CheckEmailAuthenticity

Checks the authenticity of an email based on the email's SPF, DMARC, and DKIM.

python · Phishing

Details

IDCheckEmailAuthenticity
Languagepython
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10404775
Tagsphishing ews email

README

Checks the authenticity of an email based on the email’s SPF, DMARC, and DKIM.

Script Data

Name Description
Script Type python3
Tags phishing, ews, email
Cortex XSOAR Version 5.0.0

Used In

This script is used in the following playbooks and scripts.

  • Agari Message Remediation - Agari Phishing Defense
  • Email Headers Check - Generic
  • Phishing - Generic v3
  • Phishing Investigation - Generic v2
  • Report Categorization - Cofense Triage v3

Inputs

Argument Name Description
headers A list of dictionaries of headers in the form of “Header name”:”Header value”.
original_authentication_header The header that holds the original Authentication-Results header value. This can be used when an intermediate server changes the original email and holds the original header value in a different header. Note - Use this only if you trust the server creating this header.
SPF_override_none Override value for SPF=None.
SPF_override_neutral Override value for SPF=neutral.
SPF_override_pass Override value for SPF=pass.
SPF_override_fail Override value for SPF=fail.
SPF_override_softfail Override value for SPF=softfail.
SPF_override_temperror Override value for SPF=temperror.
SPF_override_permerror Override value for SPF=permerror.
DKIM_override_none Override value for DKIM=none.
DKIM_override_pass Override value for DKIM=pass.
DKIM_override_fail Override value for DKIM=fail.
DKIM_override_policy Override value for DKIM=policy.
DKIM_override_neutral Override value for DKIM=neutral.
DKIM_override_temperror Override value for DKIM=temperror.
DKIM_override_permerror Override value for DKIM=permerror.
DMARC_override_none Override value for DMARC=none.
DMARC_override_pass Override value for DMARC=pass.
DMARC_override_fail Override value for DMARC=fail.
DMARC_override_temperror Override value for DMARC=temperror.
DMARC_override_permerror Override value for DMARC=permerror.

Outputs

Path Description Type
Email.SPF.MessageID SPF ID String
Email.SPF.Validation-Result Validation Result. Possible values are “None”, “Neutral”, “Pass”, “Fail”, “SoftFail”, “TempError”, and “PermError”. String
Email.SPF.Reason Reason for the SPF result, which is located in the headers of the email. String
Email.SPF.Sender-IP Email sender IP address. String
Email.DKIM.Message-ID DKIM ID. String
Email.DKIM.Reason DKIM reason (if found). String
Email.DMARC.Message-ID DMARC ID. String
Email.DMARC.Validation-Result DMARC reason. Possible values are “None”, “Pass”, “Fail”, “Temperror”, and “Permerror”. String
Email.DMARC.Tags DMARC Tags (if found) String
Email.DMARC.From-Domain Sender’s Domain String
Email.DKIM.Signing-Domain Sender’s Domain String
Email.AuthenticityCheck Possible values are be: Fail / Suspicious / Undetermined / Pass Unknown
Email.DKIM DKIM information extracted from the email. Unknown
Email.SPF SPF information extracted from the email. Unknown
Email.DMARC DMARC information extracted from the email. Unknown
Email.DKIM.Validation-Result Validation result. Possible values are “None”, “Pass”, “Fail”, “Policy”, “Neutral”, “Temperror”, and “Permerror”. Unknown

