id: Message Quarantine - Cofense Vision version: -1 name: Message Quarantine - Cofense Vision description: This playbook allows users to quarantine various messages that meet their specified criteria. starttaskid: '0' tasks: '0': id: '0' taskid: 5aacc68c-57fb-4b8e-84b3-40c556926c65 type: start task: id: 5aacc68c-57fb-4b8e-84b3-40c556926c65 version: -1 name: '' iscommand: false brand: '' description: '' nexttasks: '#none#': - '9' separatecontext: false view: |- { "position": { "x": 255, "y": 65 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '1': id: '1' taskid: 9adb0477-3b82-40be-8bbc-516211945a28 type: regular task: id: 9adb0477-3b82-40be-8bbc-516211945a28 version: -1 name: 'Create Message Search' description: Creates a new search. script: Cofense Vision|||cofense-message-search-create type: regular iscommand: true brand: Cofense Vision nexttasks: '#none#': - '2' scriptarguments: attachment_exclude_mime_types: complex: root: inputs.attachment_exclude_mime_types attachment_hash_match_criteria: complex: root: inputs.attachment_hash_match_criteria attachment_hashes: complex: root: 'inputs.attachment_hashes ' attachment_mime_types: complex: root: inputs.attachment_mime_types attachment_names: complex: root: inputs.attachment_names domain_match_criteria: complex: root: inputs.domain_match_criteria domains: complex: root: inputs.domains headers: complex: root: inputs.headers internet_message_id: complex: root: inputs.internet_message_id partial_ingest: complex: root: inputs.partial_ingest received_after_date: complex: root: inputs.received_after_date received_before_date: complex: root: inputs.received_before_date recipient: complex: root: inputs.recipient senders: complex: root: inputs.senders subjects: complex: root: inputs.subjects url: complex: root: inputs.url whitelist_urls: complex: root: inputs.whitelist_urls separatecontext: false view: |- { "position": { "x": 680, "y": 420 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '2': id: '2' taskid: a5b02818-db24-4cad-84cf-97d33b6b8d81 type: regular task: id: a5b02818-db24-4cad-84cf-97d33b6b8d81 version: -1 name: Get Search Results description: Retrieves the results for the search identified by the search ID. script: Cofense Vision|||cofense-message-search-results-get type: regular iscommand: true brand: Cofense Vision nexttasks: '#none#': - '10' scriptarguments: id: complex: root: Cofense.Search accessor: id size: complex: root: inputs.message_size separatecontext: false view: |- { "position": { "x": 680, "y": 620 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '4': id: '4' taskid: 3efd7f76-5bc2-4726-8799-cd29b9c400c8 type: condition task: id: 3efd7f76-5bc2-4726-8799-cd29b9c400c8 version: -1 name: Do you want to Get Message content? description: Check if user want to get message metadata. type: condition iscommand: false brand: '' nexttasks: '#default#': - '12' Yes: - '5' separatecontext: false view: |- { "position": { "x": 1290, "y": 1210 } } note: false timertriggers: [] ignoreworker: false message: to: subject: body: simple: Do you want to Get Message content or Quarantine messages? methods: [] format: '' bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 replyOptions: - Yes skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '5': id: '5' taskid: 0781e626-3dfd-4ee5-8ca3-e2c3507e9090 type: regular task: id: 0781e626-3dfd-4ee5-8ca3-e2c3507e9090 version: -1 name: Get Message Metadata description: Retrieves the full content of a message that matches the specified Internet message ID and recipient email address of an email. script: Cofense Vision|||cofense-message-metadata-get type: regular iscommand: true brand: Cofense Vision nexttasks: '#none#': - '12' scriptarguments: internet_message_id: complex: root: Cofense accessor: SearchedMessages transformers: - operator: Cut args: delimiter: value: simple: ':' fields: value: simple: '1' recipient_address: complex: root: Cofense accessor: SearchedMessages transformers: - operator: Cut args: delimiter: value: simple: ':' fields: value: simple: '2' separatecontext: false view: |- { "position": { "x": 980, "y": 1410 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '6': id: '6' taskid: a3c6d609-ad79-4162-8a04-c264a8c82309 type: regular task: id: a3c6d609-ad79-4162-8a04-c264a8c82309 version: -1 name: Quarantine Messages description: Creates a new quarantine job. script: '|||cofense-quarantine-job-create' type: regular iscommand: true brand: '' nexttasks: '#none#': - '7' scriptarguments: quarantine_emails: complex: root: Cofense accessor: SearchedMessages transformers: - operator: join args: separator: value: simple: ',' separatecontext: false view: |- { "position": { "x": 1290, "y": 1900 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '7': id: '7' taskid: 8b3d6f53-45fc-4300-87cf-fe576364e084 type: title task: id: 8b3d6f53-45fc-4300-87cf-fe576364e084 version: -1 name: Done type: title iscommand: false brand: '' description: '' separatecontext: false view: |- { "position": { "x": 255, "y": 2180 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '9': id: '9' taskid: 038d66d8-e823-443d-82e5-3bcbf3ca668c type: condition task: id: 038d66d8-e823-443d-82e5-3bcbf3ca668c version: -1 name: Is Cofense Vision Integration Enable? description: Condition to check if Cofense Vision Integration is enabled or not. type: condition iscommand: false brand: '' nexttasks: '#default#': - '7' yes: - '1' separatecontext: false conditions: - label: yes condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: Cofense Vision - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active accessor: brand iscontext: true view: |- { "position": { "x": 255, "y": 225 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '10': id: '10' taskid: eb9cb88e-f596-46da-8245-ddce5ace803d type: regular task: id: eb9cb88e-f596-46da-8245-ddce5ace803d version: -1 name: Set Internet Message ID and Recipient Address description: 'Set a value in context for internetMessageId and recipient.address fields in a following format: ```internet_message_id:recipient_address``` ' scriptName: SetAndHandleEmpty type: regular iscommand: false brand: '' nexttasks: '#none#': - '11' scriptarguments: key: simple: Cofense.SearchedMessages value: complex: root: Cofense filters: - - operator: isExists left: value: simple: Cofense.Search.Message iscontext: true accessor: SearchedMessages transformers: - operator: GetMessageIdAndRecipients args: key: value: simple: Cofense.Search.Message iscontext: true separatecontext: false view: |- { "position": { "x": 680, "y": 810 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '11': id: '11' taskid: 2aca9691-9194-466e-8b42-a7685f3e2c0f type: condition task: id: 2aca9691-9194-466e-8b42-a7685f3e2c0f version: -1 name: Is message found? description: Check if results have messages or not. type: condition iscommand: false brand: '' nexttasks: '#default#': - '7' yes: - '4' separatecontext: false conditions: - label: yes condition: - - operator: isNotEmpty left: value: simple: Cofense.SearchedMessages iscontext: true view: |- { "position": { "x": 680, "y": 985 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '12': id: '12' taskid: 9d2a8e74-24a2-4cdf-8223-4d90e5e00acf type: condition task: id: 9d2a8e74-24a2-4cdf-8223-4d90e5e00acf version: -1 name: Do you want to Quarantine Messages? description: Condition for user to get quarantine message or not. type: condition iscommand: false brand: '' nexttasks: '#default#': - '7' Yes: - '6' separatecontext: false view: |- { "position": { "x": 1290, "y": 1620 } } note: false timertriggers: [] ignoreworker: false message: to: subject: body: simple: Do you want to Get Message content or Quarantine messages? methods: [] format: '' bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 replyOptions: - Yes skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "11_7_#default#": 0.26, "12_6_Yes": 0.64, "12_7_#default#": 0.35, "4_12_#default#": 0.47, "9_7_#default#": 0.1 }, "paper": { "dimensions": { "height": 2180, "width": 1415, "x": 255, "y": 65 } } } inputs: - key: subjects value: {} required: false description: |- A comma-separated string of subjects to create a search for an email's subject. It supports the use of one or more wildcard characters (*) in any position of a subject. Note: The search can only have a maximum of 3 values. playbookInputQuery: - key: senders value: {} required: false description: |- A comma-separated string of senders to create a search for an email's sender. It supports the use of one or more wildcard characters (*) in any position of a sender's email address. Note: The search can only have a maximum of 3 values. playbookInputQuery: - key: attachment_names value: {} required: false description: |- A comma-separated string of attachment names to create a search for an email's attachments. It supports the use of one or more wildcard characters (*) in any position of an attachment name. Note: The search can only have a maximum of 3 values. playbookInputQuery: - key: attachment_hash_match_criteria value: simple: ANY required: false description: |- The type of matching performed on the hashes specified in the attachment_hashes argument. Possible values are: ALL: Emails must include all listed attachment hashes. ANY: Emails must contain at least one of the listed attachment hash. playbookInputQuery: - key: 'attachment_hashes ' value: {} required: false description: |- A comma-separated string of attachment hashes to create a search for an email's attachment hashes. Supported format: hashtype1:hashvalue1, hashtype2:hashvalue2 Possible values for hashtype are: MD5, SHA256 Example: md5:938c2cc0dcc05f2b68c4287040cfcf71 Note: The search can only have a maximum of 3 values. playbookInputQuery: - key: attachment_mime_types value: {} required: false description: |- A comma-separated string of MIME types to create a search for an email's attachment MIME type. Note: The search can only have a maximum of 3 values. playbookInputQuery: - key: attachment_exclude_mime_types value: {} required: false description: |- A comma-separated string of MIME types to create a search for excluding an email's attachment MIME type. Note: The search can only have a maximum of 3 values. playbookInputQuery: - key: domain_match_criteria value: simple: ANY required: false description: |- The type of matching to perform on the domains specified in the domains argument. Possible values are: ALL: Emails must include all listed domains. ANY: Emails must contain at least one of the listed domains. playbookInputQuery: - key: domains value: {} required: false description: |- A comma-separated string of domains to create a search for domains in an email's body or its attachment. You can change the type of matching that happens on the specified domains using the domain_match_criteria argument. Note: The search can only have a maximum of 3 values. playbookInputQuery: - key: whitelist_urls value: {} required: false description: |- A comma-separated string of URLs to be whitelisted. Note: The search can only have a maximum of 3 values. playbookInputQuery: - key: headers value: {} required: false description: "A comma-separated string of key-value pairs, defining the additional criteria to search for in the email header. \n\nSupported format: key1:value1, key2:value1:value2:value3\n\nExample: Content-Type:application/json\n\nList of available headers to create a search can be retrieved by using the command 'cofense-searchable-headers-list'.\n\nNote: The search can only have a maximum of 3 values." playbookInputQuery: - key: internet_message_id value: {} required: false description: |- The unique identifier of the email, enclosed in angle brackets. This argument is case-sensitive. Example: <513C8CD8-E593-4DC4-82BF6202E8AC95CB@example.com> playbookInputQuery: - key: partial_ingest value: simple: 'False' required: false description: Whether to create a search with partially ingested emails (true) or not with partially ingested emails (false). playbookInputQuery: - key: received_after_date value: {} required: false description: |- Date and time to create a search for emails to specify the received on or after the specified UTC date and time. Supported formats: N minutes, N hours, N days, N weeks, N months, N years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ Example: 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z playbookInputQuery: - key: received_before_date value: {} required: false description: |- Date and time to create a search for emails to specify the received before or on the specified UTC date and time. Supported formats: N minutes, N hours, N days, N weeks, N months, N years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ Example: 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z playbookInputQuery: - key: recipient value: {} required: false description: Create a search with the specified recipient. Supports one or more wildcard characters (*) in any position of a recipient's email address. playbookInputQuery: - key: url value: {} required: false description: Create a search with the specified url. Supports one or more wildcard characters (*) in any position of the URL. playbookInputQuery: - key: message_size value: simple: '50' required: false description: |- The number of results to retrieve per page. The value must be a positive integer up to 2000. Default value is '50' playbookInputQuery: outputs: - contextPath: Cofense.Search.Message.id description: The ID of the message. - contextPath: Cofense.Search.Message.subject description: The subject of the message. - contextPath: Cofense.Search.Message.receivedOn description: The date and time when the message was received by the recipient. - contextPath: Cofense.Search.Message.sentOn description: The date and time when the message was sent by the sender. - contextPath: Cofense.Search.Message.md5 description: The MD5 hash of the message. - contextPath: Cofense.Search.Message.internetMessageId description: Unique identifier of the email. - contextPath: Cofense.Search.Message.from.address description: The email address of the sender. - contextPath: Cofense.Search.Message.headers.value description: The value of the header key. - contextPath: Cofense.Search.Message.headers.name description: The name of the header key. - contextPath: Cofense.Search.Message.recipients.address description: The email address of the recipient. - contextPath: Cofense.Search.Message.attachments.filename description: The name of the attachment file. - contextPath: Cofense.Search.Message.attachments.md5 description: The MD5 hash of the attachment. - contextPath: Cofense.Search.Message.attachments.id description: The ID of the attachment. - contextPath: Cofense.Message.id description: ID of the message in cofense vision. - contextPath: Cofense.Message.subject description: Subject of the email. - contextPath: Cofense.Message.receivedOn description: Date and time an email was received by the recipient. - contextPath: Cofense.Message.sentOn description: Date and time an email was sent to the recipient. - contextPath: Cofense.Message.md5 description: MD5 hash of the message. - contextPath: Cofense.Message.internetMessageId description: ID of an email assigned by the message transfer agent. - contextPath: Cofense.Message.matchingIOCs description: MD5 hash of one or more matching IOCs. - contextPath: Cofense.Message.matchingSources description: One or more matching IOC sources. - contextPath: Cofense.Message.from.address description: An email address of the sender. - contextPath: Cofense.Message.headers.name description: The name of the key in the header. - contextPath: Cofense.Message.headers.value description: The value of the key in the header. - contextPath: Cofense.Message.recipients.address description: Email address of the recipient. - contextPath: Cofense.Message.attachments.filename description: The name of the attachment file. - contextPath: Cofense.Message.attachments.md5 description: The MD5 hash of the attachment. - contextPath: Cofense.Message.attachments.id description: The ID of the attachment. - contextPath: Cofense.QuarantineJob.id description: ID of the quarantine job in cofense vision. - contextPath: Cofense.QuarantineJob.emailCount description: Number of emails quarantined. - contextPath: Cofense.QuarantineJob.matchingIOCs description: MD5 hash of one or more matching IOCs. - contextPath: Cofense.QuarantineJob.matchingSources description: One or more IOC sources. - contextPath: Cofense.QuarantineJob.quarantineEmails.id description: ID in cofense vision. - contextPath: Cofense.QuarantineJob.quarantineEmails.internetMessageID description: ID of the email assigned by the message transfer agent. - contextPath: Cofense.QuarantineJob.quarantineEmails.recipientAddress description: Email address of the account containing the emails to be quarantined. - contextPath: Cofense.QuarantineJob.quarantineEmails.status description: Status of the email. - contextPath: Cofense.QuarantineJob.quarantineJobRuns.id description: ID of the quarantine job in Cofense Vision. - contextPath: Cofense.QuarantineJob.quarantineJobRuns.status description: Status of the quarantine job. - contextPath: Cofense.QuarantineJob.quarantineJobRuns.total description: Total number of emails in the quarantine job. - contextPath: Cofense.Search.Message.from.id description: The ID of the sender. - contextPath: Cofense.Search.Message.headers.id description: The ID of the header. - contextPath: Cofense.QuarantineJob.matchingIocInfo.id description: MD5 hash composed of the UTF-8 concatenation of "threat_type" and "threat_value" attributes. - contextPath: Cofense.QuarantineJob.matchingIocInfo.attributes.threat_type description: Threat type of the IOC match. - contextPath: Cofense.QuarantineJob.matchingIocInfo.attributes.threat_value description: Actual value of the IOC match in the email. - contextPath: Cofense.QuarantineJob.matchingIocInfo.metadata.source description: Data that the IOC source reads and writes. tests: - CofenseVision-Test fromversion: 6.2.0