commonfields:
  id: CiscoSMA
  version: -1
name: CiscoSMA
sectionorder:
- Connect
- Collect
display: Cisco Security Management Appliance
category: Email
provider: Cisco Systems
description: The Security Management Appliance (SMA) is used to centralize services from Email Security Appliances (ESAs) and Web Security Appliances (WSAs).
configuration:
- name: base_url
  display: Server URL
  type: 0
  required: true
  additionalinfo: Base URL, e.g., https://XXX.eu.iphmx.com
  section: Connect
- name: credentials
  display: Username
  required: true
  type: 9
  additionalinfo: ""
  displaypassword: Password
  section: Connect
- name: max_fetch
  display: Maximum incidents per fetch
  defaultvalue: 50
  type: 0
  additionalinfo: Default is 50. Maximum is 100.
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- name: first_fetch
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days).
  defaultvalue: 7 days
  type: 0
  additionalinfo: |-
    Timestamp in ISO format or <number> <time unit>,
    e.g., 2022-01-01T00:00:00.000Z, 12 hours, 7 days, 3 months, now.
  required: false
  section: Collect
- name: filter_by
  section: Collect
  display: Filter by
  type: 15
  additionalinfo: Message field by which to filter the results.
  options:
  - from_address
  - to_address
  - subject
  required: false
- name: filter_operator
  section: Collect
  display: Filter operator
  type: 15
  additionalinfo: Operator on the message field.
  options:
  - contains
  - is
  - begins_with
  - ends_with
  - does_not_contain
  required: false
- name: filter_value
  section: Collect
  display: Filter value
  type: 0
  additionalinfo: The value to search for.
  required: false
- name: recipient_filter_operator
  section: Collect
  display: Recipient filter operator
  type: 15
  additionalinfo: Recipient operator filter.
  options:
  - contains
  - is
  - begins_with
  - ends_with
  - does_not_contain
  required: false
- name: recipient_filter_value
  section: Collect
  display: Recipient filter value
  type: 0
  additionalinfo: Recipient filter value to fetch by message field.
  required: false
- name: timeout
  section: Connect
  display: Timeout
  type: 0
  defaultvalue: '60'
  additionalinfo: HTTP requests timeout in seconds. The default is 60 seconds.
  required: false
- name: proxy
  section: Connect
  display: Use system proxy settings
  defaultvalue: 'false'
  type: 8
  required: false
- name: insecure
  section: Connect
  display: Trust any certificate (not secure)
  defaultvalue: 'false'
  type: 8
  required: false
- display: Incident type
  section: Collect
  name: incidentType
  type: 13
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
  supportedModules:
  - agentix
  - xsiam
- display: Fetch incidents
  section: Collect
  name: isFetch
  type: 8
  required: false
  supportedModules:
  - agentix
  - xsiam
script:
  script: ''
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10325753
  isfetch: true
  commands:
  - name: cisco-sma-spam-quarantine-message-search
    description: Search messages in the spam quarantine.
    arguments:
    - name: start_date
      description: |-
        Start date in ISO format or <number> <time unit>,
        e.g., 2022-01-01T00:00:00.000Z, 12 hours, 7 days, 3 months, now.
      required: true
    - name: end_date
      description: |-
        End date in ISO format or <number> <time unit>,
        e.g., 2022-01-01T00:00:00.000Z, 12 hours, 7 days, 3 months, now.
      required: true
    - name: filter_by
      description: Field by which to filter the results.
      auto: PREDEFINED
      predefined:
      - from_address
      - to_address
      - subject
    - name: filter_operator
      description: Filter operator.
      auto: PREDEFINED
      predefined:
      - contains
      - is
      - begins_with
      - ends_with
      - does_not_contain
    - name: filter_value
      description: The value to search for. This is a user defined value, e.g., filterValue=abc.com.
    - name: recipient_filter_operator
      description: Recipient operator filter.
      auto: PREDEFINED
      predefined:
      - contains
      - is
      - begins_with
      - ends_with
      - does_not_contain
    - name: recipient_filter_value
      description: Recipient filter value.
