Sign inSign up

lumutools/harmony-email-threat-feeder

By lumutools

•Updated 1 day ago

Image
0

228

lumutools/harmony-email-threat-feeder repository overview

⁠Lumu - Harmony Email Security Response Integration

Lumu Defender offers a framework to help you leverage Lumu's integrations with your existing cybersecurity stack, including Security Information and Event Management (SIEM), Security Orchestration, Automation, and Response (SOAR), Endpoint Detection and Response (EDR), incident response systems, and more.

The integration between Harmony Email Security and Lumu leverages the Anti-Phishing Block-List feature. It is a security control that allows administrators to block specific domains, URLS, or MD5 attachments that pose a known threat to the organization. When an incoming email matches an entry on this list, the system instantly flags the email as Phishing or Spam, routing it directly to quarantine based on your organization's workflow policies. This tool provides an immediate line of defense to stop recurring malicious traffic, improving your organization's detection and response capabilities.

⁠Getting Started

To ensure a successful deployment and avoid configuration conflicts, please follow these guidelines:

  • Primary Documentation: The documentation offers detailed instructions for configuring and gathering the necessary data for the integration. We strongly recommend following the official documentation⁠ to successfully deploy the Harmony Email Security integration.
  • Management Snippet: Lumu provides a dedicated management script (manage.sh), which is the only recommended method to configure, start, and monitor this integration.
⁠Requirements

Before proceeding, ensure you have:

  • Docker-enabled host: Required for deploying the integration components.
  • Harmony Email Security API Access: You must have an account API key attached to the Email & Collaboration service.
  • Lumu Credentials: Your Lumu Company UUID and Defender API Key.
  • Network Connectivity: The host must be able to communicate with defender.lumu.io and Harmony Email Security API.

⁠Deployment Steps

The following steps only describe the deployment process; refer to the official documentation⁠ to ensure all system prerequisites and configuration requirements are met.

⁠1. Set up the Management Script

Create a file named manage.sh on your integration host and paste the following snippet:

#!/usr/bin/env bash

RED='\033[0;31m'
GREEN='\033[0;32m'
CYAN='\033[0;36m'
YELLOW='\033[1;33m'
BOLD='\033[1m'
RESET='\033[0m'

info()    { echo -e "${CYAN}[INFO]${RESET}  $*"; }
success() { echo -e "${GREEN}[OK]${RESET}    $*"; }
warn()    { echo -e "${YELLOW}[WARN]${RESET}  $*"; }
error()   { echo -e "${RED}[ERROR]${RESET} $*" >&2; }
prompt()  { echo -e "${BOLD}${YELLOW}$*${RESET}"; }

IMG=lumutools/harmony-email-threat-feeder:latest
INTEGRATION_NAME=harmony-email-threat-feeder
INTEGRATION_NAME_IOC=harmony-email-threat-feeder-ioc
INTEGRATION_DIR=${HOME}/HarmonyEmailResponse
VOLUME_DATA=${INTEGRATION_DIR}/data:/app/data
VOLUME_CONFIG=${INTEGRATION_DIR}/data/.config.toml:/app/.config.toml:ro
VOLUME_IOC=${INTEGRATION_DIR}/data/ioc.db:/app/data/ioc.db:ro

mkdir -p "${INTEGRATION_DIR}/data"
chmod -R o+w "${INTEGRATION_DIR}/data" > /dev/null 2>&1 

run_config() {
    info "Running configuration script ..."
    if docker run --rm -it -v "${INTEGRATION_DIR}/data:/app/data" "${IMG}" bash run_config; then
        success "Configuration completed."
    else
        error "Configuration script failed."; return 1
    fi
}

start_integration() {
    info "Setting up IOC integration '${INTEGRATION_NAME_IOC}' ..."
    if [[ ! -f "${INTEGRATION_DIR}/data/.config.toml" ]]; then
        error "Please configure the integration first."; return 1
    fi
    if ! docker container inspect "${INTEGRATION_NAME_IOC}" &>/dev/null; then
        info "Integration '${INTEGRATION_NAME_IOC}' does not exist. Creating it ..."
        if ! docker create \
            -v "${VOLUME_DATA}" \
            -v "${VOLUME_CONFIG}" \
            --restart unless-stopped \
            --log-driver json-file \
            --log-opt max-size=30m \
            --log-opt max-file=3 \
            --name "${INTEGRATION_NAME_IOC}" \
            "${IMG}" bash run_ioc; then
            error "Failed to create IOC integration."
            return 1
        fi
    else
        warn "Integration '${INTEGRATION_NAME_IOC}' already exists. Skipping its creation."
    fi
    if docker start "${INTEGRATION_NAME_IOC}"; then
        success "IOC integration started."; sleep 5
    else
        error "Failed to start IOC integration."; return 1
    fi

