Set up an enclave inbox to email incident and alert information directly to your enclaves

This document explains how to use the Enclave Inbox feature to submit incident and alert information directly to your Enclaves using email. Emails sent to this inbox are processed and then submitted to the Enclave every minute.

Use Case	Description
Intelligence	You belong to an email thread or group that exchanges observables over email. Send the emails to Splunk Intelligence Management to identify the observables in the email. Optional: connect detection tool to your email enclave to make detection tool download observables found in the emails.
Phishing Enrichment	Forward suspected phishing emails to Splunk Intelligence Management. Splunk Intelligence Management identifies observables in the email. Splunk Intelligence Management enriches the observables it finds with intelligence from your intel sources. Your submissions will populate Splunk Intelligence Management's Phishing Triage UI where you can review them, their scores, and mark whether or not they are a phish attempt.
Event Enrichment	Forward SIEM alerts or case management system cases to enclave via email. Splunk Intelligence Management identifies observables in the alert / case. Splunk Intelligence Management enriches the observables with intel from your intel sources. Use the enrichment to help investigate the case / alert.

How It Works

Splunk Intelligence Management creates an email handle for a given company. For example, Acme Company would be assigned the email acmeco@trustar.co. Any emails sent to this email address are then added to that user's Enclave with the subject line becoming the title of the new Intel Report and the date and report content populated within that Report.

Requirement	Description
TLS	The network device (email server, email gateway, or firewall) that communicates with Splunk Intelligence Management's email server must do so using TLS 1.2. Splunk Intelligence Management's email server requires incoming connections to use TLS 1.2.
Email byte-size	Emails are read from email inbox and submitted into enclave as a Splunk Intelligence Management report. Reports have a max byte-size, and the max is found here. Any email and its attachments must adhere to this max size.
observables	There is a limit to the quantity of observables an email and its attachments can contain. That limit is found here. Best practice: to the extent possible / reasonable / feasible, ensure any email and its attachments when combined together do not exceed more than 50% of the limit.
no images	Emails cannot have image files attached. Images are not ingested as they can cause problems with Splunk Intelligence Management's ingestion service. What out for email signature blocks, which commonly contain images that cause email ingestion failures.

Set up an enclave inbox

You must be a company administrator to configure the Enclave Inbox feature.

1. Log in to the Splunk Intelligence Management Web App as an administrator.
2. Click User Settings > Settings.
3. Click Enclave inbox on the Settings menu.
4. Click the + sign to start the configuration.
5. Choose the enclave you want to submit emails to.
6. Make a note of the value in the Desired Email Handle field. This field is automatically generated and ends in @enclave.trustar.co. You will use this email address as the recipient for all mail you are sending to the enclave.
7. Add text into the Accepted Email Subject Prefixes text box and press Enter after each entry. Using this field ensures that only emails with the specified prefixes will be processed and added to the enclave.
   • Text must be enclosed in square brackets; for example, if you want to process emails with [ACME] in the subject line, you must enter [ACME] in this text box.
   • Each entry must be at least 3 characters long, including the square brackets.
   • You can specify multiple prefixes. An email with any of the prefixes will be processed.
8. Specify Accepted Sender Emails, if desired. Press Enter after each email address to add it to the list. Restricting who can send or forward emails to this Enclave increases security. You can use wildcards to accept emails sent from a common domain. For example, @acme.com will accept all senders that end with the domain @acme.com.
9. Click Send to submit the new configuration.

After the request is complete, you will receive a notification that the enclave inbox has been set up. The enclave email inbox can take up to 2 minutes to become operational.

As with all other submissions, Observables are automatically extracted and correlated.

Find an enclave's email handle

To view the list of your enclave inboxes and their associated email handles, follow these steps.

1. Log into the Splunk Intelligence Management Web App.
2. On the Navigation Bar, click the User Settings icon at the bottom of the bar, then click Settings on the dropdown menu to see your User Profile information.
3. Click Enclave Inbox to display the enclave inboxes available to your account.

The email handle is displayed in the second column from the left. To copy this information, click the clipboard icon next to an individual email handle.

Update the enclave inbox

Perform the following tasks if you need to edit your enclave inbox's configuration.

1. Log in to the Splunk Intelligence Management Web App as an administrator.
2. Click User Settings > Settings.
3. Click Enclave inbox on the Settings menu.
4. Select the inbox configuration you need to update and click the Pencil icon on the right vertical menu.
5. Edit the Email Subject Prefix and Sender Email fields as needed. Remember to press Enter after each new entry to commit it to the list.
6. Click Save when you have finished editing the information.

