Area 1 Security offers Application Programming Interfaces (APIs) to expose our phishing campaign rulesets. These APIs both aid research and provide a set of indicators to block using network security edge devices.

Connect Area 1 Security with Devo SOAR

1. Navigate to Automations > Integrations.

2. Search for Area 1 Security.

3. Click Details, then the + icon. Enter the required information in the following fields.

4. Label: Enter a connection name.

5. Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.

6. Verify SSL: Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate).

7. Remote Agent: Run this integration using the Devo SOAR Remote Agent.

8. Username: Username to access Area 1 Security APIs.

9. Password: Password to access Area 1 Security APIs.

10. After you've entered all the details, click Connect.

Actions for Area 1 Security

List Actors

This service returns a list of Actors.

Input Field

Choose a connection that you have previously created to complete the connection.

Output

A JSON object containing multiple rows of result:

``` {json}{ "error":null, "has_error":false, "result":"ALL_ACTOR" }

Search Indicator (Rate Limit: 4/minute)

This service can be queried with a basic indicator (file hash (MD5/SHA-1/SHA-256), URL, domain, IP Address, or email address) and returns information about the indicator.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing indicator details:

``` {json}{ "has_error":false, "error":null, "indicator": "example", "first_seen": 1433810886000, "last_seen": 1478200022000, "Hash_ImpHash": "eample", "Hash_authentihash": "example", "type": "Hash_SHA1", "Hash_ssdeep": "example", "disposition": "MALICIOUS", "tlp": "white", "Hash_MD5": "example_md5", "tag_histories": [ { "intervals": [ { "start": 1337347427000, "end": "current" } ], "category": "Actor", "value": "abc" }, { "intervals": [ { "start": 1337347427000, "end": "current" } ], "category": "ThreatType", "value": "Dropper" } ], "family": "file", "Hash_SHA256": "example" }

Email Details by Alert ID

This service returns the content of an email given an alert_id from the detection message sent from Area 1.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing message content and fileId of message details:

``` {json}{ "has_error":false, "error":null, "email": "body", "fileId": "4153535" }

Search All Emails

This service returns information for each email that matches the search parameter(s). All email can be searched, whether it registered a detection or not.

Input Field

Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.

Output

A JSON object containing email details:

{json}{ "has_error":false, "error":null, "postfix_ident_outbound": "47Jjdp3WRsz11M1D", "final_disposition": "NONE", "envelope_to": [ "rebecca@example.com" ], "subject": "[EXTERNAL] RE: Lost and found", "from": "kelsey@example.com", "message_id": "<DM3P159M258D4E0@DM3P159MB001.PROD.OUTLOOK.COM>", "postfix_ident": "47Jjcz1H88z11M4F", "client_name": "mr. client", "ts": "2019-11-21T15:09:33" }

Release Notes

• v2.0.0 - Updated architecture to support IO via filesystem