riposte-marketplace/integrations/mimecast/manifest.yaml

id: mimecast
name: Mimecast
version: 1.1.0
description: "Mimecast (Email Security API) — anti-phishing containment: list/release/reject held messages, search messages and get message info, block URLs (managed URLs), block senders, create remediation incidents, and decode rewritten URLs. HMAC-SHA1 signed authentication; stdlib-only, no extra Python dependencies."
changelog: "1.1.0 — Declare the risk tier on the 5 commands that carried none, all of them destructive. An unset risk was already gated as destructive, so the approval prompt does not move; what changes is that the tier is a stated decision rather than a default, and a command added later cannot inherit it by omission. | 1.0.0 — Initial release: held-message list/release/reject, message search + info, managed URL create/list, block sender, create remediation, URL decode."
category: email

# Per-instance configuration. Requests are signed (HMAC-SHA1) with the
# application + access/secret keys.
config_schema:
  properties:
    base_url:
      type: string
      description: "Mimecast API base URL (e.g. https://eu-api.mimecast.com)"
    app_id:
      type: string
      description: "Application ID"
    app_key:
      type: string
      description: "Application Key"
      x-soar-sensitive: true
    access_key:
      type: string
      description: "Access Key"
      x-soar-sensitive: true
    secret_key:
      type: string
      description: "Secret Key (base64)"
      x-soar-sensitive: true
  required:
    - base_url
    - app_id
    - app_key
    - access_key
    - secret_key

commands:
  - id: list_held_messages
    name: mimecast-list-held-messages
    description: "List messages currently held for review."
    risk: read
    inputs_schema:
      properties:
        admin: { type: boolean, description: "List all held messages (admin view) vs. the account's own (default true)" }
        limit: { type: number, description: "Max messages (default 100)" }
      required: []
    outputs_schema: { properties: {} }
  - id: release_held_message
    name: mimecast-release-held-message
    description: "Release a held message for delivery."
    risk: destructive
    inputs_schema:
      properties:
        message_id: { type: string, description: "Held message ID" }
      required: [message_id]
    outputs_schema: { properties: {} }
  - id: reject_held_message
    name: mimecast-reject-held-message
    description: "Reject a held message."
    risk: destructive
    inputs_schema:
      properties:
        message_id: { type: string, description: "Held message ID" }
        reason: { type: string, description: "Optional rejection reason" }
      required: [message_id]
    outputs_schema: { properties: {} }
  - id: search_messages
    name: mimecast-search-messages
    description: "Search tracked messages by sender, recipient, or subject."
    risk: read
    inputs_schema:
      properties:
        from: { type: string, description: "Sender address filter" }
        to: { type: string, description: "Recipient address filter" }
        subject: { type: string, description: "Subject filter" }
        start: { type: string, description: "ISO-8601 start time" }
        end: { type: string, description: "ISO-8601 end time" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_message_info
    name: mimecast-get-message-info
    description: "Get delivery and processing details for a tracked message."
    risk: read
    inputs_schema:
      properties:
        message_id: { type: string, description: "Message ID" }
      required: [message_id]
    outputs_schema: { properties: {} }
  - id: create_managed_url
    name: mimecast-create-managed-url
    description: "Add a URL to the managed URL list (block or permit)."
    risk: destructive
    inputs_schema:
      properties:
        url: { type: string, description: "URL to manage" }
        action: { type: string, description: "block or permit (default block)" }
        match_type: { type: string, description: "explicit or domain (default explicit)" }
        comment: { type: string, description: "Optional comment" }
      required: [url]
    outputs_schema: { properties: {} }
  - id: list_managed_urls
    name: mimecast-list-managed-urls
    description: "List managed URLs (block/permit list)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }
  - id: block_sender
    name: mimecast-block-sender
    description: "Block (or permit) a sender for a recipient."
    risk: destructive
    inputs_schema:
      properties:
        sender: { type: string, description: "Sender address to block/permit" }
        recipient: { type: string, description: "Recipient address the rule applies to" }
        action: { type: string, description: "block or permit (default block)" }
      required: [sender, recipient]
    outputs_schema: { properties: {} }
  - id: create_remediation
    name: mimecast-create-remediation
    description: "Create a remediation incident to pull malicious messages from mailboxes."
    risk: destructive
    inputs_schema:
      properties:
        message_hash: { type: string, description: "File hash to remediate (provide this or message_id)" }
        message_id: { type: string, description: "Message ID / internet message ID to remediate" }
        reason: { type: string, description: "Reason for remediation" }
      required: []
    outputs_schema: { properties: {} }
  - id: decode_url
    name: mimecast-decode-url
    description: "Decode a Mimecast-rewritten URL back to its original form."
    risk: read
    inputs_schema:
      properties:
        url: { type: string, description: "Rewritten URL to decode" }
      required: [url]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: mimecast-test-connection
    description: "Verify connectivity and the signed credentials (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }