feat(mimecast): new Mimecast anti-phishing integration
Email Security API, 11 commands: held-message list/release/reject, message search + info, managed URL create/list (block), block sender, create remediation, URL decode. HMAC-SHA1 signed auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
@@ -0,0 +1,143 @@
|
||||
id: mimecast
|
||||
name: Mimecast
|
||||
version: 1.0.0
|
||||
description: "Mimecast (Email Security API) — anti-phishing containment: list/release/reject held messages, search messages and get message info, block URLs (managed URLs), block senders, create remediation incidents, and decode rewritten URLs. HMAC-SHA1 signed authentication; stdlib-only, no extra Python dependencies."
|
||||
changelog: "1.0.0 — Initial release: held-message list/release/reject, message search + info, managed URL create/list, block sender, create remediation, URL decode."
|
||||
category: email
|
||||
|
||||
# Per-instance configuration. Requests are signed (HMAC-SHA1) with the
|
||||
# application + access/secret keys.
|
||||
config_schema:
|
||||
properties:
|
||||
base_url:
|
||||
type: string
|
||||
description: "Mimecast API base URL (e.g. https://eu-api.mimecast.com)"
|
||||
app_id:
|
||||
type: string
|
||||
description: "Application ID"
|
||||
app_key:
|
||||
type: string
|
||||
description: "Application Key"
|
||||
x-soar-sensitive: true
|
||||
access_key:
|
||||
type: string
|
||||
description: "Access Key"
|
||||
x-soar-sensitive: true
|
||||
secret_key:
|
||||
type: string
|
||||
description: "Secret Key (base64)"
|
||||
x-soar-sensitive: true
|
||||
required:
|
||||
- base_url
|
||||
- app_id
|
||||
- app_key
|
||||
- access_key
|
||||
- secret_key
|
||||
|
||||
commands:
|
||||
- id: list_held_messages
|
||||
name: mimecast-list-held-messages
|
||||
description: "List messages currently held for review."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
admin: { type: boolean, description: "List all held messages (admin view) vs. the account's own (default true)" }
|
||||
limit: { type: number, description: "Max messages (default 100)" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: release_held_message
|
||||
name: mimecast-release-held-message
|
||||
description: "Release a held message for delivery."
|
||||
inputs_schema:
|
||||
properties:
|
||||
message_id: { type: string, description: "Held message ID" }
|
||||
required: [message_id]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: reject_held_message
|
||||
name: mimecast-reject-held-message
|
||||
description: "Reject a held message."
|
||||
inputs_schema:
|
||||
properties:
|
||||
message_id: { type: string, description: "Held message ID" }
|
||||
reason: { type: string, description: "Optional rejection reason" }
|
||||
required: [message_id]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: search_messages
|
||||
name: mimecast-search-messages
|
||||
description: "Search tracked messages by sender, recipient, or subject."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
from: { type: string, description: "Sender address filter" }
|
||||
to: { type: string, description: "Recipient address filter" }
|
||||
subject: { type: string, description: "Subject filter" }
|
||||
start: { type: string, description: "ISO-8601 start time" }
|
||||
end: { type: string, description: "ISO-8601 end time" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_message_info
|
||||
name: mimecast-get-message-info
|
||||
description: "Get delivery and processing details for a tracked message."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
message_id: { type: string, description: "Message ID" }
|
||||
required: [message_id]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: create_managed_url
|
||||
name: mimecast-create-managed-url
|
||||
description: "Add a URL to the managed URL list (block or permit)."
|
||||
inputs_schema:
|
||||
properties:
|
||||
url: { type: string, description: "URL to manage" }
|
||||
action: { type: string, description: "block or permit (default block)" }
|
||||
match_type: { type: string, description: "explicit or domain (default explicit)" }
|
||||
comment: { type: string, description: "Optional comment" }
|
||||
required: [url]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: list_managed_urls
|
||||
name: mimecast-list-managed-urls
|
||||
description: "List managed URLs (block/permit list)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties: {}
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: block_sender
|
||||
name: mimecast-block-sender
|
||||
description: "Block (or permit) a sender for a recipient."
|
||||
inputs_schema:
|
||||
properties:
|
||||
sender: { type: string, description: "Sender address to block/permit" }
|
||||
recipient: { type: string, description: "Recipient address the rule applies to" }
|
||||
action: { type: string, description: "block or permit (default block)" }
|
||||
required: [sender, recipient]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: create_remediation
|
||||
name: mimecast-create-remediation
|
||||
description: "Create a remediation incident to pull malicious messages from mailboxes."
|
||||
inputs_schema:
|
||||
properties:
|
||||
message_hash: { type: string, description: "File hash to remediate (provide this or message_id)" }
|
||||
message_id: { type: string, description: "Message ID / internet message ID to remediate" }
|
||||
reason: { type: string, description: "Reason for remediation" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: decode_url
|
||||
name: mimecast-decode-url
|
||||
description: "Decode a Mimecast-rewritten URL back to its original form."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
url: { type: string, description: "Rewritten URL to decode" }
|
||||
required: [url]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
- id: test_connection
|
||||
name: mimecast-test-connection
|
||||
description: "Verify connectivity and the signed credentials (used by the Test button)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties: {}
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
Reference in New Issue
Block a user