Microsoft Safelinks

The Microsoft Safelinks connector allows for the decoding of protected URLs and reporting on their safety, aiding in the protection against phishing and malware.

Microsoft Safelinks is a security feature within Microsoft's suite of products that provides URL scanning and rewriting to protect users from malicious links. The Microsoft Safelinks connector for Swimlane Turbine allows users to decode Safelinks URLs to their original form and check their safety status. This integration empowers security teams to quickly validate links, streamline threat analysis, and enhance their organization's email security posture directly within the Swimlane Turbine platform. By automating these processes, users can efficiently manage and respond to potential threats, saving time and reducing the risk of human error.

Prerequisites

To effectively utilize the Microsoft Safelinks connector with Swimlane Turbine, ensure you have the following:

Custom configuration with no additional parameters required.

Capabilities

The Microsoft Safelinks connector provides the following capabilities:

Decode Safelink URLs

Report MS Verdict

Configurations

Asset

Configuration Parameters

Parameter	Description	Type	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Decode URLs

Decodes Microsoft Safelinks URLs provided in the data body to reveal the original URL.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
data_body	object	Required	Data Body
data_body.urls	string	Required	URLs from Microsoft Safelinks that need to be decoded

Input Example

{"data_body":{"urls":"string"}}

Output

Parameter	Type	Description
parsed_urls	array	URL endpoint for the request
parsed_domains	array	Output field: parsed_domains
status_code	number	HTTP status code of the response
headers	array	HTTP headers for the request
headers.file_name	string	HTTP headers for the request
headers.file	string	HTTP headers for the request
reason	string	Response reason phrase

Output Example

{"parsed_urls":["https://google.com","https://swimlane.com"],"parsed_domains":["google.com","swimlane.com"],"status_code":200,"headers":[],"reason":"OK"}

Report MS Verdict

Reports the Microsoft Safelinks verdict on whether a link is allowed or blocked, requiring a data body input.

Endpoint

URL: /

Method: GET

Input

Argument Name	Type	Required	Description
data_body	object	Required	Data Body
data_body.url	string	Required	URL to detect whether allowed or blocked

Input Example

{"data_body":{"url":"https://example.com/api/resource"}}

Output

Parameter	Type	Description
resolved_url	string	URL endpoint for the request
verdict	string	Output field: verdict
status_code	number	HTTP status code of the response
headers	array	HTTP headers for the request
headers.file_name	string	HTTP headers for the request
headers.file	string	HTTP headers for the request
reason	string	Response reason phrase

Output Example

{"resolved_url":"http://joannawedding.tw/INFO/US/Open-Past-Due-Orders","verdict":"allowed","status_code":200,"headers":[],"reason":"OK"}

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT