CiscoEmailSecurityApplianceIronPortV2.yml

commonfields:
  id: CiscoESA
  version: -1
name: CiscoESA
display: Cisco ESA
category: Network Security
description: The Cisco Email Security Appliance is an email security gateway product. It is designed to detect and block a wide variety of email-born threats, such as malware, spam and phishing attempts.
configuration:
- name: base_url
  display: Server URL
  required: true
  type: 0
  additionalinfo: Base URL, e.g., https://XXX.eu.iphmx.com
- name: credentials
  display: Username
  required: true
  type: 9
  additionalinfo: ""
  displaypassword: Password
- name: max_fetch
  display: Maximum incidents per fetch
  defaultvalue: 50
  type: 0
  additionalinfo: Default is 50. Maximum is 100.
  required: false
- name: first_fetch
  display: First fetch timestamp
  defaultvalue: 7 days
  type: 0
  additionalinfo: |-
    Timestamp in ISO format or <number> <time unit>,
    e.g., 2022-01-01T00:00:00.000Z, 12 hours, 7 days, 3 months, now.
  required: false
- name: filter_by
  display: Filter by
  type: 15
  additionalinfo: The message field by which to fetch results.
  options:
  - from_address
  - to_address
  - subject
  required: false
- name: filter_operator
  display: Filter operator
  type: 15
  additionalinfo: The message field operator by which to fetch results.
  options:
  - contains
  - is
  - begins_with
  - ends_with
  - does_not_contain
  required: false
- name: filter_value
  display: Filter value
  type: 0
  additionalinfo: The message filter value by which to fetch results.
  required: false
- name: recipient_filter_operator
  display: Recipient filter operator
  type: 15
  additionalinfo: The message recipient filter operator by which to fetch results.
  options:
  - contains
  - is
  - begins_with
  - ends_with
  - does_not_contain
  required: false
- name: recipient_filter_value
  display: Recipient filter value
  type: 0
  additionalinfo: The message recipient filter value by which to fetch results.
  required: false
- name: jwt_token_expiration_period
  display: Time to live for JWT session token (in minutes).
  defaultvalue: 30
  type: 0
  required: false
- name: proxy
  display: Use system proxy settings
  defaultvalue: "false"
  type: 8
  additionalinfo:
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  defaultvalue: "false"
  additionalinfo:
  required: false
- display: Incident type
  name: incidentType
  type: 13
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
script:
  script: ""
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.10.12.68714
  isfetch: true
  commands:
  - name: cisco-esa-spam-quarantine-message-search
    description: Search messages in the spam quarantine.
    arguments:
    - name: start_date
      description: |-
        Start date in ISO format or <number> <time unit>,
        e.g., 2022-01-01T00:00:00.000Z, 12 hours, 7 days, 3 months, now.
      required: true
    - name: end_date
      description: |-
        End date in ISO format or <number> <time unit>,
        e.g., 2022-01-01T00:00:00.000Z, 12 hours, 7 days, 3 months, now.
      required: true
    - name: filter_by
      description: The message field by which to filter the results.
      auto: PREDEFINED
      predefined:
      - from_address
      - to_address
      - subject
    - name: filter_operator
      description: Filter operator by which to filter the results.
      auto: PREDEFINED
      predefined:
      - contains
      - is
      - begins_with
      - ends_with
      - does_not_contain
    - name: filter_value
      description: The value to search for. This is a user defined value. D.g., filterValue=abc.com.
    - name: recipient_filter_operator
      description: Recipient operator filter by which to filter the results.
      auto: PREDEFINED
      predefined:
      - contains
      - is
      - begins_with
      - ends_with
      - does_not_contain
    - name: recipient_filter_value
      description: Recipient filter by which to filter the results.
    - name: order_by
      description: The attribute by which to order the data in the response.
      auto: PREDEFINED
      predefined:
      - from_address
      - date
      - subject
      - size
    - name: order_dir
      description: Results order direction.
      auto: PREDEFINED
      predefined:
      - asc
      - desc
    - name: page
      description: |-
        Page number of paginated results.
        Minimum value: 1.
    - name: page_size
      description: Number of results per page. Maximum value 100.
    - name: limit
      defaultValue: 50
      description: The maximum number of records to retrieve.
    outputs:
    - contextPath: CiscoESA.SpamQuarantineMessage.envelopeRecipient
      description: Recipient email address.
      type: String
    - contextPath: CiscoESA.SpamQuarantineMessage.toAddress
      description: Recipient email address.
      type: String
    - contextPath: CiscoESA.SpamQuarantineMessage.subject
      description: Email subject.
      type: String
    - contextPath: CiscoESA.SpamQuarantineMessage.date
      description: Email due date.
      type: String
    - contextPath: CiscoESA.SpamQuarantineMessage.fromAddress
      description: Sender email address.
      type: String
    - contextPath: CiscoESA.SpamQuarantineMessage.size
      description: email size.
      type: String
    - contextPath: CiscoESA.SpamQuarantineMessage.mid
      description: Message ID.
      type: Number
  - name: cisco-esa-spam-quarantine-message-get
    description: Get spam quarantine message details.
    arguments:
    - name: message_id
      description: Message ID.
      required: true
    outputs:
    - type: String
      contextPath: CiscoESA.SpamQuarantineMessage.envelopeRecipient
      description: Message recipient.
    - type: String
      contextPath: CiscoESA.SpamQuarantineMessage.toAddress
      description: Message recipient.
    - type: String
      contextPath: CiscoESA.SpamQuarantineMessage.messageBody
      description: Message body.
    - type: String
      contextPath: CiscoESA.SpamQuarantineMessage.date
      description: Message date.
    - type: String
      contextPath: CiscoESA.SpamQuarantineMessage.fromAddress
      description: Message sender.
    - type: String
      contextPath: CiscoESA.SpamQuarantineMessage.subject
      description: Message subject.
    - type: Number
      contextPath: CiscoESA.SpamQuarantineMessage.mid
      description: Message ID.
  - name: cisco-esa-spam-quarantine-message-release
    description: Release quarantine emails.
    arguments:
    - name: message_ids
      description: A comma-separated list of message IDs.
      required: true
      isArray: true
    outputs: []
  - name: cisco-esa-spam-quarantine-message-delete
    description: Delete quarantine emails.
    arguments:
    - name: message_ids
      description: A comma-separated list of message IDs to delete.
      required: true
      isArray: true
    outputs: []
  - name: cisco-esa-list-entry-get
    description: Get spam quarantine blocklist/safelist entry.
    arguments:
    - name: entry_type
      description: List entry type.
      required: true
      auto: PREDEFINED
      predefined:
      - blocklist
      - safelist
    - name: page
      description: |-
        Page number of paginated results.
        Minimum value: 1.
    - name: page_size
      description: Number of results per page. Maximum value 100.
    - name: limit
      defaultValue: 50
      description: The maximum number of records to retrieve.
    - name: order_by
      description: The attribute by which to order the data in the response.
      auto: PREDEFINED
      predefined:
      - recipient
      - sender
    - name: order_dir
      description: Results order direction.
      auto: PREDEFINED
      predefined:
      - asc
      - desc
    - name: view_by
      description: View results by.
      defaultValue: recipient
      auto: PREDEFINED
      predefined:
      - recipient
      - sender
    - name: search
      description: |-
        Search for recipients or senders in blocklist/safelist with 'contains' operator.
        e.g., test@test.com, test.com
        This is only supported for the argument view_by=recipient.
    outputs:
    - type: String
      contextPath: CiscoESA.ListEntry.Blocklist.senderList
      description: Block list sender list.
    - type: String
      contextPath: CiscoESA.ListEntry.Blocklist.recipientAddress
      description: Block list recipient address.
    - type: String
      contextPath: CiscoESA.ListEntry.Blocklist.recipientList
      description: Block list recipient list.
    - type: String
      contextPath: CiscoESA.ListEntry.Blocklist.senderAddress
      description: Block list sender address.
    - type: String
      contextPath: CiscoESA.ListEntry.Safelist.senderList
      description: Safe list sender list.
    - type: String
      contextPath: CiscoESA.ListEntry.Safelist.recipientAddress
      description: Safe list recipient address.
    - type: String
      contextPath: CiscoESA.ListEntry.Safelist.recipientList
      description: Safe list recipient list.
    - type: String
      contextPath: CiscoESA.ListEntry.Safelist.senderAddress
      description: Safe list sender address.
  - name: cisco-esa-list-entry-add
    description: Add spam quarantine blocklist/safelist entry.
    arguments:
    - name: entry_type
      description: List entry type.
      required: true
      auto: PREDEFINED
      predefined:
      - blocklist
      - safelist
    - name: view_by
      description: |-
        Add list entry by recipient/sender.
