POST-Content Review-Email Channel

Interface Introduction

The Email Channel Content Review interface is used to detect whether the emails sent by users in the email channel violate the enterprise or organization's Data Loss Prevention (DLP) policies and to perform response actions such as allowing or blocking data transmission.

Request method

Interface URL

Request Parameters

 "redaction": {
        "enable": true # Redaction request takes effect when enable is true
  }

"md5":"09e066b382d4225de3c0594aa89b5fi"

Obtaining Authentication Information

Use the following example with cURL to obtain the key information required for authentication.

Python Request Example - Local Email File (Synchronous Mode)

The following example shows how to use Python code to call the interface to perform content security review of local email files in synchronous mode.

# -*- coding: utf-8 -*-
from requests.packages.urllib3.exceptions import InsecureRequestWarning
from ucwi_config import UCWIConfig
from ucwi_auth import get_headers
import requests
import json
import os
import uuid

requests.packages.urllib3.disable_warnings(InsecureRequestWarning)


api = "/skg/v1/dlp/channel/email/smtp/sync"
url = "{0}{1}".format(UCWIConfig.base_url, api)
file_path = "test.eml"

metadata = {
    "sender": "skgqa-senduser@skyguard.com.cn",
    "recipients": [
        "cloud-receiveruser@skyguard.com.cn",
        "external-receiveruser@163.com",
    ],
    "queryID": str(uuid.uuid4()),
}

headers = get_headers()
data = {"metadata": json.dumps(metadata)}
fd = open(file_path)
files = {
    "request": fd
}
response = requests.post(url, headers=headers, data=data, files=files, verify=False)
fd.close()

if response.status_code != 200:
    print("Bad request, response code:", response.status_code)
    print(response.text)
else:
    result = response.json()
    # print(json.dumps(result, indent=4).decode('raw_unicode_escape'))
    if result["responseCode"] != 200:
        print("Bad request, response code:", result["responseCode"])
        print(result["message"])
    else:
        hint = "# 1: Allow; 2: Block; 3: Confirm; 4: Delete Attachment; 5: Email Encryption; 6: Email Quarantine; 7: Terminal System Encryption; 8: Email Content Encryption; 9: Terminal Personal Key Encryption"
        print("action:{}    {}".format(result["actionCode"], hint))
        if len(result["incident_info"]) == 0:
            print("not matched.")
        else:
            print("matched policy:")
            for policy in result["incident_info"]["matchedPolicies"]:
                print(json.dumps(policy, indent=2).encode('utf-8').decode('raw_unicode_escape'))

Python Request Example - Local Email File (Asynchronous Mode)

The following example shows how to use Python code to call the interface to perform content security review of local email files in asynchronous mode.

# -*- coding: utf-8 -*-
from requests.packages.urllib3.exceptions import InsecureRequestWarning
from ucwi_config import UCWIConfig
from ucwi_auth import get_headers
import requests
import json
import os
import uuid

requests.packages.urllib3.disable_warnings(InsecureRequestWarning)


api = "/skg/v1/dlp/channel/email/smtp/async"
url = "{0}{1}".format(UCWIConfig.base_url, api)
file_path = "test.eml"

metadata = {
    "sender": "skgqa-senduser@skyguard.com.cn",
    "recipients": [
        "cloud-receiveruser@skyguard.com.cn",
        "external-receiveruser@163.com",
    ],
    "queryID": str(uuid.uuid4()),
    "uploadtype": "file",
    "callback_url": UCWIConfig.callback_url + "/email"
}

headers = get_headers()
data = {"metadata": json.dumps(metadata)}
fd = open(file_path)
files = {
    "request": fd
}
response = requests.post(url, headers=headers, data=data, files=files, verify=False)
fd.close()

if response.status_code != 200:
    print("Bad request, response code:", response.status_code)
    print(response.text)
else:
    result = response.json()
    print(result["message"])

Python Request Example - Files Stored on S3 (Asynchronous Mode)

The following example shows how to use Python code to call the interface to perform content security review of files stored on S3 in asynchronous mode.

# -*- coding: utf-8 -*-
from requests.packages.urllib3.exceptions import InsecureRequestWarning
from ucwi_config import UCWIConfig
from ucwi_auth import get_headers
import requests
import json
import os
import uuid

requests.packages.urllib3.disable_warnings(InsecureRequestWarning)


api = "/skg/v1/dlp/channel/email/smtp/async"
url = "{0}{1}".format(UCWIConfig.base_url, api)
file_path = "test.eml"

metadata = {
    "sender": "skgqa-senduser@skyguard.com.cn",
    "recipients": [
        "cloud-receiveruser@skyguard.com.cn",
        "external-receiveruser@163.com",
    ],
    "queryID": str(uuid.uuid4()),
    "uploadtype": "s3",
    "callback_url": UCWIConfig.callback_url + "/email",
    "objectInfo": {
        "accessKey": "7WDU84VEZPA4OM1I7TEH",
        "secretKey": "70Jsmd1HfovY6aHjEwhNdWeZvIZPjdZH5cjSlOZb",
        "endpointUrl": "http://172.22.110.14:8080 ",
        "s3Bucket": "test-new-bucket",
        "s3Key": "ucwi-test.txt",
    }
}

headers = get_headers()
data = {"metadata": json.dumps(metadata)}
fd = open(file_path)
files = {
    "request": fd
}
response = requests.post(url, headers=headers, data=data, files=files, verify=False)
fd.close()

if response.status_code != 200:
    print("Bad request, response code:", response.status_code)
    print(response.text)
else:
    result = response.json()
    print(result["message"])

cURL Request Example - Files Stored on S3 (Asynchronous Mode)

Return Parameters

Including the following：

Example for return code

The response to the Content inspection request is as follows.

• Request successfully

  {
  "result" : 0,
  "actionCode" : 1/2
  }
  actionCode: 1 - allow, 2 - block

  Note: If the policy is matched and the violation content is found, the system returns the policy matching information. Refer to The return value for policy match.
• Request failed

  {
  "result" : 1,
  "errorCode" : 500,
  "message" : "Invalid parameter"
  }

EML File Example

The EML example is as follows:

Date: Fri,20 Jan 2017 03:28:09 UTC
From: asmith@skg.com
To: eyee@skg.com
Subject: Normal_Mail
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="Spirent_Avalanche_SMTP"
This is a mime encoded message
--Spirent_Avalanche_SMTP
Content-Type: text/plain
Dear David and Steve,
Good morning.
This is the body of this E-Mail.Aaaaa, aaaaaaa, aaa, aaa, aa, aaaaaaaaaa,
aaaaaaaaaaaaaaaaaaa.
Please contact us at any time.
Best Regards.
Someone
--Spirent_Avalanche_SMTP--

Error code