Enclave Inbox

Updated 7 months ago by TruSTAR

This document explains how to use the Enclave Inbox feature to submit incident and alert information directly to your Enclaves using email. Emails sent to this inbox are processed and then submitted to the Enclave every minute.

Related Links:

Use Cases

Intelligence

  • You belong to an email thread / group that exchanges observables over email.
  • Send the emails to TruSTAR, let TruSTAR identify the observables in the email.
  • Optional: connect detection tool to your email enclave to make detection tool download observables TruSTAR finds in the emails.

Phishing Enrichment

  • forward suspected phishing emails to TruSTAR.
  • TruSTAR identifies observables in the email.
  • TruSTAR enriches the observables it finds with intelligence from your intel sources.
  • Your submissions will populate TruSTAR's Phishing Triage UI where you can review them, their scores, and mark whether or not they are a phish attempt.

Event Enrichment

  • forward SIEM alerts or case management system cases to enclave via email.
  • TruSTAR identifies observables in the alert / case.
  • TruSTAR enriches the observables with intel from your intel sources.
  • Use the enrichment to help investigate the case / alert.

How It Works.

TruSTAR creates an email handle for a given company. For example, Acme Company would be assigned the email acmeco@trustar.co. Any emails sent to this email address are then added to that user’s Enclave with the subject line becoming the title of the new Intel Report and the date and report content populated within that Report.

Requirements.

TLS

  • The network device (email server, email gateway, or firewall) that communicates with TruSTAR's email server must do so using TLS 1.2.
  • TruSTAR's email server requires incoming connections to use TLS 1.2.

Email byte-size

  • emails are read from email inbox and submitted into enclave as a TruSTAR Report.
  • Reports have a max byte-size, and the max is found here.
  • Any email and its attachments must adhere to this max size.

# observables

  • There is a limit to the quantity of observables an email and its attachments can contain.
  • That limit is found here.
  • Best practice: to the extent possible / reasonable / feasible, ensure any email and its attachments when combined together do not exceed more than 50% of the limit.

no images

  • emails cannot have image files attached.
  • TruSTAR does not ingest them.
  • They cause problems with TruSTAR's ingestion service.
  • caution: signature blocks sometimes contain images that cause email ingestion failures.

Setting Up an Enclave Inbox

You must be a company admin to configure the Enclave Inbox feature.
  1. Log in to the TruSTAR Web App.
  2. Click navigate to User Settings on the Navigation Bar, then choose Settings from the dropdown menu.
  3. Click Enclave inbox on the Settings menu.
  4. Click the + sign on the far right vertical menu to start the configuration.
  5. Choose the Enclave you want to submit emails to.
  6. Note the Desired Email Handle. This field is automatically generated and end in @enclave.trustar.co. You will use this email address as the recipient for all mail you are sending to the enclave.
  7. Add text into the Accepted Email Subject Prefixes text box and press Enter after each entry. Using this field ensures that only emails with the specified prefixes will be processed and added to the Enclave.
  • Text must be enclosed in square brackets; for example, if you want to process emails with [ACME] in the subject line, you must enter [ACME] in this text box.
  • Each entry must be at least 3 characters long, including the square brackets.
  • You can specify multiple prefixes. An email with any of the prefixes will be processed.
  1. Specify Accepted Sender Emails, if desired. Press Enter after each email address to add it to the list. Restricting who can send or forward emails to this Enclave increases security.
  • You can use wildcards to accept emails sent from a common domain. For example, @acme.com will accept all senders that end with the domain @acme.com.
  1. Click Send to submit the new configuration.

After the request is complete, you will receive a notification that the Enclave inbox has been set up. The enclave email inbox can take up to 2 minutes to become operational. 

As with all other submissions, Observables are automatically extracted and correlated.

Updating the Enclave Inbox

  1. Log in to the TruSTAR Web App.
  2. Navigate to User Settings on the Navigation Bar, then choose Settings from the dropdown menu.
  3. Click Enclave inbox on the Settings menu.
  4. Select the inbox configuration you need to update and click the Pencil icon on the right vertical menu.
  5. Edit the Email Subject Prefix and Sender Email fields as needed. Remember to press Enter after each new entry to commit it to the list.
  6. Click Save when you have finished editing the information.