        When view_by = recipient, recipient_addresses and sender_list are mandatory.
        When view_by = sender, sender_addresses and recipient_list are mandatory.
      defaultValue: recipient
      auto: PREDEFINED
      predefined:
      - recipient
      - sender
    - name: recipient_addresses
      description: A comma-separated list of recipient addresses to add.
      isArray: true
    - name: sender_list
      description: A comma-separated list of senders to add.
      isArray: true
    - name: sender_addresses
      description: A comma-separated list of sender addresses to add.
      isArray: true
    - name: recipient_list
      description: A comma-separated list of recipients to add.
      isArray: true
    outputs: []
  - name: cisco-esa-list-entry-append
    description: Append spam quarantine blocklist/safelist entry.
    arguments:
    - name: entry_type
      description: List entry type.
      required: true
      auto: PREDEFINED
      predefined:
      - blocklist
      - safelist
    - name: view_by
      description: |-
        Append list entry by recipient/sender.
        When view_by = recipient, recipient_addresses and sender_list are mandatory.
        When view_by = sender, sender_addresses and recipient_list are mandatory.
      defaultValue: recipient
      auto: PREDEFINED
      predefined:
      - recipient
      - sender
    - name: recipient_list
      description: A comma-separated list of recipients to append.
      isArray: true
    - name: sender_list
      description: A comma-separated list of senders to append.
    - name: recipient_addresses
      description: A comma-separated list of recipient addresses to append.
    - name: sender_addresses
      description: A comma-separated list of sender addresses to append.
    outputs: []
  - name: cisco-esa-list-entry-edit
    description: Edit spam quarantine blocklist/safelist entry. Using this command will override the existing value.
    arguments:
    - name: entry_type
      description: List entry type.
      required: true
      auto: PREDEFINED
      predefined:
      - blocklist
      - safelist
    - name: view_by
      description: |-
        Edit list entry by recipient/sender.
        When view_by = recipient, recipient_addresses and sender_list are mandatory.
        When view_by = sender, sender_addresses and recipient_list are mandatory.
      defaultValue: recipient
      auto: PREDEFINED
      predefined:
      - recipient
      - sender
    - name: recipient_list
      description: A comma-separated list of recipients to edit.
      isArray: true
    - name: sender_list
      description: A comma-separated list of senders to edit.
    - name: recipient_addresses
      description: A comma-separated list of recipient addresses to edit.
    - name: sender_addresses
      description: A comma-separated list of sender addresses to edit.
    outputs: []
  - name: cisco-esa-list-entry-delete
    description: Delete spam quarantine blocklist/safelist entry.
    arguments:
    - name: entry_type
      description: List entry type.
      required: true
      auto: PREDEFINED
      predefined:
      - blocklist
      - safelist
    - name: view_by
      description: |-
        Delete list entry by recipient/sender.
        When view_by = recipient, recipient_list is mandatory.
        When view_by = sender, sender_list is mandatory.
      defaultValue: recipient
      auto: PREDEFINED
      predefined:
      - recipient
      - sender
    - name: recipient_list
      description: List of recipient/sender addresses to delete.
      isArray: true
    - name: sender_list
      description: List of recipient/sender addresses to delete.
      isArray: true
    outputs: []
  - name: cisco-esa-message-search
    description: Search tracking messages.
    arguments:
    - name: start_date
      description: |-
        Start date in ISO format or <number> <time unit>,
        e.g., 2022-01-01T00:00:00.000Z, 12 hours, 7 days, 3 months, now.
      required: true
    - name: end_date
      description: |-
        End date in ISO format or <number> <time unit>,
        e.g., 2022-01-01T00:00:00.000Z, 12 hours, 7 days, 3 months, now.
      required: true
    - name: page
      description: |-
        Page number of paginated results.
        Minimum value: 1.
    - name: page_size
      description: Number of results per page. Maximum value 100.
    - name: limit
      defaultValue: 50
      description: The maximum number of records to retrieve.
    - name: sender_filter_operator
      description: Sender filter operator.
      auto: PREDEFINED
      predefined:
      - contains
      - is
      - begins_with
    - name: sender_filter_value
      description: Sender filter value.
    - name: recipient_filter_operator
      description: Recipient filter operator.
      auto: PREDEFINED
      predefined:
      - contains
      - is
      - begins_with
    - name: recipient_filter_value
      description: Recipient filter value.
    - name: subject_filter_operator
      description: Subject filter operator.
      auto: PREDEFINED
      predefined:
      - contains
      - is
      - begins_with
    - name: subject_filter_value
      description: Subject filter value.
    - name: attachment_name_operator
      description: Attachment name operator.
      auto: PREDEFINED
      predefined:
      - contains
      - is
      - begins_with
    - name: attachment_name_value
      description: Attachment name value.
    - name: file_sha_256
      description: |-
        SHA256 must be 64 characters long and can contain only "0-9" and "a-f" characters.
        e.g. e0d123e5f316bef78bfdf5a008837577e0d123e5f316bef78bfdf5a008837577
    - name: custom_query
      description: |-
        Custom query for cisco ESA's advanced filters.
        Syntax: <key>=<value>;<key>=<value>;<key>=<value>
        e.g., graymail=True;message_delivered=True
    outputs:
    - type: String
      contextPath: CiscoESA.Message.hostName
      description: Email gateway hostname.
    - type: String
      contextPath: CiscoESA.Message.friendly_from
      description: Friendly formatted sender email address.
    - type: String
      contextPath: CiscoESA.Message.isCompleteData
      description: Whether the entire data was pulled.
    - type: String
      contextPath: CiscoESA.Message.messageStatus
      description: Message delivery status.
    - type: String
      contextPath: CiscoESA.Message.recipientMap
      description: Recipients list.
    - type: String
      contextPath: CiscoESA.Message.senderIp
      description: Sender IP address.
    - type: String
      contextPath: CiscoESA.Message.mailPolicy
      description: Matched mail policy.
    - type: String
      contextPath: CiscoESA.Message.senderGroup
      description: Matched sender group.
    - type: String
      contextPath: CiscoESA.Message.subject
      description: Subject of email message.
    - type: Number
      contextPath: CiscoESA.Message.mid
      description: Message ID.
    - type: String
      contextPath: CiscoESA.Message.senderDomain
      description: Domain of email message sender.
    - type: String
      contextPath: CiscoESA.Message.finalSubject
      description: Extended email subject.
    - type: String
      contextPath: CiscoESA.Message.direction
      description: Message direction, incoming or outgoing.
    - type: Number
      contextPath: CiscoESA.Message.icid
      description: An Injection Connection ID (ICID). A numerical identifier for an individual SMTP connection to the system.
    - type: String
      contextPath: CiscoESA.Message.replyTo
      description: Email message reply to.
    - type: String
      contextPath: CiscoESA.Message.timestamp
      description: Time of the email message.
    - type: String
      contextPath: CiscoESA.Message.messageID
      description: Extended message ID.
    - type: String
      contextPath: CiscoESA.Message.verdictChart
      description: Verdict visual chart ID.
    - type: String
      contextPath: CiscoESA.Message.recipient
      description: Recipients email addresses list.
    - type: String
      contextPath: CiscoESA.Message.sender
      description: Sender email address.
    - type: String
      contextPath: CiscoESA.Message.serialNumber
      description: Cisco ESA email gateway serial number.
    - type: Number
      contextPath: CiscoESA.Message.allIcid
      description: ICIDs list.
    - type: String
      contextPath: CiscoESA.Message.sbrs
      description: Sender Base Reputation Scores.
  - name: cisco-esa-message-details-get
    description: Get message details.
    arguments:
    - name: serial_number
      description: Email gateway serial number.
      required: true
    - name: message_ids
      description: Message ID list.
      required: true
      isArray: true
    - name: injection_connection_id
      description: Injection connection ID.
    outputs:
    - type: String
      contextPath: CiscoESA.Message.sdrAge
      description: Sender domain reputation age.
    - type: String
      contextPath: CiscoESA.Message.attachments
      description: Message attachments.
    - type: String
      contextPath: CiscoESA.Message.hostName
      description: Email gateway hostname.
    - type: Boolean
      contextPath: CiscoESA.Message.isCompleteData
      description: Whether the entire data was pulled.
    - type: String
      contextPath: CiscoESA.Message.messageStatus
      description: Message delivery status.
    - type: String
      contextPath: CiscoESA.Message.mailPolicy
      description: Matched mail policy.
    - type: String
      contextPath: CiscoESA.Message.senderGroup
      description: Matched sender group.
    - type: String
      contextPath: CiscoESA.Message.subject
      description: Subject of email message.
    - type: Boolean
      contextPath: CiscoESA.Message.showSummaryTimeBox
      description: Whether to display the summary timebox.
    - type: String
      contextPath: CiscoESA.Message.sdrCategory
      description: Sender domain reputation category.
    - type: Number
      contextPath: CiscoESA.Message.mid
      description: Message ID.
    - type: String
      contextPath: CiscoESA.Message.sendingHostSummary.reverseDnsHostname
      description: Sending host reverse DNS hostname.
    - type: String
      contextPath: CiscoESA.Message.sendingHostSummary.ipAddress
      description: Sending host IP address.
    - type: String
      contextPath: CiscoESA.Message.sendingHostSummary.sbrsScore
      description: Sending host sender base reputation scores.
    - type: String
      contextPath: CiscoESA.Message.direction
      description: Message direction, incoming or outgoing.
    - type: String
      contextPath: CiscoESA.Message.smtpAuthId
      description: SMTP authorization ID.
    - type: String
      contextPath: CiscoESA.Message.midHeader
      description: Message ID header.
    - type: String
      contextPath: CiscoESA.Message.timestamp
      description: Email message time.
    - type: Boolean
      contextPath: CiscoESA.Message.showDLP
      description: Whether the DLP report is available.
    - type: String
      contextPath: CiscoESA.Message.messageSize
      description: Email message size.
    - type: String
      contextPath: CiscoESA.Message.sdrReputation
      description: Sender domain reputation.
    - type: Boolean
      contextPath: CiscoESA.Message.showURL
      description: Whether the URL report is available.
    - type: String
      contextPath: CiscoESA.Message.recipient
      description: Message recipient email address.
    - type: String
      contextPath: CiscoESA.Message.sender
      description: Message sender email address.
    - type: Boolean
      contextPath: CiscoESA.Message.showAMP
      description: Whether the AMP report is available.
    - type: String
      contextPath: CiscoESA.Message.summary.timestamp
      description: Event summary time.
    - type: String
      contextPath: CiscoESA.Message.summary.description
      description: Event summary description
    - type: Boolean
      contextPath: CiscoESA.Message.summary.lastEvent
      description: Whether this is the last summary event.
    - type: Number
      contextPath: CiscoESA.Message.allIcid
      description: ICIDs list.
    - type: String
      contextPath: CiscoESA.Message.headerFrom
      description: Email message header from.
  - name: cisco-esa-message-amp-details-get
    description: Get message AMP summary details.
    arguments:
    - name: serial_number
      description: Email gateway serial number.
      required: true
    - name: message_ids
      description: Message ID list.
      required: true
      isArray: true
    outputs:
    - type: String
      contextPath: CiscoESA.AMPDetail.sdrAge
      description: Sender domain reputation age.
    - type: String
      contextPath: CiscoESA.AMPDetail.attachments
      description: Message attachments.
    - type: String
      contextPath: CiscoESA.AMPDetail.hostName
      description: Email gateway hostname.
    - type: String
      contextPath: CiscoESA.AMPDetail.direction
      description: Message direction, incoming or outgoing.
    - type: String
      contextPath: CiscoESA.AMPDetail.messageStatus
      description: Message delivery status.
    - type: String
      contextPath: CiscoESA.AMPDetail.senderGroup
      description: Matched sender group.
    - type: String
      contextPath: CiscoESA.AMPDetail.subject
      description: Email message subject.
    - type: String
      contextPath: CiscoESA.AMPDetail.sdrCategory
      description: Sender domain reputation category.
    - type: Number
      contextPath: CiscoESA.AMPDetail.mid
      description: Message ID.
    - type: String
      contextPath: CiscoESA.AMPDetail.ampDetails.timestamp
      description: AMP event summary details timestamp.
    - type: String
      contextPath: CiscoESA.AMPDetail.ampDetails.description
      description: AMP event summary details description.
    - type: Boolean
      contextPath: CiscoESA.AMPDetail.ampDetails.lastEvent
      description: AMP event summary details last event.
    - type: String
      contextPath: CiscoESA.AMPDetail.smtpAuthId
      description: SMTP authorization ID.
    - type: String
      contextPath: CiscoESA.AMPDetail.midHeader
      description: Message ID header.
    - type: String
      contextPath: CiscoESA.AMPDetail.timestamp
      description: Email message time.
    - type: String
      contextPath: CiscoESA.AMPDetail.messageSize
      description: Email message size.
    - type: String
      contextPath: CiscoESA.AMPDetail.sdrThreatLevels
      description: Sender domain reputation threat levels.
    - type: String
      contextPath: CiscoESA.AMPDetail.sdrReputation
      description: Sender domain reputation.
    - type: String
      contextPath: CiscoESA.AMPDetail.recipient
      description: Message recipient email address.
    - type: String
      contextPath: CiscoESA.AMPDetail.sender
      description: Message sender email address.
    - type: Boolean
      contextPath: CiscoESA.AMPDetail.showAMPDetails
      description: Whether to show AMP details.
    - type: Number
      contextPath: CiscoESA.AMPDetail.allIcid
      description: ICIDs list.
    - type: String
      contextPath: CiscoESA.AMPDetail.headerFrom
      description: Email header from.
  - name: cisco-esa-message-dlp-details-get
    description: Get message DLP summary details.
    arguments:
    - name: serial_number
      description: Email gateway serial number.
      required: true
    - name: message_ids
      description: Message ID list.
      required: true
      isArray: true
    outputs:
    - type: String
      contextPath: CiscoESA.DLPDetail.direction
      description: Message direction, incoming or outgoing.
    - type: String
      contextPath: CiscoESA.DLPDetail.smtpAuthId
      description: SMTP authorization ID.
    - type: String
      contextPath: CiscoESA.DLPDetail.sdrAge
      description: Sender domain reputation age.
    - type: String
      contextPath: CiscoESA.DLPDetail.sender
      description: Message sender email address.
    - type: String
      contextPath: CiscoESA.DLPDetail.midHeader
      description: Message ID header.
    - type: String
      contextPath: CiscoESA.DLPDetail.timestamp
      description: Email message time.
    - type: String
      contextPath: CiscoESA.DLPDetail.sdrCategory
      description: Sender domain reputation category.
    - type: String
      contextPath: CiscoESA.DLPDetail.hostName
      description: Email gateway hostname.
    - type: Number
      contextPath: CiscoESA.DLPDetail.mid
      description: Message ID.
    - type: String
      contextPath: CiscoESA.DLPDetail.attachments
      description: Message attachments.
    - type: String
      contextPath: CiscoESA.DLPDetail.messageSize
      description: Email message size.
    - type: String
      contextPath: CiscoESA.DLPDetail.dlpDetails.violationSeverity
      description: DLP details violation severity.
    - type: String
      contextPath: CiscoESA.DLPDetail.dlpDetails.dlpMatchedContent.messagePartMatch.classifier
      description: DLP matched content classifier.
    - type: String
      contextPath: CiscoESA.DLPDetail.dlpDetails.dlpMatchedContent.messagePartMatch.classifierMatch
      description: DLP matched content classifier match.
    - type: String
      contextPath: CiscoESA.DLPDetail.dlpDetails.dlpMatchedContent.messagePart
      description: DLP matched content message part.
    - type: String
      contextPath: CiscoESA.DLPDetail.dlpDetails.mid
      description: DLP message ID.
    - type: Number
      contextPath: CiscoESA.DLPDetail.dlpDetails.riskFactor
      description: DLP risk factor.
    - type: String
      contextPath: CiscoESA.DLPDetail.dlpDetails.dlpPolicy
      description: DLP policy.
    - type: String
      contextPath: CiscoESA.DLPDetail.sdrThreatLevels
      description: Sender domain reputation threat levels.
    - type: String
      contextPath: CiscoESA.DLPDetail.sdrReputation
      description: Sender domain reputation.
    - type: String
      contextPath: CiscoESA.DLPDetail.messageStatus
      description: Message delivery status.
    - type: Number
      contextPath: CiscoESA.DLPDetail.allIcid
      description: ICIDs list.
    - type: String
      contextPath: CiscoESA.DLPDetail.senderGroup
      description: Matched sender group.
    - type: String
      contextPath: CiscoESA.DLPDetail.recipient
      description: Message recipient email address.
    - type: String
      contextPath: CiscoESA.DLPDetail.subject
      description: Email message subject.
    - type: String
      contextPath: CiscoESA.DLPDetail.headerFrom
      description: Email header from.
  - name: cisco-esa-message-url-details-get
    description: Get message URL summary details.
    arguments:
    - name: serial_number
      description: Email gateway serial number.
      required: true
    - name: message_ids
      description: Message ID list.
      required: true
      isArray: true
    outputs:
    - type: String
      contextPath: CiscoESA.URLDetail.sdrAge
      description: Sender domain reputation age.
    - type: String
      contextPath: CiscoESA.URLDetail.attachments
      description: Message attachments.
    - type: Boolean
      contextPath: CiscoESA.URLDetail.showURLDetails
      description: Whether to show URL event details.
    - type: String
      contextPath: CiscoESA.URLDetail.urlDetails.timestamp
      description: URL event details timestamp.
    - type: String
      contextPath: CiscoESA.URLDetail.urlDetails.description
      description: URL event details description.
    - type: String
      contextPath: CiscoESA.URLDetail.hostName
      description: Email gateway hostname.
    - type: String
      contextPath: CiscoESA.URLDetail.direction
      description: Message direction, incoming or outgoing.
    - type: String
      contextPath: CiscoESA.URLDetail.messageStatus
      description: Message delivery status.
    - type: String
      contextPath: CiscoESA.URLDetail.senderGroup
      description: Matched sender group.
    - type: String
      contextPath: CiscoESA.URLDetail.subject
      description: Email message subject.
    - type: String
      contextPath: CiscoESA.URLDetail.sdrCategory
      description: Sender domain reputation category.
    - type: Number
      contextPath: CiscoESA.URLDetail.mid
      description: Message ID.
    - type: String
      contextPath: CiscoESA.URLDetail.smtpAuthId
      description: SMTP authorization ID.
    - type: String
      contextPath: CiscoESA.URLDetail.midHeader
      description: Message ID header.
    - type: String
      contextPath: CiscoESA.URLDetail.timestamp
      description: Email message time.
    - type: String
      contextPath: CiscoESA.URLDetail.messageSize
      description: Email message size.
    - type: String
      contextPath: CiscoESA.URLDetail.sdrThreatLevels
      description: Sender domain reputation threat levels.
    - type: String
      contextPath: CiscoESA.URLDetail.sdrReputation
      description: Sender domain reputation.
    - type: String
      contextPath: CiscoESA.URLDetail.recipient
      description: Message recipient email address.
    - type: String
      contextPath: CiscoESA.URLDetail.sender
      description: Message sender email address.
    - type: Number
      contextPath: CiscoESA.URLDetail.allIcid
      description: ICIDs list.
    - type: String
      contextPath: CiscoESA.URLDetail.headerFrom
      description: Email header from.
  - name: cisco-esa-report-get
    description: |-
      Get statistics reports.
      Note that each report type is compatible with different arguments.
      Refer to Addendum for Cisco Secure Email Gateway ("Secure Email Reporting" sheet in the file), to view the dedicated arguments for each report type.
      https://www.cisco.com/c/dam/en/us/td/docs/security/esa/esa14-0/api/AsyncOS-14-0-API-Addendum.xlsx
    arguments:
    - name: report_type
      description: Report Type.
      defaultValue: mail_incoming_traffic_summary
      auto: PREDEFINED
      predefined:
      - mail_incoming_traffic_summary
      - reporting_system
      - mail_vof_threat_summary
      - mail_vof_specific_threat_summary
      - mail_amp_threat_summary
    - name: custom_report_type
      description: |-
        Custom report type.
        Specify this argument to get a report that does not exist in the report_type argument.
    - name: start_date
      description: |-
        Start date in ISO format or <number> <time unit>,
        e.g., 2022-01-01T00:00:00.000Z, 12 hours, 7 days, 3 months, now.
      required: true
    - name: end_date
      description: |-
        End date in ISO format or <number> <time unit>,
        e.g., 2022-01-01T00:00:00.000Z, 12 hours, 7 days, 3 months, now.
      required: true
    - name: order_by
      description: The attribute by which to order the data in the response. For example, orderBy=total_clean_recipients
    - name: order_dir
      description: The report sort order direction.
      auto: PREDEFINED
      predefined:
      - asc
      - desc
    - name: top
      description: The number of records with the highest values to return.
    - name: filter_value
      description: The filter value to search for.
    - name: filter_by
      description: The filter field to use. Filter the data to be retrieved according to the filter property and value.
    - name: filter_operator
      description: The filter operator. Filter the response data based on the value specified.
      auto: PREDEFINED
      predefined:
      - begins_with
      - is
    outputs:
    - type: String
      contextPath: CiscoESA.Report.type
      description: Report type.
    - type: Number
      contextPath: CiscoESA.Report.resultSet
      description: Report results summary.
fromversion: 6.5.0
tests:
- No tests (auto formatted)