    - name: order_by
      description: How the results should be ordered.
      auto: PREDEFINED
      predefined:
      - from_address
      - date
      - subject
      - size
    - name: order_dir
      description: Direction in which the results should be ordered.
      auto: PREDEFINED
      predefined:
      - asc
      - desc
    - name: page
      description: |-
        Page number of paginated results.
        Minimum value is 1.
    - name: page_size
      description: Number of results per page. Maximum value is 100.
    - name: limit
      defaultValue: 50
      description: The maximum number of records to retrieve.
    outputs:
    - type: String
      contextPath: CiscoSMA.SpamQuarantineMessage.envelopeRecipient
      description: Message recipient.
    - type: String
      contextPath: CiscoSMA.SpamQuarantineMessage.toAddress
      description: Message recipient.
    - type: String
      contextPath: CiscoSMA.SpamQuarantineMessage.subject
      description: Message subject.
    - type: String
      contextPath: CiscoSMA.SpamQuarantineMessage.date
      description: Message date.
    - type: String
      contextPath: CiscoSMA.SpamQuarantineMessage.fromAddress
      description: Message sender.
    - type: String
      contextPath: CiscoSMA.SpamQuarantineMessage.size
      description: Message size.
    - type: Number
      contextPath: CiscoSMA.SpamQuarantineMessage.mid
      description: Message ID.
  - name: cisco-sma-spam-quarantine-message-get
    description: Get spam quarantine message.
    arguments:
    - name: message_id
      description: Message ID.
      required: true
    outputs:
    - type: String
      contextPath: CiscoSMA.SpamQuarantineMessage.envelopeRecipient
      description: Message recipient.
    - type: String
      contextPath: CiscoSMA.SpamQuarantineMessage.toAddress
      description: Message recipient.
    - type: String
      contextPath: CiscoSMA.SpamQuarantineMessage.messageBody
      description: Message body.
    - type: String
      contextPath: CiscoSMA.SpamQuarantineMessage.date
      description: Message date.
    - type: String
      contextPath: CiscoSMA.SpamQuarantineMessage.fromAddress
      description: Message sender.
    - type: String
      contextPath: CiscoSMA.SpamQuarantineMessage.subject
      description: Message subject.
    - type: Number
      contextPath: CiscoSMA.SpamQuarantineMessage.mid
      description: Message ID.
  - name: cisco-sma-spam-quarantine-message-release
    description: Release spam quarantined message.
    arguments:
    - name: message_ids
      description: Comma-separated list of message IDs.
      required: true
      isArray: true
    outputs: []
  - name: cisco-sma-spam-quarantine-message-delete
    description: Delete spam quarantined message.
    arguments:
    - name: message_ids
      description: Comma-separated list of message IDs.
      required: true
      isArray: true
    outputs: []
  - name: cisco-sma-list-entry-get
    description: Get spam quarantine blocklist/safelist entry.
    arguments:
    - name: entry_type
      description: List entry type.
      required: true
      auto: PREDEFINED
      predefined:
      - blocklist
      - safelist
    - name: page
      description: |-
        Page number of paginated results.
        Minimum value is 1.
    - name: page_size
      description: Number of results per page. Maximum value is 100.
    - name: limit
      defaultValue: 50
      description: The maximum number of records to retrieve.
    - name: order_by
      description: How the results should be ordered.
      auto: PREDEFINED
      predefined:
      - recipient
      - sender
    - name: order_dir
      description: Direction in which the results should be ordered.
      auto: PREDEFINED
      predefined:
      - asc
      - desc
    - name: view_by
      description: View results by.
      defaultValue: recipient
      auto: PREDEFINED
      predefined:
      - recipient
      - sender
    - name: search
      description: |-
        Search for recipients or senders in blocklist/safelist with 'contains' operator.
        e.g., test@test.com, test.com
        This is only supported for the argument view_by=recipient.
    outputs:
    - type: String
      contextPath: CiscoSMA.ListEntry.Blocklist.senderList
      description: Sender list.
