SIEM/SOAR

MetaDefender™ Cloud Email Security allows integration with external SIEM/SOAR systems. Follow the steps below to configure a provider.

Supported Integrations

Elasticsearch

Use this option to forward events directly to an Elasticsearch cluster.

Configuration Steps

  1. Select Elasticsearch under Service Selection.

  2. Endpoint URL Enter the Elasticsearch endpoint, for example: https://<host>:9200

  3. Authentication Type Select Basic Authentication.

  4. Authentication Details

    • Username: Enter the Elasticsearch username.
    • Password: Enter the corresponding password.

  5. Event Filters

    • Enable Send Events to forward events.

    • Select one or more Statuses, such as:

      • Closed Without Action
      • Deleted
      • Delivered
      • Failed to Deliver
      • Investigating
      • Quarantined
      • Released
      • Rescanning

    • Select one or more Verdicts, such as:

      • Malicious
      • Suspicious
      • Sanitized
      • No threat detected
      • Encrypted content
      • Unsupported file type
      • Failure to analyze
      • Skipped
      • Sanitization policy error

  6. Audit Log Filters

    • Enable Send Audit Logs to forward administrative activity.
    • Select Event Types, such as:
      • Authentication
      • Configuration

  7. Click Save Changes to apply the configuration.

Generic HTTP

Use this option to forward events to a custom HTTP endpoint or third-party SIEM/SOAR service.

Configuration Steps

  1. Select HTTP under Service Selection.

  2. Endpoint URL Enter the destination service endpoint, for example: https://<host>:8080

  3. API Key Specify the API key required by the destination service.

  4. Event Filters

    • Enable Send Events to forward events.
    • Configure Status and Verdict filters as needed.

  5. Audit Log Filters

    • Enable Send Audit Logs to forward audit events.
    • Select relevant Event Types (for example, Authentication or Configuration).

  6. Click Save Changes to apply the configuration.

JSON Output Reference

Common Fields

FieldDescription
eventIdUnique identifier for this event instance.
correlationIdIdentifier used to correlate this event with other related events across systems.
sourceOriginating system that generated the event (e.g., MDCES).
timestampISO 8601 timestamp indicating when the event was generated.
tenantIdIdentifier for the tenant/customer associated with the event.
eventTypeHigh-level category of the event.
messageHuman-readable summary of the event outcome.
userIdUser or system responsible for triggering the event.

Event Fields

Processing Details

FieldDescription
details/messageIdUnique identifier of the processed email.
details/integrationIdIdentifier of the integration handling the message.
details/processingIdUnique ID for this processing execution.
details/policyIdIdentifier of the policy applied.
details/timestampTime when processing was logged.
details/messageStatusFinal delivery status of the message.
details/quarantineStatusIndicates whether the message was quarantined.
details/policyNameHuman-readable name of the applied policy.
details/reasonReason for quarantine or action taken.
details/processingTimeMsTotal processing time in milliseconds.

Metadata

FieldDescription
details/emailMetaData/sentTimestampTime the email was sent.
details/emailMetaData/receivedTimestampTime the email was received.
details/emailMetaData/senderIpIP address of the sending mail server.
details/emailMetaData/senderSMTP sender.
details/emailMetaData/fromFrom: header.
details/emailMetaData/toTo: header.
details/emailMetaData/ccCc: header.
details/emailMetaData/recipientsSMTP recipients.
details/emailMetaData/subjectEmail subject line.
details/emailMetaData/sizeEmail size in bytes.
details/emailMetaData/emailDirectionDirection of email flow (Inbound/Outbound).
details/emailMetaData/senderDomainSending mail server domain.
details/emailMetaData/emailHeaderMessageIdMessage-ID from email headers.

Overall Scan Result

FieldDescription
details/scanResult/overallVerdictFinal verdict after all scans.
details/scanResult/scanDurationTotal scan time in milliseconds.
details/scanResult/verdictNormalized verdict value.
details/scanResult/severitySeverity level of detected threats.
details/scanResult/scanResultEngines/totalEnginesNumber of scanning engines used.
details/scanResult/scanResultEngines/detectedEnginesNumber of engines that detected a threat.

Parts

FieldDescription
details/emailParts/fileIdUnique identifier for the email part.
details/emailParts/data/fileNameName/path of the file.
details/emailParts/data/contentTypeBody or Attachment.
details/emailParts/data/sha256SHA-256 file hash.
details/emailParts/data/sizeFile size in bytes.
details/emailParts/data/partIdMessage structure identifier.
details/emailParts/data/contentIdContent-ID header value.
details/emailParts/data/fileTypeFile extension/type.
details/emailParts/data/fileTypeDescriptionHuman-readable file type.
details/emailParts/scanResult/dataIdInternal scanning system identifier.
details/emailParts/scanResult/threatDetectionResultThreat detection outcome.
details/emailParts/scanResult/deepCdrResultCDR processing result.
details/emailParts/scanResult/fileVerdictFinal verdict for the file.

Audit History

FieldDescription
details/auditHistory/typeType of audit event.
details/auditHistory/timestampTime the audit event occurred.
details/auditHistory/descriptionDescription of the audit event.
details/auditHistory/senderSender involved in the audit event.
details/auditHistory/toRecipients involved in the audit event.

Audit Fields

FieldDescription
timestamp Time when the audited action occurred.
referencedObject Type of object affected by the action (e.g., POLICY).
operationType Operation performed on the referenced object (e.g., UPDATE).
eventType Category of audit event (e.g., CONFIGURATION).
referenceId Identifier of the specific object that was modified.

Connection Test Fields

FieldDescription
test Always 'true'.
timestamp Time when test was logged.
message Always 'Test connection from MDCES'.
Type to search, ESC to discard
Type to search, ESC to discard
Type to search, ESC to discard
Next to read:
Allowlist
On This Page
SIEM/SOARSupported IntegrationsElasticsearchConfiguration StepsGeneric HTTPConfiguration StepsJSON Output ReferenceCommon FieldsEvent FieldsProcessing DetailsMetadataOverall Scan ResultPartsAudit HistoryAudit FieldsConnection Test Fields