## Summary
This integration uses two Symantec APIs to manage email security.
The **Symantec Email Security API** handles general operations, such as managing IOCs, data feeds, and email queues, providing real-time monitoring and threat management.
The **Symantec Quarantine API** focuses on handling quarantined emails and manage allow/block lists for isolated emails.
For more details, see the vendor's documentation [here](https://techdocs.broadcom.com/us/en/symantec-security-software/email-security/email-security-cloud/1-0/related-documents.html).

## Credentials, URLs and Commands Mapping:
- ***Symantec Email Security API - Credentials***:
  - ***Server URL - IOC***
    - `symantec-email-security-ioc-list`
    - `symantec-email-security-ioc-action`
    - `symantec-email-security-ioc-renew`
  - ***Server URL - Data Feeds***
    - `symantec-email-security-data-list`
  - ***Server URL - Email Queue***
    - `symantec-email-security-email-queue-list`
- ***Symantec Quarantine API - Quarantine Credentials***:
  - ***Server URL - Quarantine***
    - `symantec-email-security-quarantine-email-preview-list`
    - `symantec-email-security-quarantine-email-release`
    - `symantec-email-security-quarantine-email-delete`
    - `symantec-email-security-item-allow-list-list`
    - `symantec-email-security-item-allow-list-update`
    - `symantec-email-security-item-allow-list-delete`
    - `symantec-email-security-item-block-list-list`
    - `symantec-email-security-item-block-list-update`
    - `symantec-email-security-item-block-list-delete`

## Test Connection
After inputting the **Credentials** or **Quarantine Portal Credentials**, click **Test** to validate the connection.
The test will pass if only one set of valid credentials has been entered and the other left empty, or both enetered and valid.

## Fetch Incidents
### Email Data Feed Types
| Feed Type        | Description                                                                                                                                                                                                                                                                                                                     | Further information                                                                                                                                                          |
|------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **all**          | Contains metadata for all scanned email. This feed contains a superset of the data in all of the available feeds for the services you have purchased. Also includes metadata for URLs in clean inbound email and attachments.                                                                                                                                          | Included in the Email Security.cloud service. No additional purchase required.                                                                                               |
| **malware**      | Contains data about malware-containing email only.                                                                                                                                                                                                                                                                               | Included in the Email Security.cloud service. No additional purchase required.                                                                                               |
| **threat-isolation** | Contains data from events logged by the URL and Attachment Isolation features, which ensure threats are executed in an isolation platform.                                                                                                                                                                                      | Requires purchase of Email Threat Detection and Response service and the Threat Isolation feature.                                                                           |
| **clicktime**    | Contains metadata from events generated by end-user clicks on URLs that were rewritten by the Click-time URL Protection feature.                                                                                                                                                                                                | Requires purchase of Email Threat Detection and Response service and the Click-time URL Protection service.                                                                  |
| **anti-spam**    | Contains metadata about emails that the Anti-Spam service has detected as spam, as well as the action taken as a result of that detection.                                                                                                                                                                                       | Included in the Email Security.cloud service. No additional purchase required.                                                                                               |
| **ec-reports**   | Contains contextual information about all emails blocked by Email Security.cloud's Anti-Malware service, as well as emails blocked because their attachments are determined to be malicious through Cynic sandbox execution. This information can be used to gauge the level of risk an email attack poses, so that customers can differentiate focused attacks from mass campaigns. | Requires purchase of Email Threat Detection and Response.                                                                                                                    |


## Email Quarantine Query Syntax
The search syntax is built by a field name and search value enclosed by parenthesis and the operators: `OR`, `AND` to combine multiple search criteria's or values, example: `(email_subject:test)`.
<br>Acceptable field names are:
- `dlp_message_id`
- `email_envelope_sender`
- `email_envelope_sender.raw`
- `email_sender`
- `email_envelope_recipient`
- `email_envelope_recipient.raw`
- `email_subject`
- `email_subject.raw`

See the section called *Search String Syntax* on page 16 [here](https://techdocs.broadcom.com/content/dam/broadcom/techdocs/us/en/dita/symantec-security-software/email-security/email-security-cloud/content/EmailQuarantineAPIGuide.pdf).