You can configure the CM Dashboard to monitor email alerts from Email Security — Cloud.
Firewall Considerations:
The protocol is Web Socket over TLS using port 443.
The destination URLs are us1.fireeyecloud.com and us2.fireeyecloud.com. These are both needed and backup each other up.
Note
The CM has a 1-hour idle connection timeout and therefore will disconnect from Email Security — Cloud occasionally.
Enabling the Email Security - Cloud endpoint using the CLI
The Email Security — Cloud endpoint has to be enabled before the CM Series appliance can monitor alerts from Email Security — Cloud. The following are the CLI provisioning commands to enter from the CLI. You will be creating two Email Security — Cloud/CCS entries; one is the backup and based on the order of entry. The name you define has local significance so you can use whatever you like as long as it is consistent.
To enable the Email Security — Cloud endpoint:
Go to CLI configuration mode:
cm-1 > enable cm-1 # configure terminal
Specify the endpoint name and access point:
cm-1 (config) # cloud etp endpoint <etp-endpoint-name> uri <access point to CCS>
If you do not have DTI settings configured, use the following command:
cm-1 (config) # cloud etp endpoint <etp-endpoint-name> username <fenet_username> password <fenet_password>
Enable the endpoint:
cm-1 (config) # cloud etp endpoint <etp-endpoint-name> enable
Write to memory:
cm-1 (config) # wr enable
Verify the configuration:
cm-1 (config) # show cloud etp status Endpoint: etp-integration1: Address: wss://us1.fireeyecloud.com:443 Enabled: yes JobWorker Connected: yes NotifHandler Connected: yes
To show the configured Email Security — Cloud instances:
cm-1 (config) # show cloud etp configurationSend an "Email Security - Cloud-to-CM Integration Provisioning Request" to the Trellix Technical Support and Email Security — Cloud Provisioning organizations.
To remove the Email Security — Cloud instance and all its associated objects and alerts:
cm-1 (config) # no cloud etp endpoint <etp-endpoint-name>
Note
The following are the URI links for customers on the US Email Security — Cloud Instance:
uri wss://us1.fireeyecloud.com
uri wss://us2.fireeyecloud.com
The following are the URI links for customers on the EMEA Email Security — Cloud Instance:
uri wss://emea1.fireeyecloud.com
uri wss://emea2.fireeyecloud.com
The following is the URI link for customers on the APJ Email Security — Cloud Instance:
uri wss://ap1.fireeyecloud.com
The following is the URI link for customers on the US Government Email Security — Cloud Instance:
uri wss://us1.fireeyegov.com
Email Security — Cloud aggregation
An aggregator process receives data from Email Security — Cloud and aggregates it into the CM Series appliance database for display on the CM Series appliance Web UI.
To display the configuration of the aggregator:
cm-1 (config) # show aggregator configuration
To display the configuration of the aggregator endpoints:
cm-1 (config) # show aggregator endpoints configuration
Solving connection issues
The following commands are used when solving connection issues and should only be used when asked to do so by Trellix Support.
To enable/disable SSL certification verification in the aggregator:
cm-1 (config) # [no] aggregator ssl cert-verify
To set the aggregator log level:
cm-1 (config) # aggregator consumer logging level [debug|info|notice|warning|error]
To set the SSL cipher list to use with the WebSocket connection:
cm-1 (config) # aggregator ssl cipher-list *
To set the minimum TLS version to use with the WebSocket connection:
cm-1 (config) # aggregator ssl min-version
Viewing email alerts from Email Security - Cloud in the web UI
On the CM Series appliance Dashboard you can select Email Security — Cloud from the All Groups menu or an Email Security — Cloud instance from the All Appliances menu.
For the selected groups and instances, you can view:
Total malicious emails
Malicious URLs
Malicious attachments
Email Security — Cloud alerts
You can view email alerts on the CMS Dashboard by going to the Alerts tab and selecting one of the categories displayed under What's Happening.
Note that Email Security - Cloud instances are not listed on the Appliances tab. You can view detailed status of the Email Security — Cloud instance's connection by selecting an instance from the All Appliances dropdown to view the Summary.