Cyware Orchestrate

Action on Email Messages

This action deletes, quarantines, or restores an email message.

Action on User Account

This action performs actions on a user account such as disabling a user account, enabling multi-factor authentication (MFA) for a user account, resetting the password for a user account, and terminating all sign-in sessions of Microsoft services for a user account.

Get Blocked Lists

This action retrieves the blocked senders, URLs, SHA-1 hash values, and SHA-256 hash values.

Get Quarantine Events

This action retrieves quarantine events of the services that the Trend Micro Cloud App Security application protects.

Get Security Logs

This action retrieves security event logs of the services that the Trend Micro Cloud App Security application protects.

Query Results

This action queries the results of actions on specified email messages or user accounts.

Sweep Email Messages

This action searches email messages in the Trend Micro Cloud App Security application-protected mailboxes.

Update Block Lists

This action adds or removes senders, URLs, SHA-1 hash values, or SHA-256 hash values to or from the blocked lists on the Trend Micro Cloud App Security application.

Base URL

Enter the base URL.

Example:

Text

Required

API Token

Enter the API token.

Password

Required

Action Type

Enter the action type to perform on a user account.

Text

Required

Allowed values:

Service

Enter the name of the protected service to which the API applies.

Text

Required

Allowed values:

Account Provider

Enter the account provider.

Text

Required

Allowed values:

Mailbox

Enter the email address of an email message to perform an action.

Example:

"user2@example2.com"

Text

Required

Mail Message Delivery Time

Enter the date and time when an email message is sent to perform an action on the email.

Text

Required

You can retrieve the mail message delivery time using the actions Sweep Email Messages or Get Quarantine Events.

Mail Message ID

Enter the internet message ID of an email message to perform an action.

Text

Optional

You can retrieve the mail message ID using the actions Sweep Email Messages or Get Quarantine Events.

Mail Unique ID

Enter the unique ID of an email message to take perform an action.

Text

Optional

You can retrieve the mail unique ID using the actions Sweep Email Messages or Get Quarantine Events.

Detection Time

Enter the date and time when the security event was detected.

Text

Optional

This parameter is required while restoring an email (mail_restore) and its value can be retrieved using the action Get Quarantine Events.

Mail Log ID

Enter the mail log ID that uniquely identifies a log.

Text

Optional

This parameter is required while restoring an email (mail_restore) and its value can be retrieved using the action Get Quarantine Events.

Action Type

Enter the action type to perform on a user account.

Text

Required

Allowed values:

Account User Email

Enter the email address used to create the user account.

Example: "user2@example2.com"

Text

Required

Start Time

Enter the start time to retrieve quarantine events.

Example:

"2016-07-22T01:51:31Z"

Text

Optional

Allowed format:

ISO 8601 timestamp to the second or millisecond (optional) in UTC, yyyy-mm-ddThh:mm:ss[.mmm]Z.

Example:

End Time

Enter the end time to retrieve quarantine events.

Example:

"2016-07-23T01:51:31Z"

Text

Optional

Allowed format:

ISO 8601 timestamp to the second or millisecond (optional) in UTC, yyyy-mm-ddThh:mm:ss[.mmm]Z.

Example:

Limit

Enter the maximum number of quarantine events to retrieve.

Integer

Optional

Default value:

500

Maximum allowed value:

500

Next Link

Enter the next link to retrieve the remaining log items for the previous request.

Text

Optional

Service

Enter the name of the protected service whose logs you need to retrieve.

Text

Required

Allowed values:

Event

Enter the type of security event whose logs you need to retrieve.

Text

Required

Allowed values:

Start Time

Enter the start time from which to retrieve security logs.

Example:

"2016-07-22T01:51:31Z"

Text

Optional

Allowed format:

ISO 8601 timestamp to the second or millisecond (optional) in UTC, yyyy-mm-ddThh:mm:ss[.mmm]Z.

Example:

End Time

Enter the end time till when to retrieve security logs.

Example:

"2016-07-23T01:51:31Z"

Text

Optional

Allowed format:

ISO 8601 timestamp to the second or millisecond (optional) in UTC, yyyy-mm-ddThh:mm:ss[.mmm]Z.

Example:

Limit

Enter the maximum number of logs to retrieve.

Integer

Optional

Default value:

500

Maximum allowed value:

500

Next Link

Enter the next link to retrieve the remaining log items for the previous request.

Text

Optional

Query Email Message

Enter true to query on email messages or enter false to query on user accounts.

Boolean

Required

Allowed values:

Batch ID

Enter the unique batch ID of threat mitigation.

Text

Required

Start Time

Enter the start time from which to retrieve results.

Example:

"2016-07-22t01:51:31z"

Text

Optional

Allowed format:

ISO 8601 timestamp to the second or millisecond (optional) in UTC, yyyy-mm-ddThh:mm:ss[.mmm]Z.

Example:

End Time

Enter the end time to retrieve results.

Example:

"2016-07-23t01:51:31z"

Text

Optional

Allowed format:

ISO 8601 timestamp to the second or millisecond (optional) in UTC, yyyy-mm-ddThh:mm:ss[.mmm]Z.

Example:

Limit

Enter the maximum number of results to retrieve.

Integer

Optional

Default value:

500

Maximum allowed value:

500

Next Link

Enter the next link to retrieve the remaining results for the previous request.

Text

Optional

Mailbox

Enter the email address of the mailbox to search in.

Example:

"u*ser@example.com"

Text

Optional

Subject

Enter the subject of email messages to search for.

Example:

"sample subject"

Text

Optional

To search for an exact phrase, for example, example1 example2, enclose the value in double quotes "example1 example2"; otherwise, the Trend Micro Cloud Security app performs a partial match based on the phrase.

Source IP

Enter the source IP address of email messages to search for.

Example:

Text

Optional

Extra Parameters

Enter the extra parameters.

Example: $dict{'sender':'u*ser@example.com','file_name':'example',..}

Key Value

Optional

Allowed keys:

Next Link

Enter the next link to retrieve the meta information of the remaining email messages for the previous request.

Text

Optional

Action Type

Enter the action type to perform.

Text

Required

Allowed values:

Rules

Enter the key-value pairs to block the sender, URL, SHA-1 hash value, and SHA-256 hash value lists to configure.

Example:

$JSON{'senders':[value1,..],'urls':[value1,..],'filehashes':[value1,..],'file256hashes':[value1,..]}

Any

Required

Allowed keys: