”, “ETP300”, “ETP301”, “ETP302”, “ETP401”, “ETP402”, “ETP403”, “ETP404”, “ETP405”. Separate multiple search values by commas only (without spaces or any special characters). |
Optional | |
| subject | Filter messages that should be retrieved from the Trellix Email Security - Cloud server based on the email subject (string). The max limit of entries is 10. Separate multiple search values by commas only (without spaces or any special characters). |
Optional |
Playbook Outputs
| Path | Description | Type |
|---|---|---|
| FireEyeETP.HuntingResults | Email message objects and fields that were retrieved from Trellix Email Security - Cloud. | string |
| FireEyeETP.HuntingResults.acceptedDateTime | Message accepted date. | string |
| FireEyeETP.HuntingResults.lastModifiedDateTime | Message last modified date. | string |
| FireEyeETP.HuntingResults.countryCode | Sender country code. | string |
| FireEyeETP.HuntingResults.domain | Domain. | string |
| FireEyeETP.HuntingResults.recipientHeader | List of message recipients header (includes the display name of the user). | string |
| FireEyeETP.HuntingResults.recipients | List of message recipients. | string |
| FireEyeETP.HuntingResults.senderHeader | Message sender header (includes the display name of the user). | string |
| FireEyeETP.HuntingResults.sender | Message sender address. | string |
| FireEyeETP.HuntingResults.senderSMTP | Message sender SMTP. | string |
| FireEyeETP.HuntingResults.senderIP | Message sender IP. | string |
| FireEyeETP.HuntingResults.status | Message status. | string |
| FireEyeETP.HuntingResults.subject | Message subject | string |
| FireEyeETP.HuntingResults.id | Message ID. | string |
Playbook Image
Inputs
IPAddress— A single or multiple IP address to search for within Trellix Email Security - Cloud logs. Used for both source and destination IP addresses. Separate multiple search values by commas only (without spaces or any special characters).Domain— Single or multiple domains to search for within Trellix Email Security - Cloud logs. By default, the 'contains' clause is used. Separate multiple search values by commas only (without spaces or any special characters).EmailAddress— A single or multiple email addresses to search for within Trellix Email Security - Cloud logs. Used for both recipient and sender email addresses. Separate multiple search values by commas only (without spaces or any special characters).from_email_not_in— List of sender email addresses to be excluded. The max limit of entries is 10. Separate multiple search values by commas only (without spaces or any special characters).recipients_not_in— List of recipient email addresses to be excluded (including "cc"). The max limit of entries is 10. Separate multiple search values by commas only (without spaces or any special characters).has_attachments— Boolean value filter to indicate if the message has attachments. Values can be only 'true' or 'false'.max_message_size— Select the message size (in KB) based on which you wish to retrieve messages from the Trellix Email Security - Cloud server. The default value is 20 and the maximum value is 100.from_accepted_date_time— The start date and time from which you would like to retrieve messages from the Trellix Email Security - Cloud server, e.g. 2017-10-24T10:48:51.000Z. For a complete date range, specify 'to_accepted_date_time' as well.to_accepted_date_time— The end date and time specify the period of time in which messages should be retrieved from the Trellix Email Security - Cloud server, e.g. 2017-10-24T10:48:51.000Z. For a complete date range, specify 'from_accepted_date_time' as well.last_modified_date_time— The last date and time messages were modified in order to retrieve them from the Trellix Email Security - Cloud server. Dates and times should be accompanied by one of the following operators: ">", "<", ">=", "<=". E.g. use value "<2017-10-24T18:00:00.000Z" to search for messages that were last modified after the specified time stamp.status— Filter messages to be retrieved from the Trellix Email Security - Cloud server based on their email message status. Possible values are: "accepted", "deleted", "delivered", "delivered (retroactive)", "dropped", "dropped oob", "dropped (oob retroactive)", "permanent failure", "processing", "quarantined", "rejected", "temporary failure". Separate multiple search values by commas only (without spaces or any special characters).status_not_in— Exclude messages from being retrieved from the Trellix Email Security - Cloud server based on the email message status. Possible values are: "accepted", "deleted", "delivered", "delivered (retroactive)", "dropped", "dropped oob", "dropped (oob retroactive)", "permanent failure", "processing", "quarantined", "rejected", "temporary failure". Separate multiple search values by commas only (without spaces or any special characters).rejection_reason— Filter messages that should be retrieved from the Trellix Email Security - Cloud server based on the email rejection reason. Possible values are: "ETP102", "ETP103", "ETP104", "ETP200", "ETP201", "ETP203", "ETP204", "ETP205", "ETP300", "ETP301", "ETP302", "ETP401", "ETP402", "ETP403", "ETP404", "ETP405". Separate multiple search values by commas only (without spaces or any special characters).subject— Filter messages that should be retrieved from the Trellix Email Security - Cloud server based on the email subject (string). The max limit of entries is 10. Separate multiple search values by commas only (without spaces or any special characters).
