commonfields:
  id: FireEye ETP
  version: -1
name: FireEye ETP
display: Trellix Email Security - Cloud
category: Network Security
provider: Trellix
sectionorder:
- Connect
- Collect
description: 'Trellix Email Security - Cloud is a cloud-based platform that protects against advanced email attacks.'
configuration:
- display: 'Server URL'
  name: server
  defaultvalue: https://etp.us.fireeye.com
  type: 0
  required: true
  additionalinfo: "Valid URLs (US, EMEA, USGOV): https://us.etp.trellix.com / https://etp.us.fireeye.com, https://eu.etp.trellix.com / https://etp.eu.fireeye.com, https://etp.us.fireeyegov.com"
  section: Connect
- display: Client ID (OAuth)
  name: credentials
  displaypassword: Client Secret (OAuth)
  type: 9
  additionalinfo: Use the Client ID and Client Secret for the Trellix base URL.
  section: Connect
- display: OAuth Scopes (OAuth)
  name: oauth_scopes
  defaultvalue: etp.conf.ro etp.trce.rw etp.admn.ro etp.domn.ro etp.accs.rw etp.quar.rw etp.domn.rw etp.rprt.rw etp.accs.ro etp.quar.ro etp.alrt.rw etp.rprt.ro etp.conf.rw etp.trce.ro etp.alrt.ro etp.admn.rw
  type: 0
  required: false
  additionalinfo: "Space-separated list of OAuth scopes. Note: Only include scopes that your application's Client ID has already been authorized to use."
  section: Connect
- display: Token URL
  name: token_url
  type: 0
  required: false
  additionalinfo: "The OAuth 2.0 token endpoint base URL override. Leave empty to use the default Trellix IAM endpoint. For Trellix GovCloud tenants, set to https://iam.us.trellix-gov.com."
  section: Connect
  advanced: true
- display: API key
  name: api_key
  defaultvalue: ""
  type: 4
  hidden: true
  required: false
  section: Connect
- displaypassword: API Key
  name: credentials_api_key
  hiddenusername: true
  type: 9
  required: false
  additionalinfo: Use the Api key for the FireEye base URL.
  section: Connect
- display: Trust any certificate (not secure)
  name: unsecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- defaultvalue: 1 minutes
  display: First fetch timestamp.
  name: fetch_time
  type: 0
  section: Collect
  required: false
- display: Incidents Fetch Interval
  defaultvalue: '1'
  name: incidentFetchInterval
  type: 19
  section: Collect
  advanced: true
  required: false
- display: Max incidents per fetch
  name: incidents_per_fetch
  type: 0
  section: Collect
  required: false
  defaultvalue: '59'
  additionalinfo: Input a value between 1 and 59. Values above 59 will be internally capped to avoid exceeding API rate limits.
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Alerts statuses to import
  additionalinfo: All alerts with a status specified here will be imported as incidents.
  name: message_status
  defaultvalue: delivered (retroactive)
  type: 16
  options:
  - accepted
  - deleted
  - delivered
  - delivered (retroactive)
  - dropped
  - dropped oob
  - dropped (oob retroactive)
  - permanent failure
  - processing
  - quarantined
  - rejected
  - temporary failure
  required: false
  section: Collect
script:
  script: '-'
  type: python
  commands:
  - name: fireeye-etp-search-messages
    arguments:
    - name: from_email
      description: 'List of ''From'' email-addresses, max limit of entries is 10. '
    - name: from_email_not_in
      description: 'List of ''From'' email-addresses not to be included, max limit of entries is 10. '
    - name: recipients
      description: List of 'To'/'Cc' email-addresses, max limit of entries is 10.
    - name: recipients_not_in
      description: 'list of ''To''/''Cc'' email-addresses not to be included, max limit of entries is 10. '
    - name: subject
      description: List of strings, max limit of entries is 10.
    - name: from_accepted_date_time
      description: ' The time stamp of the email-accepted date to specify the beginning of the date range to search, e.g. 2017-10-24T10:48:51.000Z . Specify ''to_accepted_date_time''  as well to set the complete date range for the search.'
    - name: to_accepted_date_time
      description: ' The time stamp of the email-accepted date to specify the end of the date range to search, e.g. 2017-10-24T10:48:51.000Z . Specify ''from_accepted_date_time''  as well to set the complete date range for the search.'
    - name: rejection_reason
      description: 'List of ETP rejection reason codes ( "ETP102", "ETP103", "ETP104", "ETP200", "ETP201", "ETP203", "ETP204", "ETP205", "ETP300", "ETP301", "ETP302", "ETP401", "ETP402", "ETP403", "ETP404", "ETP405"). '
    - name: sender_ip
      description: List of sender IP addresses, max limit of entries is 10.
    - name: status
      description: List of email status values( "accepted", "deleted", "delivered", "delivered (retroactive)", "dropped", "dropped oob", "dropped (oob retroactive)", "permanent failure", "processing", "quarantined", "rejected", "temporary failure").
    - name: status_not_in
      description: List of email status values not to include( "accepted", "deleted", "delivered", "delivered (retroactive)", "dropped", "dropped oob", "dropped (oob retroactive)", "permanent failure", "processing", "quarantined", "rejected", "temporary failure").
    - name: last_modified_date_time
      description: 'Date corresponding to last modified date, along with one of the following operators: ">", "<", ">=", "<=".  E.g. use value "<2017-10-24T18:00:00.000Z" to search for messages that were last modified after the specified time stamp.'
    - name: domain
      description: List of domain names.
    - name: has_attachments
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Boolean value to indicate if the message has attachments.
    - name: max_message_size
      description: The default value is 20kb and maximum value is 100kb.
    outputs:
    - contextPath: FireEyeETP.Message.acceptedDateTime
      description: Message accepted date.
    - contextPath: FireEyeETP.Message.countryCode
      description: Sender country code.
    - contextPath: FireEyeETP.Message.domain
      description: Domain.
    - contextPath: FireEyeETP.Message.emailSize
      description: Email size in kb.
    - contextPath: FireEyeETP.Message.lastModifiedDateTime
      description: Message last modified date.
    - contextPath: FireEyeETP.Message.recipientHeader
      description: List of message recipients header (includes the display name of the user).
    - contextPath: FireEyeETP.Message.recipients
      description: List of message recipients.
    - contextPath: FireEyeETP.Message.senderHeader
      description: Message sender header (includes the display name of the user).
    - contextPath: FireEyeETP.Message.sender
      description: Message sender address.
    - contextPath: FireEyeETP.Message.senderSMTP
      description: Message sender SMTP.
    - contextPath: FireEyeETP.Message.senderIP
      description: Message sender IP.
    - contextPath: FireEyeETP.Message.status
      description: Message status.
    - contextPath: FireEyeETP.Message.subject
      description: Message subject.
    - contextPath: FireEyeETP.Message.verdicts.AS
      description: pass/fail verdict for AS.
    - contextPath: FireEyeETP.Message.verdicts.AV
      description: pass/fail verdict for AV.
    - contextPath: FireEyeETP.Message.verdicts.AT
      description: pass/fail verdict for AT.
    - contextPath: FireEyeETP.Message.verdicts.PV
      description: pass/fail verdict for PV.
    - contextPath: FireEyeETP.Message.id
      description: Message ID.
    description: Search for messages that include specified message attributes that are accessible in the ETP portal.
  - name: fireeye-etp-get-message
    arguments:
    - name: message_id
      required: true
      description: The message ID.
    outputs:
    - contextPath: FireEyeETP.Message.acceptedDateTime
      description: Message accepted date.
    - contextPath: FireEyeETP.Message.countryCode
      description: Sender country code.
    - contextPath: FireEyeETP.Message.domain
      description: Domain.
    - contextPath: FireEyeETP.Message.emailSize
      description: Email size in kb.
    - contextPath: FireEyeETP.Message.lastModifiedDateTime
      description: Message last modified date.
    - contextPath: FireEyeETP.Message.recipientHeader
      description: List of message recipients header (includes the display name of the user).
