splunk
TA FireEye ETP
Splunk Cloud
Overview
Details
Technical Add-on FireEye ETP fetch the data from FireEye ETP through their API.
This app offers three functions, which is Email trace Request, Alert Summary Request and Message File Request.
Please feel free to contact me if you have any questions or requests.
This app offers three functions, which is Email trace Request, Alert Summary Request and Message File Request.
Please feel free to contact me if you have any questions or requests.
Technical Add-on FireEye ETP
1. Overview
Technical Add-on FireEye ETP fetch the data from FireEye ETP through their API.
This app offers three functions, which is Email trace Request, Alert Summary Request and Message File Request.
2. Setup
- Create an OAuth Token (API Key) on FireEye Cloud
- Go to Splunk setup page
- Apps -> Manage App -> Set up
- Select the region instance and set the OAuth Token.
3. Usage
There are three commands.
- etpemailtrace
- Email Trace Request
- etpalert
- Alert Summary Request
- etpmsgfile
- Message File Request
3.1. etpemailtrace (Email Trace Request)
- Returns a list of messages that include specified message attributes that are accessible in the ETP portal.
- There are following options.
- subject: any keyword
- at_verdict: fail or Pass
- to_accepted_dt: ISO format. If not set, use a time picker.
- from_accepted_dt: ISO format. If not set, use a time picker.
- to_email: any keyword
- from_email: any keyword
- Example
| etpemailtrace subject=hoge at_verdict=fail from_accepted_dt="2022-04-22T00:00:00" to_accepted_dt="2022-04-22T16:00:00" to_email="co.jp" | spath input=_raw - Note
- This command get max 10000 message attributes.
3.2. etpalert (Alert Summary Request)
- Gets a list of advanced threat alerts in summary format.
- There are following options.
- from_last_modified_on: ISO format. If not set, use a time picker.
- email_status: "quarantined", "released", "deleted", "bcc: dropped", "delivered (retroactive)" or "dropped (oob retroactive)"
- Example
| etpalert from_last_modified_on="2022-04-20T00:00:00" email_status="bcc: dropped" | spath input=_raw - Note
- This command get max 10000 alert summaries.
3.3. etpmsgfile (Message File Request)
- Retrieves the email file in plain text format for the given message ID.
- There are following options.
- legacy_id: number
- etp_message_id: message id
- from_last_modified_on: ISO format
- if not set, use a time picker.
- Example 1
| makeresults | etpmsgfile legacy_id=xxxxxx from_last_modified_on="2022-04-29T00:00:00" - Example 2
| makeresults | eval legacy_id = "xxxxxxxx" | eval from_last_modified_on = "2022-04-29T00:00:00" | etpmsgfile - Example 3
| makeresults | etpmsgfile etp_message_id=CXXXXXXXXXX - Example 4
| makeresults | eval etp_message_id = "CXXXXXXXXXX" | etpmsgfile
4. Note
- To use this app, users need a following privilege.
- list_storage_passwords
5. Debug
- Please check the internal log.
index=_internal source="*fireeye_etp*" NOT "__init__"
Release Notes
Version 0.0.2
April 30, 2022