    - type: String
      contextPath: CiscoSMA.ListEntry.Blocklist.recipientAddress
      description: Recipient address.
    - type: String
      contextPath: CiscoSMA.ListEntry.Blocklist.recipientList
      description: Recipient list.
    - type: String
      contextPath: CiscoSMA.ListEntry.Blocklist.senderAddress
      description: Sender address.
    - type: String
      contextPath: CiscoSMA.ListEntry.Safelist.senderList
      description: Sender list.
    - type: String
      contextPath: CiscoSMA.ListEntry.Safelist.recipientAddress
      description: Recipient address.
    - type: String
      contextPath: CiscoSMA.ListEntry.Safelist.recipientList
      description: Recipient list.
    - type: String
      contextPath: CiscoSMA.ListEntry.Safelist.senderAddress
      description: Sender address.
  - name: cisco-sma-list-entry-add
    description: Add spam quarantine blocklist/safelist entry.
    arguments:
    - name: entry_type
      description: List entry type.
      required: true
      auto: PREDEFINED
      predefined:
      - blocklist
      - safelist
    - name: view_by
      description: |-
        Add list entry by recipient/sender.
        When view_by = recipient: recipient_addresses and sender_list are mandatory.
        When view_by = sender: sender_addresses and recipient_list are mandatory.
      defaultValue: recipient
      auto: PREDEFINED
      predefined:
      - recipient
      - sender
    - name: recipient_addresses
      description: A comma-separated list of recipients to add.
      isArray: true
    - name: sender_list
      description: A comma-separated list of senders to add.
      isArray: true
    - name: sender_addresses
      description: A comma-separated list of senders to add.
      isArray: true
    - name: recipient_list
      description: A comma-separated list of recipients to add.
      isArray: true
    outputs: []
  - name: cisco-sma-list-entry-append
    description: Append spam quarantine blocklist/safelist entry.
    arguments:
    - name: entry_type
      description: List entry type.
      required: true
      auto: PREDEFINED
      predefined:
      - blocklist
      - safelist
    - name: view_by
      description: |-
        Append list entry by recipient/sender.
        When view_by = recipient: recipient_addresses and sender_list are mandatory.
        When view_by = sender: sender_addresses and recipient_list are mandatory.
      defaultValue: recipient
      auto: PREDEFINED
      predefined:
      - recipient
      - sender
    - name: recipient_list
      description: A comma-separated list of recipients to append.
      isArray: true
    - name: sender_list
      description: A comma-separated list of senders to append.
    - name: recipient_addresses
      description: A comma-separated list of recipients to append.
    - name: sender_addresses
      description: A comma-separated list of senders to append.
    outputs: []
  - name: cisco-sma-list-entry-edit
    description: Edit the spam quarantine blocklist/safelist entry. Using this command will override the existing value.
    arguments:
    - name: entry_type
      description: List entry type.
      required: true
      auto: PREDEFINED
      predefined:
      - blocklist
      - safelist
    - name: view_by
      description: |-
        Edit list entry by recipient/sender.
        When view_by = recipient: recipient_addresses and sender_list are mandatory.
        When view_by = sender: sender_addresses and recipient_list are mandatory.
      defaultValue: recipient
      auto: PREDEFINED
      predefined:
      - recipient
      - sender
    - name: recipient_list
      description: A comma-separated list of recipients to edit.
      isArray: true
    - name: sender_list
      description: A comma-separated list of senders to edit.
    - name: recipient_addresses
      description: A comma-separated list of recipients to edit.
    - name: sender_addresses
      description: A comma-separated list of senders to edit.
    outputs: []
  - name: cisco-sma-list-entry-delete
    description: Delete a spam quarantine blocklist/safelist entry.
    arguments:
    - name: entry_type
      description: List entry type.
      required: true
      auto: PREDEFINED
      predefined:
      - blocklist
      - safelist
    - name: view_by
      description: |-
        Delete list entry by recipient/sender.
        When view_by = recipient: recipient_list is mandatory.
