Cisco ESA Response Integration via API

Purpose

This guide explains how to configure the Cisco Email Security Appliance (ESA) Response integration in Logsign USO, so that Incidents and Alarms can automatically, or an analyst can manually, search and inspect message tracking data, manage quarantined messages (spam and other policy quarantines), and manage sender/recipient safelist and blocklist entries on Cisco ESA. This is not a log collection poller: it is a Response (action) integration, configured under Settings > Integrations > Responses > +Device.

Prerequisites

• A Cisco ESA appliance with its management API enabled and reachable from the Logsign server.
• An ESA administrator account with API access. Cisco ESA's REST API authenticates with a regular appliance username and passphrase.
• Use least privilege. Create a dedicated ESA user account for this integration rather than reusing a personal admin login, scoped to the message tracking / quarantine / mail policy roles this integration needs, if your ESA version supports custom user roles. The exact role names were not independently verified against a live ESA appliance during this research; confirm with your Cisco ESA administrator or Cisco documentation.

Step 1: Prepare an ESA Account for API Access

1. Log in to the Cisco ESA management interface with an administrator account.
2. Create (or designate) a dedicated user account for Logsign to use, with access to message tracking, quarantine management, and mail policy (safelist/blocklist) features.
3. Note the appliance hostname (or IP) and the username/passphrase for this account.

Step 2: Configure the Integration in Logsign USO

In Logsign USO, go to Settings > Integrations > Responses, search for Cisco ESA, click Configure then +Device, and fill in:

Click Create to save the device.

Available Methods

Once configured, the following actions are available from an Incident, Alarm, or Action Rule. They are grouped below by function; the exact field labels shown to you when configuring a method may differ slightly from the internal names.

Message search and details

• search_messages — searches message tracking for messages matching given criteria.
• message_details — gets full details of a specific tracked message.
• dlp_details — gets DLP (data loss prevention) verdict details for a message.
• amp_details — gets AMP (malware) verdict details for a message.
• url_details — gets URL reputation/filtering details for a message.
• remediation_details — gets remediation action details for a message.
• connection_details — gets SMTP connection details related to a message.
• rejected_connections — lists connections that were rejected at the SMTP layer.
• download_an_attachment — downloads an attachment associated with a tracked message.

Spam quarantine

• search_quarantined_messages — searches messages in the spam quarantine.
• retrieve_message_details_in_spam_quarantine — gets details of a message in the spam quarantine.
• release_quarantined_messages — releases one or more messages from the spam quarantine to their intended recipient.
• delete_quarantined_messages — permanently deletes one or more messages from the spam quarantine.
• delay_exit_quarantined_message — delays the scheduled auto-release/expiry of a quarantined message.

Other (policy/virus/outbreak) quarantines

• search_messages_by_rule_id — searches quarantined messages by the policy rule that quarantined them.
• retrieve_message_details_in_other_quarantine — gets details of a message in a non-spam quarantine (policy, virus, outbreak, etc.).
• move_quarantined_messages — moves a message between quarantines.
• release_messages_from_rules_in_other_quarantine — releases messages matching a given rule from a non-spam quarantine.
• delete_messages_from_rules_in_other_quarantine — deletes messages matching a given rule from a non-spam quarantine.
• view_rule_summary — shows a summary of a quarantine rule.

Safelist and blocklist management

• search_safelist_entries / search_blocklist_entries — search current safelist/blocklist entries.
• Add, edit, append, and delete variants exist for both sender and recipient safelist/blocklist entries (16 methods in total covering each combination of add/edit/append/delete × safelist/blocklist × sender/recipient).

Troubleshooting

Notes and Limits

• The manifest also declares a search_other_quarantined_messages method, but source-code review found this method is not wired into Logsign's method-registration map for this integration; it is present as a name but not currently callable. Do not rely on it, and use search_messages_by_rule_id for searching non-spam quarantines instead. This is a known gap to raise with Logsign engineering, not a documentation issue that can be fixed here.
• This integration only covers Cisco Email Security Appliance (message tracking, quarantine, and mail policy). It is unrelated to Cisco AMP, Cisco Umbrella, Cisco Firepower, or other Cisco integrations, each documented separately.
• The exact ESA console navigation path and role-naming for API access were not independently verified against a live appliance during this research (not independently verified); the field names and method behavior above are taken directly from Logsign's integration code.