Cisco Secure Email Threat Defense

Fetches information about a message after an action has been taken against it using Cisco Secure Email Threat Defense.

Target: HTTP Endpoint for "api.<region>.etd.cisco.com" with a path of "/v1"

Account Key: None (uses a token)

Steps:
[] Build the authorization headers
[] Build the request payload
[] Request the message status
[] Check if the request was successful:
[]> If it was, attempt to extract the results and set the output variable
[]> If it wasn't, output an error

More information about this API: https://developer.cisco.com/docs/message-search-api/#!status-api

 Cisco Secure Email Threat Defense - Get Message Status

prod-nam

prod-eu

prod-apjc

Retrieves an access token for Cisco Secure Email Threat Defense. This token can then be used with other atomics for Email Threat Defense.

Target: HTTP Endpoint for "api.<region>.etd.cisco.com" with a path of "/v1"

Account Key: HTTP Basic Authentication with your client ID as the username and secret as the password

Steps:
[] Build the authorization header
[] Attempt to fetch an access token
[] Check if the request was successful:
[]> If it was, attempt to extract the token and set the output variables
[]> If it wasn't, output an error

More information about this API: https://developer.cisco.com/docs/message-search-api/#!authentication-api

Cisco Secure Email Threat Defense - Get Access Token

Moves messages and/or updates message verdicts in Cisco Secure Email Threat Defense.

Target: HTTP Endpoint for "api.<region>.etd.cisco.com" with a path of "/v1"

Account Key: None (uses a token)

Steps:
[] Check if either a folder or a verdict was provided:
[]> If neither, end the workflow
[] Build the authorization headers
[] Build the request payload
[] Execute the message actions
[] Check if the request was successful:
[]> If it was, attempt to extract the results and set the output variable (if there were any errors in the payload, fail the workflow)
[]> If it wasn't, output an error

More information about this API: https://developer.cisco.com/docs/message-search-api/#!remediation-and-reclassification-api

Cisco Secure Email Threat Defense - Move or Reclassify Messages

Searches for messages processed by Cisco Secure Email Threat Defense.
Note: required admin or super-admin role to generate API Client Credentials.

Target: HTTP Endpoint for "api.<region>.etd.cisco.com" with a path of "/v1"

Account Key: None (uses a token)

Steps:
[] Build the authorization headers
[] Build the request payload
[] Search for messages
[] Check if the request was successful:
[]> If it was, attempt to extract the search results and set the output variables
[]> If it wasn't, output an error

More information about this API: https://developer.cisco.com/docs/message-search-api/#!message-search-api