category: Network Security provider: LevelBlue commonfields: id: trustwave secure email gateway version: -1 configuration: - additionalinfo: Hostname or IP address (localhost or 127.0.0.1). defaultvalue: localhost display: Hostname or IP name: host required: true type: 0 - additionalinfo: Used for retrieving a token for the commands. defaultvalue: '19007' display: SEG Configuration Service Port name: config_port required: true type: 0 - additionalinfo: Used for accessing the API console. defaultvalue: '19006' display: SEG API Port name: api_port required: true type: 0 - display: User Credentials name: credentials required: true type: 9 - display: Trust any certificate (not secure) name: insecure type: 8 required: false - display: Use system proxy settings name: proxy type: 8 required: false description: Trustwave SEG is a secure messaging solution that protects businesses and users from email-borne threats, including phishing, blended threats, and spam. Trustwave Secure Email Gateway also delivers improved policy enforcement and data leakage prevention. display: Trustwave Secure Email Gateway name: trustwave secure email gateway script: commands: - description: Gets Trustwave version information. name: trustwave-seg-get-version outputs: - contextPath: TrustwaveSEG.Version.configVersion description: The configuration version. type: Number - contextPath: TrustwaveSEG.Version.productVersion description: The product version. type: String - contextPath: TrustwaveSEG.Version.rpcInterfaceVersion description: The RPC interface version. type: Number - description: Returns a list of automatic configuration backups. name: trustwave-seg-automatic-config-backup-list outputs: - contextPath: TrustwaveSEG.AutomaticBackupConfig.fileSize description: The file size of the automatic configuration backup. type: Number - contextPath: TrustwaveSEG.AutomaticBackupConfig.filename description: The filename of the automatic configuration backup. type: String - contextPath: TrustwaveSEG.AutomaticBackupConfig.info.backupTime description: The backup time of the automatic configuration backup. type: Number - contextPath: TrustwaveSEG.AutomaticBackupConfig.info.backupTimeStr description: The backup time string of the automatic configuration backup. type: Date - contextPath: TrustwaveSEG.AutomaticBackupConfig.info.backupType description: The backup type of the automatic configuration backup. type: String - contextPath: TrustwaveSEG.AutomaticBackupConfig.info.backupUser description: The back up user of the automatic configuration backup. type: String - contextPath: TrustwaveSEG.AutomaticBackupConfig.info.commitDescription description: The commit description of the automatic configuration backup. type: String - contextPath: TrustwaveSEG.AutomaticBackupConfig.info.commitSetId description: The commit set ID of the automatic configuration backup. type: Number - contextPath: TrustwaveSEG.AutomaticBackupConfig.info.commitUser description: The commit user of the automatic configuration backup. type: String - contextPath: TrustwaveSEG.AutomaticBackupConfig.info.configVersion description: The configuration version of the automatic configuration backup. type: Number - contextPath: TrustwaveSEG.AutomaticBackupConfig.info.containsDkimKeys description: Whether there are DomainKeys Identified Mail (DKIM) keys for the automatic configuration backup. type: Boolean - contextPath: TrustwaveSEG.AutomaticBackupConfig.info.productVersion description: The product version of the automatic configuration backup. type: String - contextPath: TrustwaveSEG.AutomaticBackupConfig.lastModified description: The date the automatic backup configuration was last modified. type: Number - arguments: - description: 'The name of the backup to restore (e.g., MailMarshal-10.0.1-ManualBackup_11-Apr-2021-05-00-10).' name: name required: true - defaultValue: '30' description: The timeout for the request in seconds. This request might take a while. If the request fails due to a connectivity error, try to add more time to this argument. name: timeout - auto: PREDEFINED defaultValue: 'false' description: Whether DKIM (DomainKeys Identified Mail) should be used. name: include_dkim predefined: - 'true' - 'false' - description: If include_dkim is true, the DKIM password for the action. name: dkim_password secret: true description: Restores a specific automatic configuration backup. name: trustwave-seg-automatic-config-backup-restore outputs: - contextPath: TrustwaveSEG.AutomaticBackupRestore.errors description: The errors of the AutomaticBackupRestore. type: String - contextPath: TrustwaveSEG.AutomaticBackupRestore.reason description: The reason for the AutomaticBackupRestore. type: String - contextPath: TrustwaveSEG.AutomaticBackupRestore.warnings description: The warnings of the AutomaticBackupRestore. type: String - arguments: - defaultValue: '30' description: The timeout for the request in seconds. This request might take a while. If the request fails due to a connectivity error, try to add more seconds to the timeout. name: timeout - auto: PREDEFINED defaultValue: 'false' description: Choose if DKIM (DomainKeys Identified Mail) should be used. name: include_dkim predefined: - 'true' - 'false' - description: If include_dkim equals true - Please specify the DKIM password (defaults to configured password). name: dkim_password secret: true description: Run automatic backup now. name: trustwave-seg-automatic-config-backup-run outputs: - contextPath: TrustwaveSEG.AutomaticBackupRun.backupName description: The backup name of the automatic backup run. type: String - contextPath: TrustwaveSEG.AutomaticBackupRun.reason description: The reason for the automatic backup run. type: String - arguments: - auto: PREDEFINED default: true defaultValue: 'false' description: Whether to return only active alarms. name: active_only predefined: - 'true' - 'false' description: Gets a list of current alerts. name: trustwave-seg-list-alerts outputs: - contextPath: TrustwaveSEG.Alert.active description: The activity of the alert. type: Boolean - contextPath: TrustwaveSEG.Alert.description description: The description of the alert. type: String - contextPath: TrustwaveSEG.Alert.node description: The node of the alert. type: Number - contextPath: TrustwaveSEG.Alert.source description: The source of the alert. type: String - contextPath: TrustwaveSEG.Alert.triggered description: The trigger of the alert. type: Number - contextPath: TrustwaveSEG.Alert.type description: The type of the alert. type: Number - arguments: - description: 'An optional time range, i.e., 3 months, 1 week, 1 day ago, etc.' name: time_range - description: 'Start time in the format of: YYYY-mm-ddTHH:MM:SSZ or i.e., 3 months, 1 week, 1 day ago, etc. Given only the start_time, end_time will be set to the current time.' name: start_time - description: 'End time in the format of: YYYY-mm-ddTHH:MM:SSZ or i.e., 3 months, 1 week, 1 day ago, etc.' name: end_time description: Gets Trustwave SEG statistics. Must provide a start time or time range. name: trustwave-seg-statistics outputs: - contextPath: TrustwaveSEG.Statistics.maliciousUrls description: The number of malicious URLs in the statistics. type: Number - contextPath: TrustwaveSEG.Statistics.msgsBlendedThreats description: The number blended threats messages in the statistics. type: Number - contextPath: TrustwaveSEG.Statistics.msgsIn description: The number of incoming messages in the statistics. type: Number - contextPath: TrustwaveSEG.Statistics.msgsInternal description: The number of internal messages in the statistics. type: Number - contextPath: TrustwaveSEG.Statistics.msgsOut description: The number of outgoing messages in the statistics. type: Number - contextPath: TrustwaveSEG.Statistics.msgsSpam description: The number of spam messages in the statistics. type: Number - contextPath: TrustwaveSEG.Statistics.msgsVirus description: The number of virus messages in the statistics. type: Number - contextPath: TrustwaveSEG.Statistics.numQuarantined description: The number of quarantined messages in the statistics. type: Number - contextPath: TrustwaveSEG.Statistics.numQuarantinesPerMsg description: The number of quarantines per message in the statistics. type: Number - contextPath: TrustwaveSEG.Statistics.pFolders description: The number of pFolders in the statistics. type: Number - contextPath: TrustwaveSEG.Statistics.pThreats description: The number of pThreats in the statistics. type: Number - contextPath: TrustwaveSEG.Statistics.safeClicks description: The number of safe clicks in the statistics.in the statistics. type: Number - contextPath: TrustwaveSEG.Statistics.unsafeClicks description: The number of unsafe clicks. type: Number - contextPath: TrustwaveSEG.Statistics.unsafeUrls description: The number of unsafe URLs in the statistics. type: Number - contextPath: TrustwaveSEG.Statistics.urlsFound description: The number of URLs found in the statistics. type: Number - contextPath: TrustwaveSEG.Statistics.urlsRewritten description: The number of urls rewritten in the statistics. type: Number - contextPath: TrustwaveSEG.Statistics.virusDetected description: The number of viruses detected in the statistics. type: Number - contextPath: TrustwaveSEG.Statistics.virusScanned description: The number of virus-scanned statistics. type: Number - description: Gets a list of servers. name: trustwave-seg-list-servers outputs: - contextPath: TrustwaveSEG.Server.configCommitSetId description: The configuration commit set ID of the server. type: Number - contextPath: TrustwaveSEG.Server.configTimeStamp description: The configuration timestamp of the server. type: Number - contextPath: TrustwaveSEG.Server.disconnectedReason description: Disconnected reason for the server. type: String - contextPath: TrustwaveSEG.Server.isActive description: Activation status of the Server. type: Boolean - contextPath: TrustwaveSEG.Server.isConfigDeferred description: Whether the configuration of the server is deferred. type: Boolean - contextPath: TrustwaveSEG.Server.lastConnected description: Last connected time of the server. type: Number - contextPath: TrustwaveSEG.Server.osVersion description: The operating system version of the server. type: String - contextPath: TrustwaveSEG.Server.pServiceStatus.description description: The description of the server. type: String - contextPath: TrustwaveSEG.Server.pServiceStatus.lastError description: Last error of the server. type: Unknown - contextPath: TrustwaveSEG.Server.pServiceStatus.name description: The name of the server. type: String - contextPath: TrustwaveSEG.Server.pServiceStatus.serviceId description: The service ID of the server. type: Number - contextPath: TrustwaveSEG.Server.pServiceStatus.state description: The state of the server. type: Number - contextPath: TrustwaveSEG.Server.productVersion description: The product version of the server. type: String - contextPath: TrustwaveSEG.Server.serverDescription description: The description of the server. type: String - contextPath: TrustwaveSEG.Server.serverId description: The ID of the server. type: Number - contextPath: TrustwaveSEG.Server.serverLocation description: The location of the server. type: String - contextPath: TrustwaveSEG.Server.serverName description: The name of the server. type: String - contextPath: TrustwaveSEG.Server.timeZoneName description: Timezone name of the server. type: String - contextPath: TrustwaveSEG.Server.timeZoneOffset description: Timezone offset of the server. type: Number - arguments: - description: The ID of the server from which to retrieve information. name: server_id required: true description: Gets server details. name: trustwave-seg-get-server outputs: - contextPath: TrustwaveSEG.Server.configCommitSetId description: The configuration commit set ID of the server. type: Number - contextPath: TrustwaveSEG.Server.configTimeStamp description: The configuration timestamp of the server. type: Number - contextPath: TrustwaveSEG.Server.disconnectedReason description: Disconnected reason for the server. type: String - contextPath: TrustwaveSEG.Server.isActive description: Activation status of the Server. type: Boolean - contextPath: TrustwaveSEG.Server.isConfigDeferred description: Whether the configuration of the server is deferred. type: Boolean - contextPath: TrustwaveSEG.Server.lastConnected description: Last connected time of the server. type: Number - contextPath: TrustwaveSEG.Server.osVersion description: The operating system version of the server. type: String - contextPath: TrustwaveSEG.Server.pServiceStatus.description description: The description of the server. type: String - contextPath: TrustwaveSEG.Server.pServiceStatus.lastError description: Last error of the server. type: Unknown - contextPath: TrustwaveSEG.Server.pServiceStatus.name description: The name of the server. type: String - contextPath: TrustwaveSEG.Server.pServiceStatus.serviceId description: The service ID of the server. type: Number - contextPath: TrustwaveSEG.Server.pServiceStatus.state description: The state of the server. type: Number - contextPath: TrustwaveSEG.Server.productVersion description: The product version of the server. type: String - contextPath: TrustwaveSEG.Server.serverDescription description: The description of the server. type: String - contextPath: TrustwaveSEG.Server.serverId description: The ID of the server. type: Number - contextPath: TrustwaveSEG.Server.serverLocation description: The location of the server. type: String - contextPath: TrustwaveSEG.Server.serverName description: The name of the server. type: String - contextPath: TrustwaveSEG.Server.timeZoneName description: Timezone name of the server. type: String - contextPath: TrustwaveSEG.Server.timeZoneOffset description: Timezone offset of the server. type: Number - description: Gets a list of classifications. name: trustwave-seg-list-classifications outputs: - contextPath: TrustwaveSEG.Classification.code description: The code of the classification. type: Number - contextPath: TrustwaveSEG.Classification.id description: The ID of the classification. type: Number - contextPath: TrustwaveSEG.Classification.name description: The name of the classification. type: String - contextPath: TrustwaveSEG.Classification.type description: The type of the classification. type: Number - description: Gets a list of folders. name: trustwave-seg-list-quarantine-folders outputs: - contextPath: TrustwaveSEG.Folder.description description: The description of the folder. type: String - contextPath: TrustwaveSEG.Folder.folderId description: The ID of the folder. type: Number - contextPath: TrustwaveSEG.Folder.folderType description: The type of the folder. type: Number - contextPath: TrustwaveSEG.Folder.iconIndex description: The icon index of the folder. type: Number - contextPath: TrustwaveSEG.Folder.isDeleted description: Whether the folder is deleted. type: Boolean - contextPath: TrustwaveSEG.Folder.isFingerprintingEnabled description: Whether fingerprinting is enabled for the folder. type: Boolean - contextPath: TrustwaveSEG.Folder.isPassThru description: Whether pass thru is enabled for the folder. type: Boolean - contextPath: TrustwaveSEG.Folder.isPublishedInbound description: Whether the folder is published inbound. type: Boolean - contextPath: TrustwaveSEG.Folder.isPublishedOutbound description: Whether the folder is published outbound. type: Boolean - contextPath: TrustwaveSEG.Folder.isReadOnly description: Whether the folder is read-only. type: Boolean - contextPath: TrustwaveSEG.Folder.name description: The name of the folder. type: String - contextPath: TrustwaveSEG.Folder.numFiles description: The number of files in the folder. type: Number - contextPath: TrustwaveSEG.Folder.parentId description: The parent ID of the folder. type: Number - contextPath: TrustwaveSEG.Folder.path description: The path of the folder. type: String - contextPath: TrustwaveSEG.Folder.retention description: The retention of the folder. type: Number - contextPath: TrustwaveSEG.Folder.securityDescription description: The security description of the folder. type: String - description: Gets a list of folders with current day information. name: trustwave-seg-list-quarantine-folders-with-day-info outputs: - contextPath: TrustwaveSEG.Folder.dayItems description: The items of the day for the folder. type: Unknown - contextPath: TrustwaveSEG.Folder.description description: The description of the folder. type: String - contextPath: TrustwaveSEG.Folder.folderId description: The ID of the folder. type: Number - contextPath: TrustwaveSEG.Folder.folderType description: The type of the folder. type: Number - contextPath: TrustwaveSEG.Folder.iconIndex description: The icon index of the folder. type: Number - contextPath: TrustwaveSEG.Folder.isDeleted description: Whether the folder is deleted. type: Boolean - contextPath: TrustwaveSEG.Folder.isFingerprintingEnabled description: Whether fingerprinting is enabled for the folder. type: Boolean - contextPath: TrustwaveSEG.Folder.isPassThru description: Whether pass thru is enabled for the folder. type: Boolean - contextPath: TrustwaveSEG.Folder.isPublishedInbound description: Whether the folder is published inbound. type: Boolean - contextPath: TrustwaveSEG.Folder.isPublishedOutbound description: Whether the folder is published outbound. type: Boolean - contextPath: TrustwaveSEG.Folder.isReadOnly description: Whether the is folder read-only. type: Boolean - contextPath: TrustwaveSEG.Folder.name description: The name of the folder. type: String - contextPath: TrustwaveSEG.Folder.numFiles description: The number of files in the folder. type: Number - contextPath: TrustwaveSEG.Folder.parentId description: The parent ID of the folder. type: Number - contextPath: TrustwaveSEG.Folder.path description: The path of the folder. type: String - contextPath: TrustwaveSEG.Folder.retention description: The retention of the folder. type: Number - contextPath: TrustwaveSEG.Folder.securityDescription description: The security description of the folder. type: String - arguments: - description: The ID of the folder with quarantine day information. name: folder_id required: true description: Get the current day information for a folder. name: trustwave-seg-list-day-info-by-quarantine-folder outputs: - contextPath: TrustwaveSEG.DayInfo.endTime description: The end time of the day information. type: Number - contextPath: TrustwaveSEG.DayInfo.numFiles description: The number of files of the day information. type: Number - contextPath: TrustwaveSEG.DayInfo.startTime description: The start time of the day information. type: Number - arguments: - description: 'An optional time range of the search, i.e., 3 months, 1 week, 1 day ago, etc.' name: time_range - description: 'Start time of the search in the format: YYYY-mm-ddTHH:MM:SSZ or i.e., 3 months, 1 week, 1 day ago, etc. Given only the start_time, end_time will be set to the current time.' name: start_time - description: 'End time of the search in the format: YYYY-mm-ddTHH:MM:SSZ or i.e., 3 months, 1 week, 1 day ago, etc.' name: end_time - default: true defaultValue: '10' description: The number of rows to return from the API. Default to 10. name: max_rows - description: 'The ID of the folder in which to search for information (e.g., 1006).' name: folder_id - description: The name of the message to search for. name: message_name - description: 'The classification ID. Can be found by using the classification command (e.g., 37).' name: classification - description: The email address from which the message was sent. name: from_user - description: The email address to which the message was sent. name: to_user - description: The domain to which the message was sent. name: to_domain - description: 'The minimum size in bytes of the message (e.g., 0).' name: min_size - description: 'The maximum size in bytes of the message (e.g., 1024).' name: max_size - description: 'The subject of the message. (e.g., "some subject").' name: subject - auto: PREDEFINED description: Whether the search should include the history. name: search_history predefined: - 'true' - 'false' - auto: PREDEFINED description: Whether the search should include forwarded messages. name: forwards predefined: - 'true' - 'false' - description: 'The block number of the message (e.g., 106098471075840).' name: block_number - auto: PREDEFINED description: Whether the search should include messages with a blank subject. name: search_blank_subject predefined: - 'true' - 'false' description: Find message by specified parameters. name: trustwave-seg-find-quarantine-message outputs: - contextPath: TrustwaveSEG.Message.actionType description: The action type of the message. type: Number - contextPath: TrustwaveSEG.Message.blockNumber description: The block number of the message. type: Number - contextPath: TrustwaveSEG.Message.blockRecipientIndex description: The block recipient index of the message. type: Number - contextPath: TrustwaveSEG.Message.classification description: The classification of the message. type: Number - contextPath: TrustwaveSEG.Message.deleted description: The number of the deleted message. type: Number - contextPath: TrustwaveSEG.Message.description description: The description of the message. type: String - contextPath: TrustwaveSEG.Message.edition description: The edition of the message. type: String - contextPath: TrustwaveSEG.Message.folderId description: The folder ID of the message. type: Number - contextPath: TrustwaveSEG.Message.hasAttachments description: Whether the message has attachments. type: Boolean - contextPath: TrustwaveSEG.Message.messageBody description: The body of the message. type: String - contextPath: TrustwaveSEG.Message.messageName description: The name of the message. type: String - contextPath: TrustwaveSEG.Message.recipient description: The recipient of the message. type: String - contextPath: TrustwaveSEG.Message.sender description: The sender of the message. type: String - contextPath: TrustwaveSEG.Message.serverId description: The server ID of the message. type: Number - contextPath: TrustwaveSEG.Message.sessionNumber description: The session number of the message. type: Number - contextPath: TrustwaveSEG.Message.size description: The size of the message. type: Number - contextPath: TrustwaveSEG.Message.subject description: The subject of the message. type: String - contextPath: TrustwaveSEG.Message.timeArrived description: The time the message arrived. type: Number - contextPath: TrustwaveSEG.Message.timeLogged description: The time the message was logged. type: Number - contextPath: TrustwaveSEG.Message.unicodeSubject description: The unicode subject of the message. type: String - arguments: - description: 'The block number of the message to search for (e.g., 106098471075840). Can be retrieved from the find message endpoint.' name: block_number required: true - description: 'Edition of the message (e.g., "607ef9ae0000"). Can be retrieved from the find message endpoint.' name: edition required: true - description: 'Folder ID of the message (e.g., 1006). Can be retrieved from the find message endpoint.' name: folder_id required: true - description: 'The name of the message (e.g., "B607ef9ac0000"). Can be retrieved from the find message endpoint.' name: message_name required: true - description: 'The recipient of the message (e.g., email@example.com). Can be retrieved from the find message endpoint.' name: recipient required: true - description: 'The server ID of the message (e.g., 1). Can be retrieved from the find message endpoint. ' name: server_id required: true - description: 'The time the message was logged (e.g., 1618934189). Can be retrieved from the find message endpoint. ' name: time_logged required: true - description: 'The message that should be shown with the message on Spiderlabs. (e.g., "This message is spam...").' name: spam_report_message required: true - auto: PREDEFINED description: Whether the message is spam. name: is_spam predefined: - 'true' - 'false' required: true description: Forwards a message to Spiderlabs as spam. name: trustwave-seg-spiderlabs-forward-quarantine-message-as-spam dockerimage: demisto/python3:3.12.13.10116658 runonce: false script: '-' subtype: python3 type: python tests: - TrustwaveSEG-Test fromversion: 5.0.0