Deleting an Enclave Inbox

  1. Log in to the TruSTAR Web App.
  2. Navigate to User Settings on the Navigation Bar, then choose Settings from the dropdown menu.
  3. Click Enclave inbox on the Settings menu.
  4. Select the inbox configuration you want to delete and click the Trashcan icon on the right vertical menu.
  5. Click Delete on the confirmation popup. (Note: this does not delete the Enclave, it only deletes the email inbox for that Enclave.)

Sending Email Submissions

After the inbox for the Enclave has been set up, you can send emails to the new address to submit items to the Enclave.

To be processed correctly, the emails you send need to match the email inbox configuration.

  • From field: If you specified Accepted Senders, the email must be from one of these addresses.
  • Subject field: If you specified prefixes, the email must contain one or more of those prefixes, including the square brackets enclosing the text. Each prefix must be contained in a separate set of square brackets. For example, [ACME] [SPAM]
    • The Subject text, including any prefixes will be used as the Report Title for the submission.

Adding Tags to Emails

You can associate tags with your email submission using either of the following methods:

  1. Specify Enclave tags in the subject line. These tags must be specified as a comma-separated list within { } brackets for submission to be tagged; for example {spam,malware,highpriority}
  2. Specify Enclave tags as the first line in the body of the email. The tags must be specified as a comma-separated list within { } brackets for submission to be tagged; for example {spam,malware,highpriority}
Note that Enclave tags added to the first line in the body of the email will not appear if submitted in HTML format

Email Body

The body of the email is submitted as an Intel Report. If there are any observables in the email body, they are automatically extracted and correlated.

Attachments

If your email has an attachment in PDF, Word, Text file, CSV, Excel, .eml, .msg, or JSON, TruSTAR automatically appends the content of that attachment to the report body and extracts any observables from that content. This processing may remove the formatting of the attachment.

Redacting Submitted Emails

You can choose redact information from submitted emails using your organization's Redaction Library.

To toggle email redaction for a specific Enclave:

  1. Go to the Enclave Inbox tab in Profile SettingsT
  2. Toggle on the Redaction option for the Enclave Inbox configuration. Note that it will take up to two minutes for the changes to reflect.
This feature is only available for Enclaves that you own. Email redaction for shared Enclaves can only be requested by the TruSTAR administrator who created the Enclave Inbox for that Enclave.

Sample Email

This is an example of an email processed by TruSTAR and submitted to the specified Enclave.

FAQ

Q: Why aren't my emails appearing in my Enclave? (TROUBLESHOOTING)
  • Check your Enclave inbox configuration and ensure that the email message being sent to the inbox complies with the configured accepted sender and accepted prefix (optional).
  • Try sending a "test" email (subj: "test", body: "test") to the email address. If it successfully ends up in your enclave, then something about your emails that are not successfully landing in the enclave is causing them to not successfully land in the enclave.
  • Check that the email you are forwarding to the inbox complies with TruSTAR's report submission limits. You can find those limits here.
  • Confirm in your email server logs that the emails are being successfully delivered to the enclave inbox email address. Depending on the settings, adding the domain @enclave.trustar.co to the list of approved senders may resolve emails that are being blocked when forwarding to the enclave inbox handle.
  • Have an image in your submission? This image data can be causing TruSTAR's observable-extraction engine to time-out. Remove images from the email, including images that are part of your signature block.
  • De-configure your enclave inbox (see section "Deleting an Enclave Inbox" above) and configure a new enclave inbox for that enclave.
  • If the issue persists, please contact your account executive or support@trustar.co.
Q: Why aren't URL's being decoded after submitting into TruSTAR?
  • TruSTAR does not decode URLs submitted to the TruSTAR platform from third party tools that have been encoded. Users who would like to leverage TruSTARs platform capabilities for phishing triage and indicator correlation will need to have their URLs decoded before submitting them to TruSTAR. Please reach out the vendor's support team for help on decoding URL's so it can be useful in TruSTAR
Q: How can I update a report using the Enclave Inbox feature?
  • A report can be updated via Enclave Inbox if a response is threaded to the original email submitted into your Enclave. This is validated by the 'Message-ID' of the initial email of the thread that needs to be populated in the "In-Reply-To" header field. If the 'Message-ID' of the threaded response is different it will be submitted as a new report instead.

How Did We Do?