PAPP-35194 delete email action

splunk-soar-connectors · Dec 16, 2024 · 9881464 · 9881464
1 parent 64921b8
commit 9881464
Show file tree

Hide file tree

Showing 3 changed files with 93 additions and 1 deletion.
diff --git a/ciscosma.json b/ciscosma.json
@@ -341,6 +341,53 @@
             ],
             "versions": "EQ(*)"
         },
+        {
+            "action": "delete email",
+            "identifier": "delete_email",
+            "description": "Delete a quarantined email message",
+            "type": "generic",
+            "read_only": false,
+            "parameters": {
+                "message_id": {
+                    "description": "Message ID (mid) to delete",
+                    "data_type": "string",
+                    "required": true,
+                    "order": 0,
+                    "contains": ["cisco sma message id"]
+                }
+            },
+            "output": [
+                {
+                    "data_path": "action_result.status",
+                    "data_type": "string"
+                },
+                {
+                    "data_path": "action_result.parameter.message_id",
+                    "data_type": "string"
+                },
+                {
+                    "data_path": "action_result.data.*.action",
+                    "data_type": "string"
+                },
+                {
+                    "data_path": "action_result.data.*.totalCount",
+                    "data_type": "numeric"
+                },
+                {
+                    "data_path": "action_result.summary.total_deleted",
+                    "data_type": "numeric"
+                },
+                {
+                    "data_path": "action_result.summary.action",
+                    "data_type": "string"
+                },
+                {
+                    "data_path": "action_result.message",
+                    "data_type": "string"
+                }
+            ],
+            "versions": "EQ(*)"
+        },
         {
             "action": "search tracking messages",
             "identifier": "search_tracking_messages",

diff --git a/ciscosma_connector.py b/ciscosma_connector.py
@@ -27,6 +27,7 @@
     CISCOSMA_GET_MESSAGE_TRACKING_DETAILS_ENDPOINT,
     CISCOSMA_GET_TOKEN_ENDPOINT,
     CISCOSMA_RELEASE_MESSAGES_ENDPOINT,
+    CISCOSMA_DELETE_MESSAGES_ENDPOINT,
     CISCOSMA_SEARCH_MESSAGES_ENDPOINT,
     CISCOSMA_SEARCH_TRACKING_MESSAGES_ENDPOINT,
     CISCOSMA_VALID_FILTER_OPERATORS,
@@ -285,6 +286,49 @@ def _handle_release_email(self, param):
 
         return action_result.set_status(phantom.APP_SUCCESS, "Successfully released message")
 
+    def _handle_delete_email(self, param):
+        action_result = self.add_action_result(ActionResult(dict(param)))
+
+        message_id = param.get("message_id")
+        if not message_id:
+            return action_result.set_status(phantom.APP_ERROR, "Parameter 'message_id' is required")
+
+        # TODO: Replace with validator function
+        try:
+            message_id = int(message_id)
+        except ValueError:
+            return action_result.set_status(phantom.APP_ERROR, "Parameter 'message_id' must be a valid integer")
+
+        payload = {
+            "quarantineType": "spam",
+            "mids": [message_id]
+        }
+
+        ret_val, response = self._make_authenticated_request(
+            action_result,
+            CISCOSMA_DELETE_MESSAGES_ENDPOINT,
+            json_data=payload,
+            method="delete"
+        )
+
+        if phantom.is_fail(ret_val):
+            return action_result.get_status()
+
+        try:
+            delete_data = response.get("data", {})
+            action_result.add_data(delete_data)
+
+            summary = {
+                "total_deleted": delete_data.get("totalCount", 0),
+                "action": delete_data.get("action")
+            }
+            action_result.update_summary(summary)
+
+        except Exception as e:
+            return action_result.set_status(phantom.APP_ERROR, f"Error parsing response: {str(e)}")
+
+        return action_result.set_status(phantom.APP_SUCCESS, "Successfully deleted message")
+
     def _handle_search_tracking_messages(self, param):
         action_result = self.add_action_result(ActionResult(dict(param)))
 

diff --git a/ciscosma_consts.py b/ciscosma_consts.py
@@ -24,7 +24,8 @@
 CISCOSMA_GET_MESSAGE_TRACKING_DETAILS_ENDPOINT = "/sma/api/v2.0/message-tracking/details"
 CISCOSMA_SEARCH_MESSAGES_ENDPOINT = "/sma/api/v2.0/quarantine/messages"
 CISCOSMA_SEARCH_TRACKING_MESSAGES_ENDPOINT = "/sma/api/v2.0/message-tracking/messages"
-CISCOSMA_RELEASE_MESSAGES_ENDPOINT = "/api/v2.0/quarantine/messages"
+CISCOSMA_RELEASE_MESSAGES_ENDPOINT = "sma/api/v2.0/quarantine/messages"
+CISCOSMA_DELETE_MESSAGES_ENDPOINT = "/sma/api/v2.0/quarantine/messages"
 
 # Future endpoints
 # GET /api/v2.0/reporting/report?resource_attribute