        When view_by = sender: sender_list is mandatory.
      defaultValue: recipient
      auto: PREDEFINED
      predefined:
      - recipient
      - sender
    - name: recipient_list
      description: A comma-separated list of recipients to delete.
      isArray: true
    - name: sender_list
      description: A comma-separated list of senders to delete.
      isArray: true
    outputs: []
  - name: cisco-sma-message-search
    description: Search tracking messages.
    arguments:
    - name: start_date
      description: |-
        Start date in ISO format or <number> <time unit>,
        e.g., 2022-01-01T00:00:00.000Z, 12 hours, 7 days, 3 months, now.
      required: true
    - name: end_date
      description: |-
        End date in ISO format or <number> <time unit>,
        e.g., 2022-01-01T00:00:00.000Z, 12 hours, 7 days, 3 months, now.
      required: true
    - name: page
      description: |-
        Page number of paginated results.
        Minimum value is 1.
    - name: page_size
      description: Number of results per page. Maximum value is 100.
    - name: limit
      defaultValue: 50
      description: The maximum number of records to retrieve.
    - name: sender_filter_operator
      description: Sender filter operator.
      auto: PREDEFINED
      predefined:
      - contains
      - is
      - begins_with
    - name: sender_filter_value
      description: Sender filter value.
    - name: recipient_filter_operator
      description: Recipient filter operator.
      auto: PREDEFINED
      predefined:
      - contains
      - is
      - begins_with
    - name: recipient_filter_value
      description: Recipient filter value.
    - name: subject_filter_operator
      description: Subject filter operator.
      auto: PREDEFINED
      predefined:
      - contains
      - is
      - begins_with
    - name: subject_filter_value
      description: Subject filter value.
    - name: attachment_name_operator
      description: Attachment name operator.
      auto: PREDEFINED
      predefined:
      - contains
      - is
      - begins_with
    - name: attachment_name_value
      description: Attachment name value.
    - name: cisco_host
      description: Cisco host.
      defaultValue: All_Hosts
    - name: file_sha_256
      description: |-
        SHA256 must be 64 characters long and can contain only "0-9" and "a-f" symbols.
        E.g., e0d123e5f316bef78bfdf5a008837577e0d123e5f316bef78bfdf5a008837577.
    - name: custom_query
      description: |-
        Custom query for cisco SMA's advanced filters.
        Syntax: <key>=<value>;<key>=<value>;<key>=<value>
        E.g.,  graymail=True;message_delivered=True.
    outputs:
    - type: String
      contextPath: CiscoSMA.Message.hostName
      description: Email gateway hostname.
    - type: String
      contextPath: CiscoSMA.Message.friendly_from
      description: Friendly formatted sender email address.
    - type: String
      contextPath: CiscoSMA.Message.isCompleteData
      description: Is complete data pulled?.
    - type: String
      contextPath: CiscoSMA.Message.messageStatus
      description: Message delivery status.
    - type: String
      contextPath: CiscoSMA.Message.recipientMap
      description: Recipients list.
    - type: String
      contextPath: CiscoSMA.Message.senderIp
      description: Sender IP address.
    - type: String
      contextPath: CiscoSMA.Message.mailPolicy
      description: Matched mail policy.
    - type: String
      contextPath: CiscoSMA.Message.senderGroup
      description: Matched sender group.
    - type: String
      contextPath: CiscoSMA.Message.subject
      description: Subject of email message.
    - type: Number
      contextPath: CiscoSMA.Message.dcid
      description: Delivery Connection ID.
    - type: String
      contextPath: CiscoSMA.Message.mid
      description: Message ID.
    - type: String
      contextPath: CiscoSMA.Message.senderDomain
      description: Domain of email message sender.
    - type: String
      contextPath: CiscoSMA.Message.finalSubject
      description: Extended email subject.
    - type: String
      contextPath: CiscoSMA.Message.direction
      description: Message direction, incoming or outgoing.
    - type: Number
      contextPath: CiscoSMA.Message.icid
      description: An Injection Connection ID (ICID) is a numerical identifier for an individual SMTP connection to the system.