    info "Setting up main integration '${INTEGRATION_NAME}' ..."
    if ! docker container inspect "${INTEGRATION_NAME}" &>/dev/null; then
        info "Integration '${INTEGRATION_NAME}' does not exist. Creating ..."
        if ! docker create \
            -v "${VOLUME_DATA}" \
            -v "${VOLUME_CONFIG}" \
            -v "${VOLUME_IOC}" \
            --restart unless-stopped \
            --log-driver json-file \
            --log-opt max-size=30m \
            --log-opt max-file=3 \
            --name "${INTEGRATION_NAME}" \
            "${IMG}" bash run_component; then
            error "Failed to create main integration."; return 1
        fi
    else
        warn "Integration '${INTEGRATION_NAME}' already exists. Skipping create."
    fi
    if docker start "${INTEGRATION_NAME}"; then
        success "Main integration started."
    else
        error "Failed to start main integration."; return 1
    fi
}

check_status() {
    info "Checking status of integrations ..."
    if [[ ! -f "${INTEGRATION_DIR}/data/.status.ndjson" ]]; then
        error "Status check failed. Verify if your integration has been deployed."; return 1
    fi
    if docker run --rm -it -v "${VOLUME_DATA}":ro "${IMG}" bash run_status; then
        success "Status check completed."
    else
        error "Status check failed."; return 1
    fi
}

show_logs() {
    echo ""
    prompt "Select which logs to view:"
    echo -e "  ${CYAN}1${RESET}) IOC integration  (${INTEGRATION_NAME_IOC})"
    echo -e "  ${CYAN}2${RESET}) Main integration  (${INTEGRATION_NAME})"
    echo ""
    read -rp "$(prompt 'Enter option [1/2]: ')" choice
    case "${choice}" in
        1)
            info "Showing logs for '${INTEGRATION_NAME_IOC}' ..."
            docker logs --tail 100 -f "${INTEGRATION_NAME_IOC}"
            ;;
        2)
            info "Showing logs for '${INTEGRATION_NAME}' ..."
            docker logs --tail 100 -f "${INTEGRATION_NAME}"
            ;;
        *)
            error "Invalid option '${choice}'."
            return 1
            ;;
    esac
}

usage() {
    echo ""
    prompt "   HARMONY EMAIL SECURITY RESPONSE INTEGRATION MANAGEMENT"
    echo -e "  ${BOLD}Usage:${RESET} $0 <command>"
    echo ""
    echo -e "  ${CYAN}config${RESET}   Run configuration"
    echo -e "  ${CYAN}start${RESET}    Start integration"
    echo -e "  ${CYAN}status${RESET}   Check integration status"
    echo -e "  ${CYAN}logs${RESET}     Show integration logs"
    echo ""
}

case "${1}" in
    config) run_config ;;
    start)  start_integration ;;
    status) check_status ;;
    logs)   show_logs ;;
    *)      usage
            [[ -n "${1}" ]] && error "Unknown command '${1}'."
            exit 1 ;;
esac
⁠2. Configure and Run

Execute the following commands in order using the script created above:

  1. Run Configuration: Follow the wizard prompts to input your Lumu and Harmony Email credentials.
    Bash
bash manage.sh config
  1. Start Integration: This deploys the integration.
bash manage.sh start
  1. Verify Status: Ensure everything is running correctly.
bash manage.sh status
  1. Check logs: Collect the integration logs.
bash manage.sh logs

⁠General Recommendations

Follow these recommendations to ensure the integration works correctly:

  • The integration between Lumu and Harmony Email Security is carried out using the Anti-Phishing Block-List.
  • Harmony Email Security integration caps the Anti-Phishing Block-List at 1,000 entries. Lumu ensures these 1,000 slots are always filled with the most recent and active IoCs.
  • The Anti-Phishing Block-List is actively used and updated by this integration; therefore, it must not be modified manually while managed by this integration.
  • Do not stop the integration. Stopping it will stop the synchronization process.
  • The integration operates with Docker. Ensure your Docker daemon works properly.

⁠Find out more about us

Tag summary

Content type

Image

Digest

sha256:3d89e5b24…

Size

84.8 MB

Last updated

1 day ago

docker pull lumutools/harmony-email-threat-feeder