name: CiscoETDConnector
display: Cisco Email Threat Defense Connector
description: Cisco Secure Email Threat Defense (ETD) is a cloud-native email security service that detects and remediates email threats such as phishing, business email compromise, and malware. This collector ingests ETD message, audit, and blocked connection logs into Cortex XSIAM.
category: Analytics & SIEM
commonfields:
  id: CiscoETDConnector
  version: -1
provider: Cisco
fromversion: 6.8.0
sectionorder:
- Connect
- Collect
configuration:
- display: ETD API Base URL
  name: etd_base_url
  type: 0
  section: Connect
  required: true
- displaypassword: ETD API Key
  name: api_key
  type: 9
  hiddenusername: true
  section: Connect
  required: true
- display: Client ID
  name: client_id
  type: 0
  section: Connect
  required: true
- displaypassword: Client Secret
  name: client_secret
  type: 9
  hiddenusername: true
  section: Connect
  required: true
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  required: false
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  required: false
  advanced: true
- display: Fetch events
  name: isFetchEvents
  type: 8
  section: Collect
  required: false
  defaultvalue: "true"
- display: Event Types
  name: event_type
  type: 16
  options:
  - message
  - audit
  - connection
  defaultvalue: message,audit,connection
  additionalinfo: The Cisco ETD log types to collect. Each type must also be enabled in the ETD UI under Administration > Business > Export Log Preferences. If no type is selected, all types are collected.
  section: Collect
  required: false
- display: Max fetch
  name: max_fetch
  type: 0
  section: Collect
  required: false
  advanced: true
  defaultvalue: '5000'
  additionalinfo: The maximum number of events to collect per fetch cycle. Any remainder is collected on the following cycle.
  supportedModules:
  - xsiam
- display: Events Fetch Interval
  name: eventFetchInterval
  type: 19
  section: Collect
  required: false
  advanced: true
  defaultvalue: "60"
  additionalinfo: Cisco ETD publishes log export files on an hourly basis, so intervals shorter than 60 minutes produce no additional events.
  supportedModules:
  - xsiam
script:
  script: "-"
  type: python
  subtype: python3
  dockerimage: demisto/fastapi:0.125.0.12689358
  isfetchevents: true
  commands:
  - name: cisco-etd-get-events
    description: Retrieves ETD logs from Cisco. Use this command for development and debugging only, as it may produce duplicate events, exceed API rate limits, or disrupt the fetch mechanism.
    arguments:
    - name: start_time
      description: Start of the time range. Accepts a date, a timestamp, or a relative expression such as "3 hours ago". Rounded down to the start of the hour, since Cisco ETD exports logs hourly.
      defaultValue: 1 hour ago
    - name: end_time
      description: End of the time range. Accepts a date, a timestamp, or a relative expression such as "now". Rounded down to the start of the hour. The hour currently in progress cannot be retrieved.
      defaultValue: now
    - name: log_type
      description: Log type(s) to retrieve. If not provided, all types are retrieved.
      auto: PREDEFINED
      predefined:
      - message
      - audit
      - connection
      isArray: true
    - name: limit
      description: Maximum number of events to return.
      defaultValue: "100"
    - name: should_push_events
      description: Push fetched events to Cortex XSIAM.
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      defaultValue: "false"
marketplaces:
- marketplacev2
- platform
tests:
- No tests