    - type: String
      contextPath: CiscoSMA.Message.replyTo
      description: Email message reply to.
    - type: String
      contextPath: CiscoSMA.Message.timestamp
      description: Time of email message.
    - type: String
      contextPath: CiscoSMA.Message.messageID
      description: Extended message ID.
    - type: String
      contextPath: CiscoSMA.Message.verdictChart
      description: Verdict visual chart ID.
    - type: String
      contextPath: CiscoSMA.Message.recipient
      description: Recipients email addresses list.
    - type: String
      contextPath: CiscoSMA.Message.sender
      description: Sender email address.
    - type: String
      contextPath: CiscoSMA.Message.serialNumber
      description: Cisco ESA email gateway serial number.
    - type: Number
      contextPath: CiscoSMA.Message.allIcid
      description: ICIDs list.
    - type: String
      contextPath: CiscoSMA.Message.sbrs
      description: Sender Base Reputation Scores.
  - name: cisco-sma-message-details-get
    description: Get more details on the message.
    arguments:
    - name: serial_number
      description: Email gateway serial number.
      required: true
    - name: message_ids
      description: Message ID list.
      required: true
      isArray: true
    - name: injection_connection_id
      description: Injection connection ID.
    - name: delivery_connection_id
      description: Delivery connection ID.
    outputs:
    - type: String
      contextPath: CiscoSMA.Message.sdrAge
      description: Sender Domain Reputation age.
    - type: String
      contextPath: CiscoSMA.Message.attachments
      description: Message attachments.
    - type: String
      contextPath: CiscoSMA.Message.hostName
      description: Email gateway hostname.
    - type: String
      contextPath: CiscoSMA.Message.direction
      description: Message direction, incoming or outgoing.
    - type: Boolean
      contextPath: CiscoSMA.Message.isCompleteData
      description: Is complete data pulled?.
    - type: String
      contextPath: CiscoSMA.Message.messageStatus
      description: Message delivery status.
    - type: String
      contextPath: CiscoSMA.Message.mailPolicy
      description: Matched mail policy.
    - type: String
      contextPath: CiscoSMA.Message.senderGroup
      description: Matched sender group.
    - type: String
      contextPath: CiscoSMA.Message.subject
      description: Email message subject.
    - type: Boolean
      contextPath: CiscoSMA.Message.showSummaryTimeBox
      description: Whether to show the summary time box.
    - type: String
      contextPath: CiscoSMA.Message.sdrCategory
      description: Sender Domain Reputation category.
    - type: String
      contextPath: CiscoSMA.Message.mid
      description: Message ID.
    - type: String
      contextPath: CiscoSMA.Message.sendingHostSummary.reverseDnsHostname
      description: Sending host reverse DNS hostname.
    - type: String
      contextPath: CiscoSMA.Message.sendingHostSummary.ipAddress
      description: Sending host IP address.
    - type: String
      contextPath: CiscoSMA.Message.sendingHostSummary.sbrsScore
      description: Sending host Sender Base Reputation scores.
    - type: String
      contextPath: CiscoSMA.Message.smtpAuthId
      description: SMTP auth ID.
    - type: String
      contextPath: CiscoSMA.Message.midHeader
      description: Message ID header.
    - type: String
      contextPath: CiscoSMA.Message.timestamp
      description: Email message time.
    - type: Boolean
      contextPath: CiscoSMA.Message.showDLP
      description: Whether the DLP report is available.
    - type: String
      contextPath: CiscoSMA.Message.messageSize
      description: Email message size.
    - type: String
      contextPath: CiscoSMA.Message.sdrThreatLevels
      description: Sender Domain Reputation threat levels.
    - type: String
      contextPath: CiscoSMA.Message.sdrReputation
      description: Sender Domain Reputation.
    - type: Boolean
      contextPath: CiscoSMA.Message.showURL
      description: Whether the URL report is available.
    - type: String
      contextPath: CiscoSMA.Message.recipient
      description: Message recipient email address.