Outputs
FireEyeETP.HuntingResults— Email message objects and fields that were retrieved from Trellix Email Security - Cloud.FireEyeETP.HuntingResults.acceptedDateTime— Message accepted date.FireEyeETP.HuntingResults.lastModifiedDateTime— Message last modified date.FireEyeETP.HuntingResults.countryCode— Sender country code.FireEyeETP.HuntingResults.domain— Domain.FireEyeETP.HuntingResults.recipientHeader— List of message recipients header (includes the display name of the user).FireEyeETP.HuntingResults.recipients— List of message recipients.FireEyeETP.HuntingResults.senderHeader— Message sender header (includes the display name of the user).FireEyeETP.HuntingResults.sender— Message sender address.FireEyeETP.HuntingResults.senderSMTP— Message sender SMTP.FireEyeETP.HuntingResults.senderIP— Message sender IP.FireEyeETP.HuntingResults.status— Message status.FireEyeETP.HuntingResults.subject— Message subjectFireEyeETP.HuntingResults.id— Message ID.
Commands used
fireeye-etp-search-messages
Flowchart
id: FireEye ETP - Indicators Hunting version: -1 name: Trellix Email Security Cloud - Indicators Hunting description: |- This playbook queries Trellix Email Security - Cloud for indicators such as domains, IP addresses, sender and recipient email addresses. Separate searches are conducted for each type of indicator in the playbook. Note that multiple search values should be separated by commas only (without spaces or any special characters). starttaskid: "0" tasks: "0": id: "0" taskid: a52d8420-7a8c-4987-866d-15dd05511bae type: start task: id: a52d8420-7a8c-4987-866d-15dd05511bae version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "56" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 290, "y": -470 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "10": id: "10" taskid: 67f16a8f-9fec-4a68-805a-2eaf47bc1721 type: title task: id: 67f16a8f-9fec-4a68-805a-2eaf47bc1721 version: -1 name: IP Address Indicators type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "109" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -40, "y": -150 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "14": id: "14" taskid: 057a7a85-a28d-49ce-8725-9e2bb741908f type: title task: id: 057a7a85-a28d-49ce-8725-9e2bb741908f version: -1 name: Domain Indicators type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "108" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -670, "y": -150 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "40": id: "40" taskid: ffb7e3dc-8938-4ec9-8ff2-60e2c2b6f9f7 type: title task: id: ffb7e3dc-8938-4ec9-8ff2-60e2c2b6f9f7 version: -1 name: Email Address Indicators type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "110" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1240, "y": -150 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "56": id: "56" taskid: 9194fece-7d1c-4f5d-886d-5c10e93324b4 type: condition task: id: 9194fece-7d1c-4f5d-886d-5c10e93324b4 version: -1 name: Is FireEye ETP enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: '#default#': - "127" "yes": - "14" - "10" - "40" scriptarguments: brandname: simple: FireEye ETP results: - brandInstances separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 290, "y": -320 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "100": id: "100" taskid: 9e1e414c-a541-40cd-8180-3eb81cfbb159 type: regular task: id: 9e1e414c-a541-40cd-8180-3eb81cfbb159 version: -1 name: FireEye ETP Query - Domain description: Search for messages that include specified message attributes that are accessible in he ETP portal. script: FireEye ETP|||fireeye-etp-search-messages type: regular iscommand: true brand: FireEye ETP nexttasks: '#none#': - "129" scriptarguments: domain: complex: root: inputs.Domain transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq from_accepted_date_time: complex: root: inputs.from_accepted_date_time from_email_not_in: complex: root: inputs.from_email_not_in filters: - - operator: isNotEmpty left: value: simple: inputs.from_email_not_in iscontext: true transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq has_attachments: complex: root: inputs.has_attachments filters: - - operator: isEqualString left: value: simple: inputs.has_attachments iscontext: true right: value: simple: "true" - operator: isEqualString left: value: simple: inputs.has_attachments iscontext: true right: value: simple: "false" last_modified_date_time: complex: root: inputs.last_modified_date_time filters: - - operator: isNotEmpty left: value: simple: inputs.last_modified_date_time iscontext: true max_message_size: complex: root: inputs.max_message_size filters: - - operator: lessThanOrEqual left: value: simple: inputs.max_message_size iscontext: true right: value: simple: "100" recipients_not_in: complex: root: inputs.recipients_not_in filters: - - operator: isNotEmpty left: value: simple: inputs.recipients_not_in iscontext: true transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq rejection_reason: complex: root: inputs.rejection_reason filters: - - operator: isNotEmpty left: value: simple: inputs.rejection_reason iscontext: true transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq status: complex: root: inputs.status filters: - - operator: isNotEmpty left: value: simple: inputs.status iscontext: true transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq status_not_in: complex: root: inputs.status_not_in filters: - - operator: isNotEmpty left: value: simple: inputs.status_not_in iscontext: true transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq subject: complex: root: inputs.subject filters: - - operator: isNotEmpty left: value: simple: inputs.subject iscontext: true transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq to_accepted_date_time: complex: root: inputs.to_accepted_date_time separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -900, "y": 155 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "108": id: "108" taskid: b526088f-ddc8-470f-87c3-51ff917f2c49 type: condition task: id: b526088f-ddc8-470f-87c3-51ff917f2c49 version: -1 name: Any domains to hunt for? description: Checks whether any domains are available for threat hunting. type: condition iscommand: false brand: "" nexttasks: '#default#': - "122" "yes": - "100" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.Domain iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": -670, "y": -15 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "109": id: "109" taskid: 668d2d38-e8c3-4c94-84ef-e9d2689f13d5 type: condition task: id: 668d2d38-e8c3-4c94-84ef-e9d2689f13d5 version: -1 name: Any IP addresses to hunt for? description: Checks whether any IP addresses are available for threat hunting. type: condition iscommand: false brand: "" nexttasks: '#default#': - "123" "yes": - "131" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.IPAddress iscontext: true right: value: {} continueonerrortype: "" view: |- { "position": { "x": -40, "y": -15 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "110": id: "110" taskid: 429aae54-c10e-4ac3-8afd-bcfbb1700721 type: condition task: id: 429aae54-c10e-4ac3-8afd-bcfbb1700721 version: -1 name: Any email addresses to hunt for? description: Checks whether any email addresses are available for threat hunting. type: condition iscommand: false brand: "" nexttasks: '#default#': - "124" "yes": - "134" - "136" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.EmailAddress iscontext: true continueonerrortype: "" view: |- { "position": { "x": 1240, "y": -15 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "122": id: "122" taskid: 171b6e82-e132-4763-8379-a4a23158ebf4 type: title task: id: 171b6e82-e132-4763-8379-a4a23158ebf4 version: -1 name: Domain Hunting Done type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "127" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -670, "y": 490 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "123": id: "123" taskid: 9813d836-c103-4746-8499-5422cf337eb7 type: title task: id: 9813d836-c103-4746-8499-5422cf337eb7 version: -1 name: IP Address Hunting Done type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "127" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -40, "y": 490 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "124": id: "124" taskid: e40fdebf-27e8-4c2b-8fcf-e6670e1d7935 type: title task: id: e40fdebf-27e8-4c2b-8fcf-e6670e1d7935 version: -1 name: Email Address Hunting Done type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "127" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1240, "y": 660 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "127": id: "127" taskid: 902796a2-512e-4d1d-84cf-2412f7ee3f92 type: title task: id: 902796a2-512e-4d1d-84cf-2412f7ee3f92 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 290, "y": 800 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "129": id: "129" taskid: c3259372-88f3-4462-88b5-3fab26c952e0 type: regular task: id: c3259372-88f3-4462-88b5-3fab26c952e0 version: -1 name: Save Matching Results - Domain description: |- Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "122" scriptarguments: append: simple: "true" key: simple: FireEyeETP.HuntingResults value: complex: root: FireEyeETP.Message filters: - - operator: isNotEmpty left: value: simple: FireEyeETP.Message.domain iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -900, "y": 320 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "131": id: "131" taskid: 7e4fa03e-c55e-4b80-802d-028f519234de type: regular task: id: 7e4fa03e-c55e-4b80-802d-028f519234de version: -1 name: FireEye ETP Query - IP Address description: Search for messages that include specified message attributes that are accessible in he ETP portal. script: FireEye ETP|||fireeye-etp-search-messages type: regular iscommand: true brand: FireEye ETP nexttasks: '#none#': - "132" scriptarguments: from_accepted_date_time: complex: root: inputs.from_accepted_date_time from_email_not_in: complex: root: inputs.from_email_not_in filters: - - operator: isNotEmpty left: value: simple: inputs.from_email_not_in iscontext: true transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq has_attachments: complex: root: inputs.has_attachments filters: - - operator: isEqualString left: value: simple: inputs.has_attachments iscontext: true right: value: simple: "true" - operator: isEqualString left: value: simple: inputs.has_attachments iscontext: true right: value: simple: "false" last_modified_date_time: complex: root: inputs.last_modified_date_time filters: - - operator: isNotEmpty left: value: simple: inputs.last_modified_date_time iscontext: true max_message_size: complex: root: inputs.max_message_size filters: - - operator: lessThanOrEqual left: value: simple: inputs.max_message_size iscontext: true right: value: simple: "100" recipients_not_in: complex: root: inputs.recipients_not_in filters: - - operator: isNotEmpty left: value: simple: inputs.recipients_not_in iscontext: true transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq rejection_reason: complex: root: inputs.rejection_reason filters: - - operator: isNotEmpty left: value: simple: inputs.rejection_reason iscontext: true transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq sender_ip: complex: root: inputs.IPAddress transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq status: complex: root: inputs.status filters: - - operator: isNotEmpty left: value: simple: inputs.status iscontext: true transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq status_not_in: complex: root: inputs.status_not_in filters: - - operator: isNotEmpty left: value: simple: inputs.status_not_in iscontext: true transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq subject: complex: root: inputs.subject filters: - - operator: isNotEmpty left: value: simple: inputs.subject iscontext: true transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq to_accepted_date_time: complex: root: inputs.to_accepted_date_time separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -270, "y": 155 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "132": id: "132" taskid: 53be4b17-8a8a-4626-8c02-f9846f4afb48 type: regular task: id: 53be4b17-8a8a-4626-8c02-f9846f4afb48 version: -1 name: Save Matching Results - IP Address description: |- Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "123" scriptarguments: append: simple: "true" key: simple: FireEyeETP.HuntingResults value: complex: root: FireEyeETP.Message filters: - - operator: isNotEmpty left: value: simple: FireEyeETP.Message.senderIP iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": -270, "y": 320 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "134": id: "134" taskid: 8ca859fa-b50d-4a49-8a9a-2206d23f117f type: regular task: id: 8ca859fa-b50d-4a49-8a9a-2206d23f117f version: -1 name: FireEye ETP Query - Sender Email Address description: Search for messages that include specified message attributes that are accessible in he ETP portal. script: FireEye ETP|||fireeye-etp-search-messages type: regular iscommand: true brand: FireEye ETP nexttasks: '#none#': - "135" scriptarguments: from_accepted_date_time: complex: root: inputs.from_accepted_date_time from_email: complex: root: inputs.EmailAddress transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq from_email_not_in: complex: root: inputs.from_email_not_in filters: - - operator: isNotEmpty left: value: simple: inputs.from_email_not_in iscontext: true transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq has_attachments: complex: root: inputs.has_attachments filters: - - operator: isEqualString left: value: simple: inputs.has_attachments iscontext: true right: value: simple: "true" - operator: isEqualString left: value: simple: inputs.has_attachments iscontext: true right: value: simple: "false" last_modified_date_time: complex: root: inputs.last_modified_date_time filters: - - operator: isNotEmpty left: value: simple: inputs.last_modified_date_time iscontext: true max_message_size: complex: root: inputs.max_message_size filters: - - operator: lessThanOrEqual left: value: simple: inputs.max_message_size iscontext: true right: value: simple: "100" recipients_not_in: complex: root: inputs.recipients_not_in filters: - - operator: isNotEmpty left: value: simple: inputs.recipients_not_in iscontext: true transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq rejection_reason: complex: root: inputs.rejection_reason filters: - - operator: isNotEmpty left: value: simple: inputs.rejection_reason iscontext: true transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq status: complex: root: inputs.status filters: - - operator: isNotEmpty left: value: simple: inputs.status iscontext: true transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq status_not_in: complex: root: inputs.status_not_in filters: - - operator: isNotEmpty left: value: simple: inputs.status_not_in iscontext: true transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq subject: complex: root: inputs.subject filters: - - operator: isNotEmpty left: value: simple: inputs.subject iscontext: true transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq to_accepted_date_time: complex: root: inputs.to_accepted_date_time separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 610, "y": 160 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "135": id: "135" taskid: 7503d077-2191-46a7-88a6-7490f576c33f type: regular task: id: 7503d077-2191-46a7-88a6-7490f576c33f version: -1 name: Save Matching Results - Sender Email Address description: |- Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "138" scriptarguments: append: simple: "true" key: simple: FireEyeETP.HuntingResults value: complex: root: FireEyeETP.Message filters: - - operator: isNotEmpty left: value: simple: FireEyeETP.Message.senderHeader iscontext: true - operator: isNotEmpty left: value: simple: FireEyeETP.Message.sender iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 610, "y": 320 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "136": id: "136" taskid: 0f34a9b8-a0f7-4384-8750-593fbe25d34e type: regular task: id: 0f34a9b8-a0f7-4384-8750-593fbe25d34e version: -1 name: FireEye ETP Query - Recipient Email Address description: Search for messages that include specified message attributes that are accessible in he ETP portal. script: FireEye ETP|||fireeye-etp-search-messages type: regular iscommand: true brand: FireEye ETP nexttasks: '#none#': - "137" scriptarguments: from_accepted_date_time: complex: root: inputs.from_accepted_date_time from_email_not_in: complex: root: inputs.from_email_not_in filters: - - operator: isNotEmpty left: value: simple: inputs.from_email_not_in iscontext: true transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq has_attachments: complex: root: inputs.has_attachments filters: - - operator: isEqualString left: value: simple: inputs.has_attachments iscontext: true right: value: simple: "true" - operator: isEqualString left: value: simple: inputs.has_attachments iscontext: true right: value: simple: "false" last_modified_date_time: complex: root: inputs.last_modified_date_time filters: - - operator: isNotEmpty left: value: simple: inputs.last_modified_date_time iscontext: true max_message_size: complex: root: inputs.max_message_size filters: - - operator: lessThanOrEqual left: value: simple: inputs.max_message_size iscontext: true right: value: simple: "100" recipients: complex: root: inputs.EmailAddress transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq recipients_not_in: complex: root: inputs.recipients_not_in filters: - - operator: isNotEmpty left: value: simple: inputs.recipients_not_in iscontext: true transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq rejection_reason: complex: root: inputs.rejection_reason filters: - - operator: isNotEmpty left: value: simple: inputs.rejection_reason iscontext: true transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq status: complex: root: inputs.status filters: - - operator: isNotEmpty left: value: simple: inputs.status iscontext: true transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq status_not_in: complex: root: inputs.status_not_in filters: - - operator: isNotEmpty left: value: simple: inputs.status_not_in iscontext: true transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq subject: complex: root: inputs.subject filters: - - operator: isNotEmpty left: value: simple: inputs.subject iscontext: true transformers: - operator: split args: delimiter: value: simple: ',' - operator: uniq to_accepted_date_time: complex: root: inputs.to_accepted_date_time separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1010, "y": 155 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "137": id: "137" taskid: c8d64db3-e696-45b2-858e-6d1529354cf9 type: regular task: id: c8d64db3-e696-45b2-858e-6d1529354cf9 version: -1 name: Save Matching Results - Sender Email Address description: |- Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "138" scriptarguments: append: simple: "true" key: simple: HuntingResults2 value: complex: root: FireEyeETP.Message filters: - - operator: isNotEmpty left: value: simple: FireEyeETP.Message.recipientHeader iscontext: true - operator: isNotEmpty left: value: simple: FireEyeETP.Message.recipients iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1010, "y": 320 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "138": id: "138" taskid: f94f066b-b9f3-4c01-84d5-2d32888189cf type: regular task: id: f94f066b-b9f3-4c01-84d5-2d32888189cf version: -1 name: Remove Duplications From Matching Results description: |- Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: SetAndHandleEmpty type: regular iscommand: false brand: "" nexttasks: '#none#': - "124" scriptarguments: append: simple: "true" key: simple: FireEyeETP.HuntingResults value: complex: root: HuntingResults2 filters: - - operator: notInList left: value: simple: HuntingResults2.id iscontext: true right: value: simple: FireEyeETP.HuntingResults.id iscontext: true separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 810, "y": 490 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { "height": 1335, "width": 2520, "x": -900, "y": -470 } } } inputs: - key: IPAddress value: {} required: false description: |- A single or multiple IP address to search for within Trellix Email Security - Cloud logs. Used for both source and destination IP addresses. Separate multiple search values by commas only (without spaces or any special characters). playbookInputQuery: - key: Domain value: {} required: false description: |- Single or multiple domains to search for within Trellix Email Security - Cloud logs. By default, the 'contains' clause is used. Separate multiple search values by commas only (without spaces or any special characters). playbookInputQuery: - key: EmailAddress value: {} required: false description: |- A single or multiple email addresses to search for within Trellix Email Security - Cloud logs. Used for both recipient and sender email addresses. Separate multiple search values by commas only (without spaces or any special characters). playbookInputQuery: - key: from_email_not_in value: {} required: false description: |- List of sender email addresses to be excluded. The max limit of entries is 10. Separate multiple search values by commas only (without spaces or any special characters). playbookInputQuery: - key: recipients_not_in value: {} required: false description: |- List of recipient email addresses to be excluded (including "cc"). The max limit of entries is 10. Separate multiple search values by commas only (without spaces or any special characters). playbookInputQuery: - key: has_attachments value: {} required: false description: |- Boolean value filter to indicate if the message has attachments. Values can be only 'true' or 'false'. playbookInputQuery: - key: max_message_size value: {} required: false description: |- Select the message size (in KB) based on which you wish to retrieve messages from the Trellix Email Security - Cloud server. The default value is 20 and the maximum value is 100. playbookInputQuery: - key: from_accepted_date_time value: {} required: true description: |- The start date and time from which you would like to retrieve messages from the Trellix Email Security - Cloud server, e.g. 2017-10-24T10:48:51.000Z. For a complete date range, specify 'to_accepted_date_time' as well. playbookInputQuery: - key: to_accepted_date_time value: {} required: true description: |- The end date and time specify the period of time in which messages should be retrieved from the Trellix Email Security - Cloud server, e.g. 2017-10-24T10:48:51.000Z. For a complete date range, specify 'from_accepted_date_time' as well. playbookInputQuery: - key: last_modified_date_time value: {} required: false description: "The last date and time messages were modified in order to retrieve them from the Trellix Email Security - Cloud server. \n\nDates and times should be accompanied by one of the following operators: \">\", \"<\", \">=\", \"<=\". \nE.g. use value \"<2017-10-24T18:00:00.000Z\" to search for messages that were last modified after the specified time stamp." playbookInputQuery: - key: status value: {} required: false description: |- Filter messages to be retrieved from the Trellix Email Security - Cloud server based on their email message status. Possible values are: "accepted", "deleted", "delivered", "delivered (retroactive)", "dropped", "dropped oob", "dropped (oob retroactive)", "permanent failure", "processing", "quarantined", "rejected", "temporary failure". Separate multiple search values by commas only (without spaces or any special characters). playbookInputQuery: - key: status_not_in value: {} required: false description: |- Exclude messages from being retrieved from the Trellix Email Security - Cloud server based on the email message status. Possible values are: "accepted", "deleted", "delivered", "delivered (retroactive)", "dropped", "dropped oob", "dropped (oob retroactive)", "permanent failure", "processing", "quarantined", "rejected", "temporary failure". Separate multiple search values by commas only (without spaces or any special characters). playbookInputQuery: - key: rejection_reason value: {} required: false description: |- Filter messages that should be retrieved from the Trellix Email Security - Cloud server based on the email rejection reason. Possible values are: "ETP102", "ETP103", "ETP104", "ETP200", "ETP201", "ETP203", "ETP204", "ETP205", "ETP300", "ETP301", "ETP302", "ETP401", "ETP402", "ETP403", "ETP404", "ETP405". Separate multiple search values by commas only (without spaces or any special characters). playbookInputQuery: - key: subject value: {} required: false description: |- Filter messages that should be retrieved from the Trellix Email Security - Cloud server based on the email subject (string). The max limit of entries is 10. Separate multiple search values by commas only (without spaces or any special characters). playbookInputQuery: outputs: - contextPath: FireEyeETP.HuntingResults description: Email message objects and fields that were retrieved from Trellix Email Security - Cloud. type: string - contextPath: FireEyeETP.HuntingResults.acceptedDateTime description: Message accepted date. type: string - contextPath: FireEyeETP.HuntingResults.lastModifiedDateTime description: Message last modified date. type: string - contextPath: FireEyeETP.HuntingResults.countryCode description: Sender country code. type: string - contextPath: FireEyeETP.HuntingResults.domain description: Domain. type: string - contextPath: FireEyeETP.HuntingResults.recipientHeader description: List of message recipients header (includes the display name of the user). type: string - contextPath: FireEyeETP.HuntingResults.recipients description: List of message recipients. type: string - contextPath: FireEyeETP.HuntingResults.senderHeader description: Message sender header (includes the display name of the user). type: string - contextPath: FireEyeETP.HuntingResults.sender description: Message sender address. type: string - contextPath: FireEyeETP.HuntingResults.senderSMTP description: Message sender SMTP. type: string - contextPath: FireEyeETP.HuntingResults.senderIP description: Message sender IP. type: string - contextPath: FireEyeETP.HuntingResults.status description: Message status. type: string - contextPath: FireEyeETP.HuntingResults.subject description: Message subject type: string - contextPath: FireEyeETP.HuntingResults.id description: Message ID. type: string tests: - No tests (auto formatted) fromversion: 6.5.0