Source

CheckEmailAuthenticity.py CheckEmailAuthenticity_test.py CheckEmailAuthenticity.yml
Download History Raw 
args:
- auto: PREDEFINED
  description: A list of dictionaries of headers in the form of "Header name":"Header value".
  isArray: true
  name: headers
  predefined:
  - admin
- auto: PREDEFINED
  description: The header that holds the original Authentication-Results header value. This can be used when an intermediate server changes the original email and holds the original header value in a different header. Note - Use this only if you trust the server creating this header.
  name: original_authentication_header
- auto: PREDEFINED
  description: Override value for SPF=None.
  name: SPF_override_none
  predefined:
  - Fail
  - Suspicious
  - Undetermined
  - Pass
- auto: PREDEFINED
  description: Override value for SPF=neutral.
  name: SPF_override_neutral
  predefined:
  - Fail
  - Suspicious
  - Undetermined
  - Pass
- auto: PREDEFINED
  description: Override value for SPF=pass.
  name: SPF_override_pass
  predefined:
  - Fail
  - Suspicious
  - Undetermined
  - Pass
- auto: PREDEFINED
  description: Override value for SPF=fail.
  name: SPF_override_fail
  predefined:
  - Suspicious
  - Undetermined
  - Pass
- auto: PREDEFINED
  description: Override value for SPF=softfail.
  name: SPF_override_softfail
  predefined:
  - Fail
  - Suspicious
  - Undetermined
  - Pass
- auto: PREDEFINED
  description: Override value for SPF=temperror.
  name: SPF_override_temperror
  predefined:
  - Fail
  - Suspicious
  - Undetermined
  - Pass
- auto: PREDEFINED
  description: 'Override value for SPF=permerror. '
  name: SPF_override_permerror
  predefined:
  - Fail
  - Suspicious
  - Undetermined
  - Pass
- auto: PREDEFINED
  description: Override value for DKIM=none.
  name: DKIM_override_none
  predefined:
  - Fail
  - Suspicious
  - Undetermined
  - Pass
- auto: PREDEFINED
  description: Override value for DKIM=pass.
  name: DKIM_override_pass
  predefined:
  - Fail
  - Suspicious
  - Undetermined
  - Pass
- auto: PREDEFINED
  description: Override value for DKIM=fail.
  name: DKIM_override_fail
  predefined:
  - Fail
  - Suspicious
  - Undetermined
  - Pass
- auto: PREDEFINED
  description: Override value for DKIM=policy.
  name: DKIM_override_policy
  predefined:
  - Fail
  - Suspicious
  - Undetermined
  - Pass
- auto: PREDEFINED
  description: Override value for DKIM=neutral.
  name: DKIM_override_neutral
  predefined:
  - Fail
  - Suspicious
  - Undetermined
  - Pass
- auto: PREDEFINED
  description: Override value for DKIM=temperror.
  name: DKIM_override_temperror
  predefined:
  - Fail
  - Suspicious
  - Undetermined
  - Pass
- auto: PREDEFINED
  description: Override value for DKIM=permerror.
  name: DKIM_override_permerror
  predefined:
  - Fail
  - Suspicious
  - Undetermined
  - Pass
- auto: PREDEFINED
  description: Override value for DMARC=none.
  name: DMARC_override_none
  predefined:
  - Fail
  - Suspicious
  - Undetermined
  - Pass
- auto: PREDEFINED
  description: Override value for DMARC=pass.
  name: DMARC_override_pass
  predefined:
  - Fail
  - Suspicious
  - Undetermined
  - Pass
- auto: PREDEFINED
  description: Override value for DMARC=fail.
  name: DMARC_override_fail
  predefined:
  - Fail
  - Suspicious
  - Undetermined
  - Pass
- auto: PREDEFINED
  description: Override value for DMARC=temperror.
  name: DMARC_override_temperror
  predefined:
  - Fail
  - Suspicious
  - Undetermined
  - Pass
- auto: PREDEFINED
  description: Override value for DMARC=permerror.
  name: DMARC_override_permerror
  predefined:
  - Fail
  - Suspicious
  - Undetermined
  - Pass
comment: Checks the authenticity of an email based on the email's SPF, DMARC, and DKIM.
commonfields:
  id: CheckEmailAuthenticity
  version: -1
enabled: true
name: CheckEmailAuthenticity
outputs:
- contextPath: Email.SPF.MessageID
  description: SPF ID.
  type: String
- contextPath: Email.SPF.Validation-Result
  description: 'Validation Result. Possible values are "None", "Neutral", "Pass", "Fail", "SoftFail", "TempError", and "PermError". '
  type: String
- contextPath: Email.SPF.Reason
  description: Reason for the SPF result, which is located in the headers of the email.
  type: String
- contextPath: Email.SPF.Sender-IP
  description: Email sender IP address.
  type: String
- contextPath: Email.DKIM.Message-ID
  description: DKIM ID.
  type: String
- contextPath: Email.DKIM.Reason
  description: DKIM reason (if found).
  type: String
- contextPath: Email.DMARC.Message-ID
  description: DMARC ID.
  type: String
- contextPath: Email.DMARC.Validation-Result
  description: DMARC reason. Possible values are "None", "Pass", "Fail", "Temperror", and "Permerror".
  type: String
- contextPath: Email.DMARC.Tags
  description: DMARC Tags (if found).
  type: String
- contextPath: Email.DMARC.From-Domain
  description: Sender's Domain.
  type: String
- contextPath: Email.DKIM.Signing-Domain
  description: Sender's Domain.
  type: String
- contextPath: Email.AuthenticityCheck
  description: 'Possible values are be: Fail / Suspicious / Undetermined / Pass.'
  type: Unknown
- contextPath: Email.DKIM
  description: DKIM information extracted from the email.
  type: Unknown
- contextPath: Email.SPF
  description: SPF information extracted from the email.
  type: Unknown
- contextPath: Email.DMARC
  description: DMARC information extracted from the email.
  type: Unknown
- contextPath: Email.DKIM.Validation-Result
  description: Validation result. Possible values are "None", "Pass", "Fail", "Policy", "Neutral", "Temperror", and "Permerror".
  type: Unknown
script: '-'
tags:
- phishing
- ews
- email
timeout: '0'
type: python
subtype: python3
dockerimage: demisto/python3:3.12.13.10404775
runas: DBotWeakRole
fromversion: 5.0.0
tests:
- No tests