Delete an enclave inbox

Perform the following steps to delete an enclave inbox:

1. Log in to the Splunk Intelligence Management Web App as an administrator.
2. Click User Settings > Settings.
3. Click Enclave inbox on the Settings menu.
4. Select the inbox configuration you want to delete and click the Trashcan icon on the right vertical menu.
5. Click Delete on the confirmation popup. (Note: this does not delete the Enclave, it only deletes the email inbox for that Enclave.)

Send email submissions

After the inbox for the Enclave has been set up, you can send emails to the new address to submit items to the enclave.

To be processed correctly, the emails you send need to match the email inbox configuration:

• From field: If you specified Accepted Senders, the email must be from one of these addresses.
• Subject field: If you specified prefixes, the email must contain one or more of those prefixes, including the square brackets enclosing the text. Each prefix must be contained in a separate set of square brackets. For example, [ACME] [SPAM]
• The Subject text, including any prefixes will be used as the Report Title for the submission.

Add tags to emails

You can associate tags with your email submission using either of the following methods:

• Specify Enclave tags in the subject line. These tags must be specified as a comma-separated list within { } brackets for submission to be tagged; for example {spam,malware,highpriority}
• Specify Enclave tags as the first line in the body of the email. The tags must be specified as a comma-separated list within { } brackets for submission to be tagged; for example {spam,malware,highpriority}

Enclave tags added to the first line in the body of the email will not appear if submitted in HTML format.

Email body

The body of the email is submitted as an Intel Report. If there are any observables in the email body, they are automatically extracted and correlated.

Email attachments

If your email has an attachment in PDF, Word, Text file, CSV, Excel, .eml, .msg, or JSON, Splunk Intelligence Management automatically appends the content of that attachment to the report body and extracts any observables from that content. This processing may remove the formatting of the attachment.

Redacting submitted emails

You can choose redact information from submitted emails using your organization's Redaction Library.

To toggle email redaction for a specific Enclave:

1. Go to the Enclave Inbox tab in Profile Settings
2. Toggle on the Redaction option for the Enclave Inbox configuration. Note that it will take up to two minutes for the changes to reflect.

This feature is only available for Enclaves that you own. Email redaction for shared Enclaves can only be requested by the Splunk Intelligence Management administrator who created the Enclave Inbox for that Enclave.

Sample email

This is an example of an email processed by Splunk Intelligence Management and submitted to the specified enclave.

Troubleshooting the configuration of enclave inboxes

Why aren't my emails appearing in my Enclave?

• Check your Enclave inbox configuration and ensure that the email message being sent to the inbox complies with the configured accepted sender and accepted prefix (optional).
• Try sending a "test" email (subj: "test", body: "test") to the email address. If it successfully ends up in your enclave, then something about your emails that are not successfully landing in the enclave is causing them to not successfully land in the enclave.
• Check that the email you are forwarding to the inbox complies with Splunk Intelligence Management's report submission limits. You can find those limits here.
• Confirm in your email server logs that the emails are being successfully delivered to the enclave inbox email address. Depending on the settings, adding the domain @enclave.trustar.co to the list of approved senders may resolve emails that are being blocked when forwarding to the enclave inbox handle.
• Have an image in your submission? This image data can be causing Splunk Intelligence Management's observable-extraction engine to time-out. Remove images from the email, including images that are part of your signature block.
• De-configure your enclave inbox (see section "Deleting an Enclave Inbox" above) and configure a new enclave inbox for that enclave.

If the issue persists, please contact Splunk Intelligence Support.

Why aren't URL's being decoded after submitting into Splunk Intelligence Management?

Splunk Intelligence Management does not decode URLs submitted to the Splunk Intelligence Management platform from third party tools that have been encoded. Users who would like to leverage Splunk Intelligence Management's platform capabilities for phishing triage and indicator correlation will need to have their URLs decoded before submitting them to Splunk Intelligence Management. Please reach out to the vendor's support team for help on decoding URL's so it can be useful in Splunk Intelligence Management.

How can I update a report using the Enclave Inbox feature?

A report can be updated via Enclave Inbox if a response is threaded to the original email submitted into your Enclave. This is validated by the 'Message-ID' of the initial email of the thread that needs to be populated in the "In-Reply-To" header field. If the 'Message-ID' of the threaded response is different it will be submitted as a new report instead.