Enclave Inbox

Updated 1 month ago by TruSTAR

This document explains how to use the Enclave Inbox feature to submit incident and alert information directly to your Enclaves using email. Emails sent to this inbox are processed and then submitted to the Enclave every minute.

Related Links:

Use Cases

  1. You belong to a listserv where observables are exchanged regularly. This provides valuable context, but there is no easy way to extract and operationalize this intelligence. 
  2. You have automated alerts setup on your SIEM or case management system and want to automatically submit the details of an alert or case as an Intel Report to a TruSTAR Enclave.
  3. You can forward emails that you suspect to be phishing attempts and TruSTAR will store the email as an Intel Report in your Enclave and identify any observables in that email.
  4. You can forward emails into your shared Enclave and use the Redaction Library to remove any sensitive information.

How It Works

TruSTAR creates an email handle for a given company. For example, Acme Company would be assigned the email acmeco@trustar.co. Any emails sent to this email address are then added to that user’s Enclave with the subject line becoming the title of the new Intel Report and the date and report content populated within that Report.

Setting Up an Enclave Inbox

You must be a company admin to configure the Enclave Inbox feature.
  1. Log in to the TruSTAR Web App.
  2. Click navigate to User Settings on the Navigation Bar, then choose Settings from the dropdown menu.
  3. Click Enclave inbox on the Settings menu.
  4. Click the + sign on the far right vertical menu to start the configuration.
  5. Choose the Enclave you want to submit emails to.
  6. Note the Desired Email Handle. This field is automatically generated and end in @enclave.trustar.co. You will use this email address as the recipient for all mail you are sending to the enclave.
  7. Add text into the Accepted Email Subject Prefixes text box and press Enter after each entry. Using this field ensures that only emails with the specified prefixes will be processed and added to the Enclave.
  • Text must be enclosed in square brackets; for example, if you want to process emails with [ACME] in the subject line, you must enter [ACME] in this text box.
  • Each entry must be at least 3 characters long, including the square brackets.
  • You can specify multiple prefixes. An email with any of the prefixes will be processed.
  1. Specify Accepted Sender Emails, if desired. Press Enter after each email address to add it to the list. Restricting who can send or forward emails to this Enclave increases security.
  • You can use wildcards to accept emails sent from a common domain. For example, @acme.com will accept all senders that end with the domain @acme.com.
  1. Click Send to submit the new configuration.

After the request is complete, you will receive a notification that the Enclave inbox has been set up. The enclave email inbox can take up to 2 minutes to become operational. 

As with all other submissions, Observables are automatically extracted and correlated.

Updating the Enclave Inbox

  1. Log in to the TruSTAR Web App.
  2. Navigate to User Settings on the Navigation Bar, then choose Settings from the dropdown menu.
  3. Click Enclave inbox on the Settings menu.
  4. Select the inbox configuration you need to update and click the Pencil icon on the right vertical menu.
  5. Edit the Email Subject Prefix and Sender Email fields as needed. Remember to press Enter after each new entry to commit it to the list.
  6. Click Save when you have finished editing the information.

Deleting an Enclave Inbox

  1. Log in to the TruSTAR Web App.
  2. Navigate to User Settings on the Navigation Bar, then choose Settings from the dropdown menu.
  3. Click Enclave inbox on the Settings menu.
  4. Select the inbox configuration you want to delete and click the Trashcan icon on the right vertical menu.
  5. Click Delete on the confirmation popup. (Note: this does not delete the Enclave, it only deletes the email inbox for that Enclave.)

Sending Email Submissions

After the inbox for the Enclave has been set up, you can send emails to the new address to submit items to the Enclave.

To be processed correctly, the emails you send need to match the email inbox configuration.

  • From field: If you specified Accepted Senders, the email must be from one of these addresses.
  • Subject field: If you specified prefixes, the email must contain one or more of those prefixes, including the square brackets enclosing the text. Each prefix must be contained in a separate set of square brackets. For example, [ACME] [SPAM]
    • The Subject text, including any prefixes will be used as the Report Title for the submission.

Adding Tags to Emails

You can associate tags with your email submission using either of the following methods:

  1. Specify Enclave tags in the subject line. These tags must be specified as a comma-separated list within { } brackets for submission to be tagged; for example {spam,malware,highpriority}
  2. Specify Enclave tags as the first line in the body of the email. The tags must be specified as a comma-separated list within { } brackets for submission to be tagged; for example {spam,malware,highpriority}
Note that Enclave tags added to the first line in the body of the email will not appear if submitted in HTML format

Email Body

The body of the email is submitted as an Intel Report. If there are any observables in the email body, they are automatically extracted and correlated.

Attachments

If your email has an attachment in PDF, Word, Text file, CSV, Excel, .eml, .msg, or JSON, TruSTAR automatically appends the content of that attachment to the report body and extracts any observables from that content. This processing may remove the formatting of the attachment.

Redacting Submitted Emails

You can choose redact information from submitted emails using your organization's Redaction Library.

To toggle email redaction for a specific Enclave:

  1. Go to the Enclave Inbox tab in Profile SettingsT
  2. Toggle on the Redaction option for the Enclave Inbox configuration. Note that it will take up to two minutes for the changes to reflect.
This feature is only available for Enclaves that you own. Email redaction for shared Enclaves can only be requested by the TruSTAR administrator who created the Enclave Inbox for that Enclave.

Sample Email

This is an example of an email processed by TruSTAR and submitted to the specified Enclave.

FAQ

Q: Why aren't my emails appearing in my Enclave? (TROUBLESHOOTING)
  • Check your Enclave inbox configuration and ensure that the email message being sent to the inbox complies with the configured accepted sender and accepted prefix (optional).
  • Try sending a "test" email (subj: "test", body: "test") to the email address. If it successfully ends up in your enclave, then something about your emails that are not successfully landing in the enclave is causing them to not successfully land in the enclave.
  • Check that the email you are forwarding to the inbox complies with TruSTAR's report submission limits. You can find those limits here.
  • Confirm in your email server logs that the emails are being successfully delivered to the enclave inbox email address. Depending on the settings, adding the domain @enclave.trustar.co to the list of approved senders may resolve emails that are being blocked when forwarding to the enclave inbox handle.
  • Have an image in your submission? This image data can be causing TruSTAR's observable-extraction engine to time-out. Remove images from the email, including images that are part of your signature block.
  • De-configure your enclave inbox (see section "Deleting an Enclave Inbox" above) and configure a new enclave inbox for that enclave.
  • If the issue persists, please contact your account executive or support@trustar.co.
Q: Why aren't URL's being decoded after submitting into TruSTAR?
  • TruSTAR does not decode URLs submitted to the TruSTAR platform from third party tools that have been encoded. Users who would like to leverage TruSTARs platform capabilities for phishing triage and indicator correlation will need to have their URLs decoded before submitting them to TruSTAR. Please reach out the vendor's support team for help on decoding URL's so it can be useful in TruSTAR
Q: How can I update a report using the Enclave Inbox feature?
  • A report can be updated via Enclave Inbox if a response is threaded to the original email submitted into your Enclave. This is validated by the 'Message-ID' of the initial email of the thread that needs to be populated in the "In-Reply-To" header field. If the 'Message-ID' of the threaded response is different it will be submitted as a new report instead.

How Did We Do?