Ironscales

Details
Content
Dependencies
Version History

IRONSCALES is a self-learning email security platform, automatically responding to malicious emails.

IRONSCALES is an email security company focused on fighting back against today’s modern phishing attacks.

Our self-learning, AI-driven platform continuously detects and remediates advanced threats like Business Email Compromise (BEC), credential harvesting, Account Takeover (ATO) and more.

Pack Contributors:

Illia Pekelnyi

Contributions are welcome and appreciated. For more info, visit our Contribution Guide.

IRONSCALES is an email security company focused on fighting back against today’s modern phishing attacks.

Our self-learning, AI-driven platform continuously detects and remediates advanced threats like Business Email Compromise (BEC), credential harvesting, Account Takeover (ATO) and more.

Pack Contributors:

Illia Pekelnyi

Contributions are welcome and appreciated. For more info, visit our Contribution Guide.

Automations

Name	Description
IronscalesEmailFieldTrigger	Automatically changes email field when choosing classification.

Classifiers

Name	Description
Ironscales - Incoming Mapper	Maps incoming Ironscales incident fields.

Incident Fields

Name	Description
Ironscales-mail_server
Ironscales-Resolver-email-address
Ironscales-ID
Ironscales-Links
Ironscales-sender_reputation
Ironscales-first_reported_by
Ironscales-themis_verdict
Ironscales-reply_to
Ironscales-sender_is_internal
Ironscales-first_reported_date
Ironscales-attachments
Ironscales-themis_proba
Ironscales-federation
Ironscales-Details
Ironscales-Choose-Classification
Ironscales_incident_id
Ironscales-company_name
Ironscales-spf_Result
Ironscales-affected_mailbox_count
Ironscales-reports
Ironscales-company_id
Ironscales-banner_displayed
Ironscales-Classification
Ironscales-sender_email

Incident Types

Name	Description
Ironscales

Integrations

Name	Description
Ironscales (Partner Contribution)	IRONSCALES, a self-learning email security platform integration.

Layouts

Name	Description
Ironscales

Playbooks

Name	Description
Ironscales-Classify-Incident	Classify an Ironscales incident

Automations

Name	Description
IronscalesEmailFieldTrigger	Automatically changes email field when choosing classification.

Classifiers

Name	Description
Ironscales - Incoming Mapper	Maps incoming Ironscales incident fields.

Incident Fields

Name	Description
Ironscales-banner_displayed
Ironscales-reports
Ironscales-Classification
Ironscales-company_id
Ironscales-reply_to
Ironscales-federation
Ironscales-Choose-Classification
Ironscales-attachments
Ironscales-Details
Ironscales-affected_mailbox_count
Ironscales-themis_verdict
Ironscales-sender_is_internal
Ironscales-company_name
Ironscales-Resolver-email-address
Ironscales-mail_server
Ironscales-Links
Ironscales-first_reported_date
Ironscales-spf_Result
Ironscales-ID
Ironscales-first_reported_by
Ironscales_incident_id
Ironscales-themis_proba
Ironscales-sender_reputation

Incident Types

Name	Description
Ironscales

Integrations

Name	Description
Ironscales (Partner Contribution)	IRONSCALES, a self-learning email security platform integration.

Playbooks

Name	Description
Ironscales-Classify-Alert	Classify an Ironscales alert

Required Content Packs (1)

Pack Name	Pack By
Base	By: Cortex XSOAR

Optional Content Packs (0)

Pack Name	Pack By

All level dependencies (2)

Pack Name	Pack By
Aggregated Scripts	By: Cortex XSOAR
Base	By: Cortex XSOAR

1.1.19 - 8201591 (April 12, 2026)

Integrations

Fixed an issue where the ironscales-get-open-incidents command returned an error when the company had no open incidents.
Updated the Docker image to: demisto/python3:3.12.13.8160132.

Related pull requests:
- 43639
- 43815

Download

1.1.18 - 7827247 (March 22, 2026)

Documentation and metadata improvements.

Related pull requests:
- 43566

Download

1.1.17 - 5636304 (October 29, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 41629

Download

1.1.16 - R5469292 (October 20, 2025)

Integrations

Ironscales

Updated the Docker image to: demisto/python3:3.12.8.3296088.

Scripts

IronscalesEmailFieldTrigger

Updated the Docker image to: demisto/python3:3.12.8.3296088.

Related pull requests:
- 41193

Download

1.1.15 - R3444919 (May 18, 2025)

Integrations

Ironscales

Metadata and documentation improvements.

Scripts

IronscalesEmailFieldTrigger

Metadata and documentation improvements.

Related pull requests:
- 39009

Download

1.1.14 - 1748140 (December 4, 2024)

Scripts

IronscalesEmailFieldTrigger

Updated the Docker image to: demisto/python3:3.11.10.115186.

Related pull requests:
- 37528
- 37524
- 37525
- 37526
- 37527

Download

1.1.13 - R1741355 (December 3, 2024)

Integrations

Ironscales

Updated the Docker image to: demisto/python3:3.11.10.116439.

Related pull requests:
- 37271

Download

1.1.12 - 1061293 (June 2, 2024)

Scripts

IronscalesEmailFieldTrigger

Updated the Docker image to: demisto/python3:3.10.14.95956.

Related pull requests:
- 34631
- 34076
- 34074
- 34075
- 34071
- 34072
- 34073

Download

1.1.11 - 6234071 (September 4, 2023)

Integrations

Ironscales

Updated the Docker image to: demisto/python3:3.10.13.72123.

Related pull requests:
- 29430

Download

1.1.10 - 6122748 (August 22, 2023)

Integrations

Ironscales

Updated the Docker image to: demisto/python3:3.10.12.68714.

Related pull requests:
- 29133

Download

1.1.9 - 5940472 (August 2, 2023)

Integrations

Ironscales

Updated the Docker image to: demisto/python3:3.10.12.66339.

Related pull requests:
- 28699

Download

1.1.8 - R5866730 (July 25, 2023)

Scripts

IronscalesEmailFieldTrigger

Updated the Docker image to: demisto/python3:3.10.12.63474.

Related pull requests:
- 27997

Download

1.1.7 - R5692327 (July 5, 2023)

Integrations

Ironscales

Updated the Docker image to: demisto/python3:3.10.12.63474.

Related pull requests:
- 27802

Download

1.1.6 - 5470583 (June 7, 2023)

Integrations

Ironscales

Updated the Docker image to: demisto/python3:3.10.11.61265.

Related pull requests:
- 27272

Download

1.1.5 - R5170573 (May 2, 2023)

Integrations

Ironscales

Updated the pack category to Email.
Updated the Docker image to: demisto/python3:3.10.10.48392.

Related pull requests:
- 24813

Download

1.1.4 - R4646022 (February 19, 2023)

Layouts

Ironscales
This item is no longer supported in XSIAM.

Related pull requests:
- 24221

Download

1.1.3 - R4372591 (January 11, 2023)

Integrations

Ironscales

Updated the Docker image to: demisto/python3:3.10.8.37233.

Related pull requests:
- 22175

Download

1.1.2 - 2303329 (January 25, 2022)

Incident Fields

Ironscales-sender_email
- Maintenance and stability enhancements.

Download

1.1.1 - R2146019 (December 21, 2021)

Integrations

Ironscales

Updated the Docker image to: demisto/python3:3.9.8.24399.

Download

1.1.0 - R2009340 (November 25, 2021)

Incident Fields

Ironscales-Choose-Classification

Incident Types

Ironscales

Integrations

Ironscales

Fixed a typo in the context output of the ironscales-classify-incident command.
Added a default mapper to the integration.
Updated the Docker image to: demisto/python3:3.9.7.24076.

Scripts

New: IronscalesEmailFieldTrigger

Automatically changes email field when choosing a classification.

Download

1.0.2 - 7584045 (September 13, 2021)

Incident Fields

Ironscales-Resolver-email-address

Maintenance and stability enhancements.

Download

1.1.19 - 8201591 (April 12, 2026)

Integrations

Ironscales

Fixed an issue where the ironscales-get-open-incidents command returned an error when the company had no open incidents.
Updated the Docker image to: demisto/python3:3.12.13.8160132.

Related pull requests:
- 43639
- 43815

Download

1.1.18 - 7827247 (March 22, 2026)

Documentation and metadata improvements.

Related pull requests:
- 43566

Download

1.1.17 - 5636304 (October 29, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 41629

Download

1.1.16 - R5469292 (October 20, 2025)

Integrations

Ironscales

Updated the Docker image to: demisto/python3:3.12.8.3296088.

Scripts

IronscalesEmailFieldTrigger

Updated the Docker image to: demisto/python3:3.12.8.3296088.

Related pull requests:
- 41193

Download

1.1.15 - R3444919 (May 18, 2025)

Integrations

Ironscales

Metadata and documentation improvements.

Scripts

IronscalesEmailFieldTrigger

Metadata and documentation improvements.

Related pull requests:
- 39009

Download

1.1.14 - 1748140 (December 4, 2024)

Scripts

IronscalesEmailFieldTrigger

Updated the Docker image to: demisto/python3:3.11.10.115186.

Related pull requests:
- 37528
- 37524
- 37525
- 37526
- 37527

Download

1.1.13 - R1741355 (December 3, 2024)

Integrations

Ironscales

Updated the Docker image to: demisto/python3:3.11.10.116439.

Related pull requests:
- 37271

Download

1.1.12 - 1063016 (June 2, 2024)

Scripts

IronscalesEmailFieldTrigger

Updated the Docker image to: demisto/python3:3.10.14.95956.

Related pull requests:
- 34631
- 34076
- 34074
- 34075
- 34071
- 34072
- 34073

Download

1.1.11 - 6234071 (September 4, 2023)

Integrations

Ironscales

Updated the Docker image to: demisto/python3:3.10.13.72123.

Related pull requests:
- 29430

Download

1.1.10 - 6122748 (August 22, 2023)

Integrations

Ironscales

Updated the Docker image to: demisto/python3:3.10.12.68714.

Related pull requests:
- 29133

Download

1.1.9 - 5940472 (August 2, 2023)

Integrations

Ironscales

Updated the Docker image to: demisto/python3:3.10.12.66339.

Related pull requests:
- 28699

Download

1.1.8 - R5866730 (July 25, 2023)

Scripts

IronscalesEmailFieldTrigger

Updated the Docker image to: demisto/python3:3.10.12.63474.

Related pull requests:
- 27997

Download

1.1.7 - 5649943 (June 29, 2023)

Integrations

Ironscales

Updated the Docker image to: demisto/python3:3.10.12.63474.

Related pull requests:
- 27802

Download

1.1.6 - 5470583 (June 7, 2023)

Integrations

Ironscales

Updated the Docker image to: demisto/python3:3.10.11.61265.

Related pull requests:
- 27272

Download

1.1.5 - R5170573 (May 2, 2023)

Integrations

Ironscales

Updated the pack category to Email.
Updated the Docker image to: demisto/python3:3.10.10.48392.

Related pull requests:
- 24813

Download

1.1.4 - R4646022 (February 19, 2023)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 24221

Download

1.1.3 - R4361094 (January 9, 2023)

Integrations

Ironscales

Updated the Docker image to: demisto/python3:3.10.8.37233.
Added sections to instance configuration.

Related pull requests:
- 22175

Download

1.1.2 - 2316504 (January 27, 2022)

Incident Fields

Ironscales-sender_email
- Maintenance and stability enhancements.

Download

1.1.1 - R2146019 (December 21, 2021)

Integrations

Ironscales

Updated the Docker image to: demisto/python3:3.9.8.24399.

Download

1.1.0 - R2009340 (November 25, 2021)

Incident Fields

Ironscales-Choose-Classification

Incident Types

Ironscales

Integrations

Ironscales

Fixed a typo in the context output of the ironscales-classify-incident command.
Added a default mapper to the integration.
Updated the Docker image to: demisto/python3:3.9.7.24076.

Scripts

New: IronscalesEmailFieldTrigger

Automatically changes email field when choosing a classification.

Download

1.0.2 - 7584045 (September 13, 2021)

Incident Fields

Ironscales-Resolver-email-address

Maintenance and stability enhancements.

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Partner
Created	July 20, 2021
Last Release	April 12, 2026

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise.