FireEye EX

Integration version: 10.0

Important: FireEye and McAfee Enterprise merged and became Trellix. FireEye EX was renamed to Trellix Email Security - Server Edition.

Product Use Cases

1. Ingest Trellix Email Security - Server Edition alerts to use them to create Google Security Operations SOAR alerts. Next, in Google Security Operations SOAR, alerts can be used to perform orchestrations with playbooks or manual analysis.
2. Perform enrichment actions - get data from Trellix Email Security - Server Edition to enrich data in Google Security Operations SOAR Alerts.
3. Perform active actions - release/delete email using Trellix Email Security - Server Edition agent from Google Security Operations SOAR.

Configure FireEye EX integration in Google Security Operations SOAR

For detailed instructions on how to configure an integration in Google Security Operations SOAR, see Configure integrations.

Integration parameters

Use the following parameters to configure the integration:

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Instance Name	String	N/A	No	Name of the Instance you intend to configure integration for.
Description	String	N/A	No	Description of the Instance.
API Root	String	https://<address>:\<port>	Yes	API root of Trellix Email Security - Server Edition server.
Username	String	N/A	Yes	Username of the Trellix Email Security - Server Edition account.
Password	Password	N/A	Yes	The password of the Trellix Email Security - Server Edition account.
Verify SSL	Checkbox	Checked	Yes	If enabled, verifies that the SSL certificate for the connection to the Trellix Email Security - Server Edition server is valid.
Run Remotely	Checkbox	Unchecked	No	Check the field in order to run the configured integration remotely. Once checked, the option appears to select the remote user (agent).

Note: You can make changes at a later stage if needed. Once configured, the Instances can be used in Playbooks. For detailed information on configuring and supporting multiple instances, please see Supporting multiple instances.

Actions

Ping

Description

Test connectivity to the Trellix Email Security - Server Edition with parameters provided at the integration configuration page in the Google Security Operations Marketplace tab.

Parameters

N/A

Run On

The action doesn't run on entities, nor has mandatory input parameters.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

List Quarantined Emails

Description

List quarantined emails.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Start Time	String	N/A	No	If specified, only emails that were created after start time will be returned. If Start Time and End Time are not specified, action returns quarantined emails from the last 24 hours. Format: YYYY-MM-DD'T'HH:MM:SS.SSS-HHMM
End Time	String	N/A	No	If specified, only emails that were created before end time will be returned. If Start Time and End Time are not specified, action returns quarantined emails from the last 24 hours. Format: YYYY-MM-DD'T'HH:MM:SS.SSS-HHMM
Sender Filter	String	N/A	No	If specified, returns all of the quarantined emails only from this sender.
Subject Filter	String	N/A	No	If specified, returns all of the quarantined emails only with this subject.
Max Email to Return	String	N/A	No	Specify how many emails to return. Limit is 10000. This is Trellix Email Security - Server Edition limitation.

Run On

The action doesn't run on entities, nor has mandatory input parameters.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

JSON Result

[
    {
        "completed_at": "2020-06-09T08:21:17",
        "email_uuid": "9de3a94f-5ef6-46c7-b6d3-7d4f8c964925",
        "quarantine_path": "/data/email-analysis/quarantine2/2020-06-09/08/49h33n3HZczxNgc",
        "subject": "qwe",
        "message_id": "[e-mail]",
        "from": "[e-mail]",
        "queue_id": "49h33n3HZczxNgc"
    },
    {
        "completed_at": "2020-06-09T08:21:42",
        "email_uuid": "58800022-51f7-4b07-b6b1-c5d88434283f",
        "quarantine_path": "/data/email-analysis/quarantine2/2020-06-09/08/49h34G5TVczxNgg",
        "subject": "rew",
        "message_id": "[e-mail]",
        "from": "[e-mail]",
        "queue_id": "49h34G5TVczxNgg"
    }
]

Release Quarantined Email

Description

Releases quarantined email.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Queue ID	String	N/A	Yes	Specify the queue id of the email that needs to be released.

Run On

The action doesn't run on entities, nor has mandatory input parameters.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

Delete Quarantined Email

Description

Delete the quarantined email.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Queue ID	String	N/A	Yes	Specify the queue id of the email that needs to be deleted.

Run On

The action doesn't run on entities, nor has mandatory input parameters.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

Download Quarantined Email

Description

Download quarantined email.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Queue ID	String	N/A	Yes	Specify the queue id of the email that needs to be downloaded.
Download Path	String	N/A	No	Specify where the action should save the files. If nothing is specified, action will not save the file on the disk.

Run On

The action doesn't run on entities, nor has mandatory input parameters.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

Download Alert Artifacts

Description

Download alert artifacts.

Parameters

Parameter Display Name	Type	Default Value	Is mandatory	Description
Alert UUID	String	N/A	Yes	Specify the alert UUID from where we need to download artifacts.
Download Path	String	N/A	No	Specify where the action should save the files. If nothing is specified, action will not save the file on the disk.

Run On

The action doesn't run on entities, nor has mandatory input parameters.

Action Results

Script Result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

Connectors

FireEye EX - Alerts Connector

Configure FireEye EX - Alerts Connector in Google Security Operations SOAR

For detailed instructions on how to configure a connector in Google Security Operations SOAR, see Configuring the connector.

Connector parameters

Use the following parameters to configure the connector:

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Product Field Name	String	Product Name	Yes	Enter the source field name in order to retrieve the Product Field name.
Event Field Name	String	eventType	Yes	Enter the source field name in order to retrieve the Event Field name.
Environment Field Name	String	""	No	Describes the name of the field where the environment name is stored. If the environment field isn't found, the environment is the default environment.
Environment Regex Pattern	String	.*	No	A regex pattern to run on the value found in the "Environment Field Name" field. Default is .* to catch all and return the value unchanged. Used to allow the user to manipulate the environment field via regex logic. If the regex pattern is null or empty, or the environment value is null, the final environment result is the default environment.
Script Timeout (Seconds)	Integer	180	Yes	Timeout limit for the python process running the current script.
API Root	String	https://x.x.x.x:x	Yes	API root of Trellix Email Security - Server Edition server.
Username	String	N/A	Yes	Username of the Trellix Email Security - Server Edition account.
Password	Password		Yes	Password of the Trellix Email Security - Server Edition account.
Fetch Max Hours Backwards	Integer	1	No	Amount of hours from where to fetch alerts. Max supported value is 48. This is the Trellix Email Security - Server Edition limitation.
Verify SSL	Checkbox	Checked	Yes	If enabled, verify the SSL certificate for the connection to the SonicWall server is valid.
Proxy Server Address	String		No	The address of the proxy server to use.
Proxy Username	String		No	The proxy username to authenticate with.
Proxy Password	Password		No	The proxy password to authenticate with.

Connector Rules

Proxy Support

The connector supports proxy.