    - type: String
      contextPath: CiscoSMA.Message.sender
      description: Message sender email address.
    - type: Boolean
      contextPath: CiscoSMA.Message.showAMP
      description: Whether the AMP report is available.
    - type: String
      contextPath: CiscoSMA.Message.summary.timestamp
      description: Event summary time.
    - type: String
      contextPath: CiscoSMA.Message.summary.description
      description: Event summary description.
    - type: Boolean
      contextPath: CiscoSMA.Message.summary.lastEvent
      description: Whether the event summary is the last event.
    - type: Number
      contextPath: CiscoSMA.Message.allIcid
      description: ICIDs list.
    - type: String
      contextPath: CiscoSMA.Message.headerFrom
      description: Email header from.
  - name: cisco-sma-message-amp-details-get
    description: Get message AMP summary details.
    arguments:
    - name: serial_number
      description: Email gateway serial number.
      required: true
    - name: message_ids
      description: Message ID list.
      required: true
      isArray: true
    outputs:
    - type: String
      contextPath: CiscoSMA.AMPDetail.sdrAge
      description: Sender Domain Reputation age.
    - type: String
      contextPath: CiscoSMA.AMPDetail.attachments
      description: Message attachments.
    - type: String
      contextPath: CiscoSMA.AMPDetail.hostName
      description: Email gateway hostname.
    - type: String
      contextPath: CiscoSMA.AMPDetail.direction
      description: Message direction, incoming or outgoing.
    - type: String
      contextPath: CiscoSMA.AMPDetail.messageStatus
      description: Message delivery status.
    - type: String
      contextPath: CiscoSMA.AMPDetail.senderGroup
      description: Matched sender group.
    - type: String
      contextPath: CiscoSMA.AMPDetail.subject
      description: Email message subject.
    - type: String
      contextPath: CiscoSMA.AMPDetail.sdrCategory
      description: Sender Domain Reputation category.
    - type: Number
      contextPath: CiscoSMA.AMPDetail.mid
      description: Message ID.
    - type: String
      contextPath: CiscoSMA.AMPDetail.ampDetails.timestamp
      description: AMP event summary details timestamp.
    - type: String
      contextPath: CiscoSMA.AMPDetail.ampDetails.description
      description: AMP event summary details description.
    - type: Boolean
      contextPath: CiscoSMA.AMPDetail.ampDetails.lastEvent
      description: AMP event summary details last event.
    - type: String
      contextPath: CiscoSMA.AMPDetail.smtpAuthId
      description: SMTP auth ID.
    - type: String
      contextPath: CiscoSMA.AMPDetail.midHeader
      description: Message ID header.
    - type: String
      contextPath: CiscoSMA.AMPDetail.timestamp
      description: Email message time.
    - type: String
      contextPath: CiscoSMA.AMPDetail.messageSize
      description: Email message size.
    - type: String
      contextPath: CiscoSMA.AMPDetail.sdrThreatLevels
      description: Sender Domain Reputation threat levels.
    - type: String
      contextPath: CiscoSMA.AMPDetail.sdrReputation
      description: Sender Domain Reputation.
    - type: String
      contextPath: CiscoSMA.AMPDetail.recipient
      description: Message recipient email address.
    - type: String
      contextPath: CiscoSMA.AMPDetail.sender
      description: Message sender email address.
    - type: Boolean
      contextPath: CiscoSMA.AMPDetail.showAMPDetails
      description: Whether to show AMP details.
    - type: Number
      contextPath: CiscoSMA.AMPDetail.allIcid
      description: ICIDs list.
    - type: String
      contextPath: CiscoSMA.AMPDetail.headerFrom
      description: Email header from.
  - name: cisco-sma-message-dlp-details-get
    description: Get message DLP summary details.
    arguments:
    - name: serial_number
      description: Email gateway serial number.
      required: true
    - name: message_ids
      description: Message ID list.
      required: true
      isArray: true
    outputs:
    - type: String
      contextPath: CiscoSMA.DLPDetail.direction
      description: Message direction, incoming or outgoing.
    - type: String
      contextPath: CiscoSMA.DLPDetail.smtpAuthId
      description: SMTP auth ID.
    - type: String
      contextPath: CiscoSMA.DLPDetail.sdrAge
      description: Sender Domain Reputation age.
    - type: String
      contextPath: CiscoSMA.DLPDetail.sender
      description: Message sender email address.
    - type: String
      contextPath: CiscoSMA.DLPDetail.midHeader
      description: Message ID header.
    - type: String
      contextPath: CiscoSMA.DLPDetail.timestamp
      description: Email message time.
    - type: String
      contextPath: CiscoSMA.DLPDetail.sdrCategory
      description: Sender Domain Reputation category.
    - type: String
      contextPath: CiscoSMA.DLPDetail.hostName
      description: Email gateway hostname.
    - type: Number
      contextPath: CiscoSMA.DLPDetail.mid
      description: Message ID.
    - type: String
      contextPath: CiscoSMA.DLPDetail.attachments
      description: Message attachments.
    - type: String
      contextPath: CiscoSMA.DLPDetail.messageSize
      description: Email message size.
    - type: String
      contextPath: CiscoSMA.DLPDetail.dlpDetails.violationSeverity
      description: DLP details violation severity.
    - type: String
      contextPath: CiscoSMA.DLPDetail.dlpDetails.dlpMatchedContent.messagePartMatch.classifier
      description: DLP matched content classifier.
    - type: String
      contextPath: CiscoSMA.DLPDetail.dlpDetails.dlpMatchedContent.messagePartMatch.classifierMatch
      description: DLP matched content classifier match.
    - type: String
      contextPath: CiscoSMA.DLPDetail.dlpDetails.dlpMatchedContent.messagePart
      description: DLP matched content message part.
    - type: String
      contextPath: CiscoSMA.DLPDetail.dlpDetails.mid
      description: DLP message ID.
    - type: Number
      contextPath: CiscoSMA.DLPDetail.dlpDetails.riskFactor
      description: DLP risk factor.
    - type: String
      contextPath: CiscoSMA.DLPDetail.dlpDetails.dlpPolicy
      description: DLP policy.
    - type: String
      contextPath: CiscoSMA.DLPDetail.sdrThreatLevels
      description: Sender Domain Reputation threat levels.
    - type: String
      contextPath: CiscoSMA.DLPDetail.sdrReputation
      description: Sender Domain Reputation.
    - type: String
      contextPath: CiscoSMA.DLPDetail.messageStatus
      description: Message delivery status.
    - type: Number
      contextPath: CiscoSMA.DLPDetail.allIcid
      description: ICIDs list.
    - type: String
      contextPath: CiscoSMA.DLPDetail.senderGroup
      description: Matched sender group.
    - type: String
      contextPath: CiscoSMA.DLPDetail.recipient
      description: Message recipient email address.
    - type: String
      contextPath: CiscoSMA.DLPDetail.subject
      description: Email message subject.
    - type: String
      contextPath: CiscoSMA.DLPDetail.headerFrom
      description: Email header from.
  - name: cisco-sma-message-url-details-get
    description: Get message URL summary details.
    arguments:
    - name: serial_number
      description: Email gateway serial number.
      required: true
    - name: message_ids
      description: Message ID list.
      required: true
      isArray: true
    outputs:
    - type: String
      contextPath: CiscoSMA.URLDetail.sdrAge
      description: Sender Domain Reputation age.
    - type: String
      contextPath: CiscoSMA.URLDetail.attachments
      description: Message attachments.
    - type: Boolean
      contextPath: CiscoSMA.URLDetail.showURLDetails
      description: Whether to show URL event details.
    - type: String
      contextPath: CiscoSMA.URLDetail.urlDetails.timestamp
      description: URL event details timestamp.
    - type: String
      contextPath: CiscoSMA.URLDetail.urlDetails.description
      description: URL event details description.
    - type: String
      contextPath: CiscoSMA.URLDetail.hostName
      description: Email gateway hostname.