    - contextPath: FireEyeETP.Message.recipients
      description: List of message recipients.
    - contextPath: FireEyeETP.Message.senderHeader
      description: Message sender header (includes the display name of the user).
    - contextPath: FireEyeETP.Message.sender
      description: Message sender address.
    - contextPath: FireEyeETP.Message.senderSMTP
      description: Message sender SMTP.
    - contextPath: FireEyeETP.Message.senderIP
      description: Message sender IP.
    - contextPath: FireEyeETP.Message.status
      description: Message status.
    - contextPath: FireEyeETP.Message.subject
      description: Message subject.
    - contextPath: FireEyeETP.Message.verdicts.AS
      description: pass/fail verdict for AS.
    - contextPath: FireEyeETP.Message.verdicts.AV
      description: pass/fail verdict for AV.
    - contextPath: FireEyeETP.Message.verdicts.AT
      description: pass/fail verdict for AT.
    - contextPath: FireEyeETP.Message.verdicts.PV
      description: pass/fail verdict for PV.
    - contextPath: FireEyeETP.Message.id
      description: Message ID.
    description: Get the data of a specific message.
  - name: fireeye-etp-get-alerts
    arguments:
    - name: legacy_id
      description: Alert ID as shown in ETP Web Portal.
    - name: from_last_modified_on
      description: Datetime in yyy-mm-ddThh:mm:ss.fff format. Default last 90 days.
    - name: etp_message_id
      description: Email message id.
    - name: size
      description: Number of alerts intended in response. Default 20. Valid range 1-100 .
    outputs:
    - contextPath: FireEyeETP.Alerts.meta.read
      description: Email read flag.
    - contextPath: FireEyeETP.Alerts.meta.last_modified_on
      description: Last modified timestamp.
    - contextPath: FireEyeETP.Alerts.meta.legacy_id
      description: Alert ID as shown in ETP Web Portal.
    - contextPath: FireEyeETP.Alerts.alert.product
      description: Product alerted.
    - contextPath: FireEyeETP.Alerts.alert.timestamp
      description: Alert timestamp.
    - contextPath: FireEyeETP.Alerts.alert.malware_md5
      description: md5 of file attached.
    - contextPath: FireEyeETP.Alerts.email.status
      description: The email status.
    - contextPath: FireEyeETP.Alerts.email.source_ip
      description: Email source IP.
    - contextPath: FireEyeETP.Alerts.email.smtp.rcpt_to
      description: Recipient SMTP.
    - contextPath: FireEyeETP.Alerts.email.smtp.mail_from
      description: Sender SMTP.
    - contextPath: FireEyeETP.Alerts.email.etp_message_id
      description: The message ID.
    - contextPath: FireEyeETP.Alerts.email.headers.cc
      description: Email 'cc' recipients.
    - contextPath: FireEyeETP.Alerts.email.headers.to
      description: Email recipients.
    - contextPath: FireEyeETP.Alerts.email.headers.from
      description: Email sender.
    - contextPath: FireEyeETP.Alerts.email.headers.subject
      description: Email subject.
    - contextPath: FireEyeETP.Alerts.email.attachment
      description: File name or URL pointing to file.
    - contextPath: FireEyeETP.Alerts.email.timestamp.accepted
      description: Email accepted time.
    - contextPath: FireEyeETP.Alerts.id
      description: The alert ID.
    description: 'Get summary format information about the alerts.
      Deprecated. Use the fireeye-etp-list-alerts instead.'
    deprecated: true
  - name: fireeye-etp-list-alerts
    arguments:
    - name: alert_id
      description: The alert ID.
    - name: date_from
      description: Supports ISO format (e.g., 2025-09-02T06:45:01Z) or natural language ("7 days ago", "now").
    - name: date_to
      description: Supports ISO format (e.g., 2025-09-02T06:45:01Z) or natural language ("7 days ago", "now").
    - name: domain
      isArray: true
      description: List of domain names.
    - name: domain_group
      isArray: true
      description: List of domain groups names.
    - name: email_header_subject
      isArray: true
      description: List of message subject headers.
    - name: is_read
      type: boolean
      description: is_read flag.
    - name: is_retro
      type: boolean
      description: is_retro flag.
    - name: malwarename
      isArray: true
      description: List of malware names.
    - name: malwarestype
      isArray: true
      description: List of malware types.
    - name: md5
      isArray: true
      description: List of md5.
    - name: mta_msg_id
      isArray: true
      description: List of mta_msg_id.
    - name: traffic_type
      auto: PREDEFINED
      predefined:
      - inbound
      - outbound
      description: 'Traffic type defaults to inbound. To handle outbound traffic, set the traffic_type parameter to outbound. Possible values are: inbound, outbound.'
    - name: verdict
      isArray: true
      description: List of verdicts.
    - name: limit
      description: 'Number of alerts to include in response. Valid range: 1-200.'
    outputs:
    - contextPath: FireEyeETP.Alerts.domain
      description: Domain.
    - contextPath: FireEyeETP.Alerts.report_id
      description: Report_id.
    - contextPath: FireEyeETP.Alerts.id
      description: The alert unique ID.
    - contextPath: FireEyeETP.Alerts.alert_date
      description: The alert date.
    description: 'Get summary format information about the alerts.'
  - name: fireeye-etp-get-alert
    arguments:
    - name: alert_id
      required: true
      description: The alert ID.
    outputs:
    - contextPath: FireEyeETP.Alerts.meta.read
      description: Email read flag.
    - contextPath: FireEyeETP.Alerts.meta.last_modified_on
      description: Last modified timestamp.
    - contextPath: FireEyeETP.Alerts.meta.legacy_id
      description: Alert ID as shown in ETP Web Portal.
    - contextPath: FireEyeETP.Alerts.meta.acknowledged
      description: Acknowledged.
    - contextPath: FireEyeETP.Alerts.alert.product
      description: Product generate the alert.
    - contextPath: FireEyeETP.Alerts.alert.alert_type
      description: Alert type code.
    - contextPath: FireEyeETP.Alerts.alert.severity
      description: Severity code.
    - contextPath: FireEyeETP.Alerts.alert.explanation.analysis
      description: Analysis.
    - contextPath: FireEyeETP.Alerts.alert.explanation.anomaly
      description: Anomaly.
    - contextPath: FireEyeETP.Alerts.alert.explanation.malware_detected.malware.domain
      description: Malware domain.
    - contextPath: FireEyeETP.Alerts.alert.explanation.malware_detected.malware.downloaded_at
      description: Malware downloaded at timestamp.
    - contextPath: FireEyeETP.Alerts.alert.explanation.malware_detected.malware.executed_at
      description: Malware executed at timestamp.
    - contextPath: FireEyeETP.Alerts.alert.explanation.malware_detected.malware.name
      description: Malware name.
    - contextPath: FireEyeETP.Alerts.alert.explanation.malware_detected.malware.sid
      description: Malware SID.
    - contextPath: FireEyeETP.Alerts.alert.explanation.malware_detected.malware.stype
      description: Malware type.
    - contextPath: FireEyeETP.Alerts.alert.explanation.malware_detected.malware.submitted_at
      description: Malware submitted at.
    - contextPath: FireEyeETP.Alerts.alert.explanation.protocol
      description: Protocol.
    - contextPath: FireEyeETP.Alerts.alert.explanation.timestamp
      description: Explanation timestamp.
    - contextPath: FireEyeETP.Alerts.alert.timestamp
      description: Alert timestamp.
    - contextPath: FireEyeETP.Alerts.alert.action
      description: Alert action.
    - contextPath: FireEyeETP.Alerts.alert.name
      description: Alert name.
    - contextPath: FireEyeETP.Alerts.email.status
      description: The email status.
    - contextPath: FireEyeETP.Alerts.email.source_ip
      description: Email source IP.
    - contextPath: FireEyeETP.Alerts.email.smtp.rcpt_to
      description: Recipient SMTP.
    - contextPath: FireEyeETP.Alerts.email.smtp.mail_from
      description: Sender SMTP.
    - contextPath: FireEyeETP.Alerts.email.etp_message_id
      description: FE ETP unique message ID.
    - contextPath: FireEyeETP.Alerts.email.headers.cc
      description: Email cc recipients.
    - contextPath: FireEyeETP.Alerts.email.headers.to
      description: Email recipients.
    - contextPath: FireEyeETP.Alerts.email.headers.from
      description: Email sender.
    - contextPath: FireEyeETP.Alerts.email.headers.subject
      description: Email subject.
    - contextPath: FireEyeETP.Alerts.email.attachment
      description: File name or URL pointing to file.
    - contextPath: FireEyeETP.Alerts.email.timestamp.accepted
      description: Email eccepted time.
    - contextPath: FireEyeETP.Alerts.id
      description: The alert unique ID.
    description: 'Detailed information from any particular alert. Alerts more than 90 days old are not available.
      Deprecated. Use the fireeye-etp-list-alerts instead.'
    deprecated: true
  - name: fireeye-etp-download-alert-artifact
    deprecated: true
    arguments:
    - name: alert_id
      required: true
      description: The alert ID.
    description: 'Downloads all case files of the alert specified by the alert ID, in
      a zip file. You can obtain the ID from the Alert Summary response, for example
      "id": "AV7zzRy7kvIwrKcfu0I".
      Deprecated. Use the fireeye-etp-download-alert-case-files instead.'
  - name: fireeye-etp-download-alert-case-files
    arguments:
    - name: alert_id
      required: true
      description: The alert ID.
    description: 'Downloads all case files of the alert specified by the alert ID, in
      a zip file. You can obtain the ID from the Alert Summary response, for example
      "id": "AV7zzRy7kvIwrKcfu0I". The downloaded zip is password protected, and the password is "infected".'
  - name: fireeye-etp-list-yara-rulesets
    arguments:
    - name: policy_uuid
      required: true
      description: Universally unique identifier (UUID) of the policy. (Can be found
        in the URL of the ETP Policies).
    outputs:
    - contextPath: FireEyeETP.Policy
      description: The policy id.
    description: Fetch the list of YARA rulesets and return a list with all the rules.
  - name: fireeye-etp-download-yara-file
    arguments:
    - name: policy_uuid
      required: true
      description: Universally unique identifier (UUID) of the policy. (Can be found
        in the URL of the ETP Policies).
    - name: ruleset_uuid
      required: true
      description: Universally unique identifier (UUID) of the ruleset.
    description: Downloads a YARA file.
  - name: fireeye-etp-upload-yara-file
    arguments:
    - name: policy_uuid
      required: true
      description: Universally unique identifier (UUID) of the policy. (Can be found
        in the URL of the ETP Policies).
    - name: ruleset_uuid
      required: true
      description: Universally unique identifier (UUID) of the ruleset.
    - name: entryID
      required: true
      description: Entry ID of yara file to upload.
    description: Update or replace the YARA rule file in the existing ruleset.
  - name: fireeye-etp-get-events-data
    arguments:
    - name: message_id
      required: true
      description: Message ID of alert.
    outputs:
    - contextPath: FireEyeETP.Events
      description: The events of the alert.
    - contextPath: FireEyeETP.Events.Delivered_msg
      description: Display if event is delivered successfully or not.
    - contextPath: FireEyeETP.Events.Delivered_status
      description: The status of the message.
    - contextPath: FireEyeETP.Events.InternetMessageId
      description: The internet message ID of the alert.
    - contextPath: FireEyeETP.Events.Logs
      description: The logs of the alert.
    description: Returns all events of the alert by the alert ID.
  - name: fireeye-etp-quarantine-release
    arguments:
    - name: message_id
      description: The message ID.
    description: Releases the email file present in the quarantine for the given email.
      Cloud message ID.
  isfetch: true
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10404775
tests:
- No Test
defaultclassifier: Trellix Incident Classifier
defaultmapperin: Trellix Mapper
fromversion: 5.0.0