Enclave Inbox
This document explains how to use the Enclave Inbox feature to submit incident and alert information directly to your Enclaves using email. Emails sent to this inbox are processed and then submitted to the Enclave every minute.
Related Links:
Use Cases
Intelligence |
|
Phishing Enrichment |
|
Event Enrichment |
|
How It Works.
TruSTAR creates an email handle for a given company. For example, Acme Company would be assigned the email acmeco@trustar.co. Any emails sent to this email address are then added to that user’s Enclave with the subject line becoming the title of the new Intel Report and the date and report content populated within that Report.
Requirements.
TLS |
|
Email byte-size |
|
# observables |
|
no images |
|
Setting Up an Enclave Inbox
- Log in to the TruSTAR Web App.
- Click navigate to User Settings on the Navigation Bar, then choose Settings from the dropdown menu.
- Click Enclave inbox on the Settings menu.
- Click the + sign on the far right vertical menu to start the configuration.
- Choose the Enclave you want to submit emails to.
- Note the Desired Email Handle. This field is automatically generated and end in @enclave.trustar.co. You will use this email address as the recipient for all mail you are sending to the enclave.
- Add text into the Accepted Email Subject Prefixes text box and press Enter after each entry. Using this field ensures that only emails with the specified prefixes will be processed and added to the Enclave.
- Text must be enclosed in square brackets; for example, if you want to process emails with [ACME] in the subject line, you must enter [ACME] in this text box.
- Each entry must be at least 3 characters long, including the square brackets.
- You can specify multiple prefixes. An email with any of the prefixes will be processed.
- Specify Accepted Sender Emails, if desired. Press Enter after each email address to add it to the list. Restricting who can send or forward emails to this Enclave increases security.
- You can use wildcards to accept emails sent from a common domain. For example, @acme.com will accept all senders that end with the domain @acme.com.
- Click Send to submit the new configuration.
After the request is complete, you will receive a notification that the Enclave inbox has been set up. The enclave email inbox can take up to 2 minutes to become operational.
Updating the Enclave Inbox
- Log in to the TruSTAR Web App.
- Navigate to User Settings on the Navigation Bar, then choose Settings from the dropdown menu.
- Click Enclave inbox on the Settings menu.
- Select the inbox configuration you need to update and click the Pencil icon on the right vertical menu.
- Edit the Email Subject Prefix and Sender Email fields as needed. Remember to press Enter after each new entry to commit it to the list.
- Click Save when you have finished editing the information.
Deleting an Enclave Inbox
- Log in to the TruSTAR Web App.
- Navigate to User Settings on the Navigation Bar, then choose Settings from the dropdown menu.
- Click Enclave inbox on the Settings menu.
- Select the inbox configuration you want to delete and click the Trashcan icon on the right vertical menu.
- Click Delete on the confirmation popup. (Note: this does not delete the Enclave, it only deletes the email inbox for that Enclave.)
Sending Email Submissions
After the inbox for the Enclave has been set up, you can send emails to the new address to submit items to the Enclave.
To be processed correctly, the emails you send need to match the email inbox configuration.
- From field: If you specified Accepted Senders, the email must be from one of these addresses.
- Subject field: If you specified prefixes, the email must contain one or more of those prefixes, including the square brackets enclosing the text. Each prefix must be contained in a separate set of square brackets. For example, [ACME] [SPAM]
- The Subject text, including any prefixes will be used as the Report Title for the submission.
Adding Tags to Emails
You can associate tags with your email submission using either of the following methods:
- Specify Enclave tags in the subject line. These tags must be specified as a comma-separated list within { } brackets for submission to be tagged; for example {spam,malware,highpriority}
- Specify Enclave tags as the first line in the body of the email. The tags must be specified as a comma-separated list within { } brackets for submission to be tagged; for example {spam,malware,highpriority}
Email Body
The body of the email is submitted as an Intel Report. If there are any observables in the email body, they are automatically extracted and correlated.
Attachments
If your email has an attachment in PDF, Word, Text file, CSV, Excel, .eml, .msg, or JSON, TruSTAR automatically appends the content of that attachment to the report body and extracts any observables from that content. This processing may remove the formatting of the attachment.
Redacting Submitted Emails
You can choose redact information from submitted emails using your organization's Redaction Library.
To toggle email redaction for a specific Enclave:
- Go to the Enclave Inbox tab in Profile SettingsT
- Toggle on the Redaction option for the Enclave Inbox configuration. Note that it will take up to two minutes for the changes to reflect.
Sample Email
This is an example of an email processed by TruSTAR and submitted to the specified Enclave.

FAQ
Q: Why aren't my emails appearing in my Enclave? (TROUBLESHOOTING)
- Check your Enclave inbox configuration and ensure that the email message being sent to the inbox complies with the configured accepted sender and accepted prefix (optional).
- Try sending a "test" email (subj: "test", body: "test") to the email address. If it successfully ends up in your enclave, then something about your emails that are not successfully landing in the enclave is causing them to not successfully land in the enclave.
- Check that the email you are forwarding to the inbox complies with TruSTAR's report submission limits. You can find those limits here.
- Confirm in your email server logs that the emails are being successfully delivered to the enclave inbox email address. Depending on the settings, adding the domain @enclave.trustar.co to the list of approved senders may resolve emails that are being blocked when forwarding to the enclave inbox handle.
- Have an image in your submission? This image data can be causing TruSTAR's observable-extraction engine to time-out. Remove images from the email, including images that are part of your signature block.
- De-configure your enclave inbox (see section "Deleting an Enclave Inbox" above) and configure a new enclave inbox for that enclave.
- If the issue persists, please contact your account executive or support@trustar.co.
Q: Why aren't URL's being decoded after submitting into TruSTAR?
- TruSTAR does not decode URLs submitted to the TruSTAR platform from third party tools that have been encoded. Users who would like to leverage TruSTARs platform capabilities for phishing triage and indicator correlation will need to have their URLs decoded before submitting them to TruSTAR. Please reach out the vendor's support team for help on decoding URL's so it can be useful in TruSTAR
Q: How can I update a report using the Enclave Inbox feature?
- A report can be updated via Enclave Inbox if a response is threaded to the original email submitted into your Enclave. This is validated by the 'Message-ID' of the initial email of the thread that needs to be populated in the "In-Reply-To" header field. If the 'Message-ID' of the threaded response is different it will be submitted as a new report instead.