Lumu Defender offers a framework to help you leverage Lumu's integrations with your existing cybersecurity stack, including Security Information and Event Management (SIEM), Security Orchestration, Automation, and Response (SOAR), Endpoint Detection and Response (EDR), incident response systems, and more.
The integration between Harmony Email Security and Lumu leverages the Anti-Phishing Block-List feature. It is a security control that allows administrators to block specific domains, URLS, or MD5 attachments that pose a known threat to the organization. When an incoming email matches an entry on this list, the system instantly flags the email as Phishing or Spam, routing it directly to quarantine based on your organization's workflow policies. This tool provides an immediate line of defense to stop recurring malicious traffic, improving your organization's detection and response capabilities.
To ensure a successful deployment and avoid configuration conflicts, please follow these guidelines:
manage.sh), which is the only recommended method to configure, start, and monitor this integration.Before proceeding, ensure you have:
defender.lumu.io and Harmony Email Security API.The following steps only describe the deployment process; refer to the official documentation to ensure all system prerequisites and configuration requirements are met.
Create a file named manage.sh on your integration host and paste the following snippet:
#!/usr/bin/env bash
RED='\033[0;31m'
GREEN='\033[0;32m'
CYAN='\033[0;36m'
YELLOW='\033[1;33m'
BOLD='\033[1m'
RESET='\033[0m'
info() { echo -e "${CYAN}[INFO]${RESET} $*"; }
success() { echo -e "${GREEN}[OK]${RESET} $*"; }
warn() { echo -e "${YELLOW}[WARN]${RESET} $*"; }
error() { echo -e "${RED}[ERROR]${RESET} $*" >&2; }
prompt() { echo -e "${BOLD}${YELLOW}$*${RESET}"; }
IMG=lumutools/harmony-email-threat-feeder:latest
INTEGRATION_NAME=harmony-email-threat-feeder
INTEGRATION_NAME_IOC=harmony-email-threat-feeder-ioc
INTEGRATION_DIR=${HOME}/HarmonyEmailResponse
VOLUME_DATA=${INTEGRATION_DIR}/data:/app/data
VOLUME_CONFIG=${INTEGRATION_DIR}/data/.config.toml:/app/.config.toml:ro
VOLUME_IOC=${INTEGRATION_DIR}/data/ioc.db:/app/data/ioc.db:ro
mkdir -p "${INTEGRATION_DIR}/data"
chmod -R o+w "${INTEGRATION_DIR}/data" > /dev/null 2>&1
run_config() {
info "Running configuration script ..."
if docker run --rm -it -v "${INTEGRATION_DIR}/data:/app/data" "${IMG}" bash run_config; then
success "Configuration completed."
else
error "Configuration script failed."; return 1
fi
}
start_integration() {
info "Setting up IOC integration '${INTEGRATION_NAME_IOC}' ..."
if [[ ! -f "${INTEGRATION_DIR}/data/.config.toml" ]]; then
error "Please configure the integration first."; return 1
fi
if ! docker container inspect "${INTEGRATION_NAME_IOC}" &>/dev/null; then
info "Integration '${INTEGRATION_NAME_IOC}' does not exist. Creating it ..."
if ! docker create \
-v "${VOLUME_DATA}" \
-v "${VOLUME_CONFIG}" \
--restart unless-stopped \
--log-driver json-file \
--log-opt max-size=30m \
--log-opt max-file=3 \
--name "${INTEGRATION_NAME_IOC}" \
"${IMG}" bash run_ioc; then
error "Failed to create IOC integration."
return 1
fi
else
warn "Integration '${INTEGRATION_NAME_IOC}' already exists. Skipping its creation."
fi
if docker start "${INTEGRATION_NAME_IOC}"; then
success "IOC integration started."; sleep 5
else
error "Failed to start IOC integration."; return 1
fi
info "Setting up main integration '${INTEGRATION_NAME}' ..."
if ! docker container inspect "${INTEGRATION_NAME}" &>/dev/null; then
info "Integration '${INTEGRATION_NAME}' does not exist. Creating ..."
if ! docker create \
-v "${VOLUME_DATA}" \
-v "${VOLUME_CONFIG}" \
-v "${VOLUME_IOC}" \
--restart unless-stopped \
--log-driver json-file \
--log-opt max-size=30m \
--log-opt max-file=3 \
--name "${INTEGRATION_NAME}" \
"${IMG}" bash run_component; then
error "Failed to create main integration."; return 1
fi
else
warn "Integration '${INTEGRATION_NAME}' already exists. Skipping create."
fi
if docker start "${INTEGRATION_NAME}"; then
success "Main integration started."
else
error "Failed to start main integration."; return 1
fi
}
check_status() {
info "Checking status of integrations ..."
if [[ ! -f "${INTEGRATION_DIR}/data/.status.ndjson" ]]; then
error "Status check failed. Verify if your integration has been deployed."; return 1
fi
if docker run --rm -it -v "${VOLUME_DATA}":ro "${IMG}" bash run_status; then
success "Status check completed."
else
error "Status check failed."; return 1
fi
}
show_logs() {
echo ""
prompt "Select which logs to view:"
echo -e " ${CYAN}1${RESET}) IOC integration (${INTEGRATION_NAME_IOC})"
echo -e " ${CYAN}2${RESET}) Main integration (${INTEGRATION_NAME})"
echo ""
read -rp "$(prompt 'Enter option [1/2]: ')" choice
case "${choice}" in
1)
info "Showing logs for '${INTEGRATION_NAME_IOC}' ..."
docker logs --tail 100 -f "${INTEGRATION_NAME_IOC}"
;;
2)
info "Showing logs for '${INTEGRATION_NAME}' ..."
docker logs --tail 100 -f "${INTEGRATION_NAME}"
;;
*)
error "Invalid option '${choice}'."
return 1
;;
esac
}
usage() {
echo ""
prompt " HARMONY EMAIL SECURITY RESPONSE INTEGRATION MANAGEMENT"
echo -e " ${BOLD}Usage:${RESET} $0 <command>"
echo ""
echo -e " ${CYAN}config${RESET} Run configuration"
echo -e " ${CYAN}start${RESET} Start integration"
echo -e " ${CYAN}status${RESET} Check integration status"
echo -e " ${CYAN}logs${RESET} Show integration logs"
echo ""
}
case "${1}" in
config) run_config ;;
start) start_integration ;;
status) check_status ;;
logs) show_logs ;;
*) usage
[[ -n "${1}" ]] && error "Unknown command '${1}'."
exit 1 ;;
esac
Execute the following commands in order using the script created above:
bash manage.sh config
bash manage.sh start
bash manage.sh status
bash manage.sh logs
Follow these recommendations to ensure the integration works correctly:
Content type
Image
Digest
sha256:3d89e5b24…
Size
84.8 MB
Last updated
1 day ago
docker pull lumutools/harmony-email-threat-feeder