Use Case #4: Email Integration 

Use Case #4: Email Integration 

Exchange/Email servers are a vital part of implementing automated response actions as one of the most common entry points for malicious/unknown entities into customers’ environments. The SOC is enabled with these response actions to prevent and mitigate any potential threat that can be identified through various tool-based detections and/or user reported phish emails. 

 

In this use case automation, users from the customer environment are setup with a reporting process where they can easily report specific emails to the SOC which can be further analyzed, triaged, and investigated using the tools within the SOC. Once identified as malicious or harmful, the SOC can trigger actions to remove similar emails from across the environment and avoid other user compromise.

Typical Actions

  1. Search for similar emails across inboxes 
  2. Block sender with matching message ID 

Default Playbooks

  1. Exchange Email integration (use-case specific)  

Base Workflow


What is Needed

  1. Mail address 
  2. Mail server address 
  3. Other Graph API details:  
    1. Client ID, secret value, and Directory ID  
  4. Refresh Token 
    1. This step needs to be completed with customer support since it requires the SOAR team to hop on a call with the customer. With OAuth, the time limit to share refresh token is limited to 10 minutes. 

Available Vendors

  1. CyFlare Managed Email Security
  2. Exchange 
  3. Office365 (Exchange Online) 
  4. Mimecast 
  5. Symantec 
  6. Trend Micro Cloud Application Security 
  7. ... more on Updated Integration List for Chronicle SOAR  
Note: If you do not see an integration, it still may be possible to configure, CyFlare has an internal SOAR team that can develop integrations within SOAR. This may be of extra cost to a client, depending on the request. Reach out to your CSM or socir@cyflare.com for more details. 

How to Get Started

Two Options: 

  1. You can work with your dedicated Customer Success Manager, and they will coordinate with the SOAR Team in getting this Automation built out for you. 
  2. Send an email to socir@cyflare.com and specify what integration you would like to leverage for automation to be built out. 
    1. The SOAR Team will process your request and get back to you with the criteria we need and meet with any customer to further explain and validate any questions they may have.