    - type: String
      contextPath: CiscoSMA.URLDetail.direction
      description: Message direction, incoming or outgoing.
    - type: String
      contextPath: CiscoSMA.URLDetail.messageStatus
      description: Message delivery status.
    - type: String
      contextPath: CiscoSMA.URLDetail.senderGroup
      description: Matched sender group.
    - type: String
      contextPath: CiscoSMA.URLDetail.subject
      description: Email message subject.
    - type: String
      contextPath: CiscoSMA.URLDetail.sdrCategory
      description: Sender Domain Reputation category.
    - type: Number
      contextPath: CiscoSMA.URLDetail.mid
      description: Message ID.
    - type: String
      contextPath: CiscoSMA.URLDetail.smtpAuthId
      description: SMTP auth ID.
    - type: String
      contextPath: CiscoSMA.URLDetail.midHeader
      description: Message ID header.
    - type: String
      contextPath: CiscoSMA.URLDetail.timestamp
      description: Email message time.
    - type: String
      contextPath: CiscoSMA.URLDetail.messageSize
      description: Email message size.
    - type: String
      contextPath: CiscoSMA.URLDetail.sdrThreatLevels
      description: Sender Domain Reputation threat levels.
    - type: String
      contextPath: CiscoSMA.URLDetail.sdrReputation
      description: Sender Domain Reputation.
    - type: String
      contextPath: CiscoSMA.URLDetail.recipient
      description: Message recipient Email address.
    - type: String
      contextPath: CiscoSMA.URLDetail.sender
      description: Message sender email address.
    - type: Number
      contextPath: CiscoSMA.URLDetail.allIcid
      description: ICIDs list.
    - type: String
      contextPath: CiscoSMA.URLDetail.headerFrom
      description: Email header from.
  - name: cisco-sma-report-get
    description: |-
      Get statistics reports.
      Note that each report type is compatible with different arguments.
      Refer to the following link ("ESA Reporting" section in the file) in order to view the dedicated arguments for each report type.
      https://www.cisco.com/c/dam/en/us/td/docs/security/security_management/sma/sma12-0/AsyncOS-API-Addendum-GD_General_Deployment.xlsx.
    arguments:
    - name: report_type
      description: Report Type.
      defaultValue: mail_incoming_traffic_summary
      auto: PREDEFINED
      predefined:
      - mail_incoming_traffic_summary
      - reporting_system
      - mail_vof_threat_summary
      - mail_vof_specific_threat_summary
      - mail_amp_threat_summary
    - name: custom_report_type
      description: |-
        Custom report type.
        Specify this argument in order to get a report that does not exist in the report_type argument.
    - name: start_date
      description: |-
        Start date in ISO format or <number> <time unit>,
        e.g., 2022-01-01T00:00:00.000Z, 12 hours, 7 days, 3 months, now.
      required: true
    - name: end_date
      description: |-
        End date in ISO format or <number> <time unit>,
        e.g., 2022-01-01T00:00:00.000Z, 12 hours, 7 days, 3 months, now.
      required: true
    - name: device_group_name
      description: The device group name.
      defaultValue: Hosted_Cluster
    - name: device_name
      description: The device name.
    - name: order_by
      description: Specify the attribute by which to order the data in the response. For example, orderBy=total_clean_recipients.
    - name: order_dir
      description: The report order direction. Specify sort direction.
      auto: PREDEFINED
      predefined:
      - asc
      - desc
    - name: top
      description: Specify the number of records with the highest values to return.
    - name: filter_value
      description: The value to search for.
    - name: filter_by
      description: The filter field to use. Filter the data to be retrieved according to the filter property and value.
    - name: filter_operator
      description: Filter the response data based on the value specified.
      auto: PREDEFINED
      predefined:
      - begins_with
      - is
    outputs:
    - type: String
      contextPath: CiscoSMA.Report.type
      description: Report type.
    - type: Number
      contextPath: CiscoSMA.Report.resultSet
      description: Report results summary.
fromversion: "6.2.0"
tests:
- No tests (auto formatted)