Trellix Email Security Cloud - Indicators Hunting

Inputs

• IPAddress — A single or multiple IP address to search for within Trellix Email Security - Cloud logs. Used for both source and destination IP addresses. Separate multiple search values by commas only (without spaces or any special characters).
• Domain — Single or multiple domains to search for within Trellix Email Security - Cloud logs. By default, the 'contains' clause is used. Separate multiple search values by commas only (without spaces or any special characters).
• EmailAddress — A single or multiple email addresses to search for within Trellix Email Security - Cloud logs. Used for both recipient and sender email addresses. Separate multiple search values by commas only (without spaces or any special characters).
• from_email_not_in — List of sender email addresses to be excluded. The max limit of entries is 10. Separate multiple search values by commas only (without spaces or any special characters).
• recipients_not_in — List of recipient email addresses to be excluded (including "cc"). The max limit of entries is 10. Separate multiple search values by commas only (without spaces or any special characters).
• has_attachments — Boolean value filter to indicate if the message has attachments. Values can be only 'true' or 'false'.
• max_message_size — Select the message size (in KB) based on which you wish to retrieve messages from the Trellix Email Security - Cloud server. The default value is 20 and the maximum value is 100.
• from_accepted_date_time — The start date and time from which you would like to retrieve messages from the Trellix Email Security - Cloud server, e.g. 2017-10-24T10:48:51.000Z. For a complete date range, specify 'to_accepted_date_time' as well.
• to_accepted_date_time — The end date and time specify the period of time in which messages should be retrieved from the Trellix Email Security - Cloud server, e.g. 2017-10-24T10:48:51.000Z. For a complete date range, specify 'from_accepted_date_time' as well.
• last_modified_date_time — The last date and time messages were modified in order to retrieve them from the Trellix Email Security - Cloud server. Dates and times should be accompanied by one of the following operators: ">", "<", ">=", "<=". E.g. use value "<2017-10-24T18:00:00.000Z" to search for messages that were last modified after the specified time stamp.
• status — Filter messages to be retrieved from the Trellix Email Security - Cloud server based on their email message status. Possible values are: "accepted", "deleted", "delivered", "delivered (retroactive)", "dropped", "dropped oob", "dropped (oob retroactive)", "permanent failure", "processing", "quarantined", "rejected", "temporary failure". Separate multiple search values by commas only (without spaces or any special characters).
• status_not_in — Exclude messages from being retrieved from the Trellix Email Security - Cloud server based on the email message status. Possible values are: "accepted", "deleted", "delivered", "delivered (retroactive)", "dropped", "dropped oob", "dropped (oob retroactive)", "permanent failure", "processing", "quarantined", "rejected", "temporary failure". Separate multiple search values by commas only (without spaces or any special characters).
• rejection_reason — Filter messages that should be retrieved from the Trellix Email Security - Cloud server based on the email rejection reason. Possible values are: "ETP102", "ETP103", "ETP104", "ETP200", "ETP201", "ETP203", "ETP204", "ETP205", "ETP300", "ETP301", "ETP302", "ETP401", "ETP402", "ETP403", "ETP404", "ETP405". Separate multiple search values by commas only (without spaces or any special characters).
• subject — Filter messages that should be retrieved from the Trellix Email Security - Cloud server based on the email subject (string). The max limit of entries is 10. Separate multiple search values by commas only (without spaces or any special characters).

Outputs

• FireEyeETP.HuntingResults — Email message objects and fields that were retrieved from Trellix Email Security - Cloud.
• FireEyeETP.HuntingResults.acceptedDateTime — Message accepted date.
• FireEyeETP.HuntingResults.lastModifiedDateTime — Message last modified date.
• FireEyeETP.HuntingResults.countryCode — Sender country code.
• FireEyeETP.HuntingResults.domain — Domain.
• FireEyeETP.HuntingResults.recipientHeader — List of message recipients header (includes the display name of the user).
• FireEyeETP.HuntingResults.recipients — List of message recipients.
• FireEyeETP.HuntingResults.senderHeader — Message sender header (includes the display name of the user).
• FireEyeETP.HuntingResults.sender — Message sender address.
• FireEyeETP.HuntingResults.senderSMTP — Message sender SMTP.
• FireEyeETP.HuntingResults.senderIP — Message sender IP.
• FireEyeETP.HuntingResults.status — Message status.
• FireEyeETP.HuntingResults.subject — Message subject
• FireEyeETP.HuntingResults.id — Message ID.

Commands used