--- title: Cisco Secure Email CLI  description: "Cisco Secure Email Appliance is a virtual, all-in-one appliance that provides protection against spam, malware, viruses, and other inbound and outbound email threats and annoyances.\n\nTogether, SIRP and Cisco Secure Email deliver advanced email security. SIRP’s integration with Cisco Secure Email allows security teams to execute response actions right from SIRP" --- [Skip to content](https://content.sirp.io/knowledge-base/cisco-secure-email-cli-help-center-sirp#main-content) English Show submenu for translations [Customer portal](https://content.sirp.io/customer-portal?hsLang=en) [![SIRP-Logo-4c-KO](https://content.sirp.io/hs-fs/hubfs/SIRP-Logo-4c-KO.png?width=200&height=90&name=SIRP-Logo-4c-KO.png)](https://sirp.io/) Open main navigation Close main navigation - English Show submenu for translations - [Customer portal](https://content.sirp.io/customer-portal) - [Contact us](https://content.sirp.io/customer-portal/new) [Contact us](https://content.sirp.io/customer-portal/new?hsLang=en) What would you like to automate today? - There are no suggestions because the search field is empty. 1. [SIRP Help Center](https://content.sirp.io/knowledge-base?hsLang=en) 2. [Integration Guide](https://content.sirp.io/knowledge-base/integration-guide?hsLang=en) # Cisco Secure Email CLI ### About Cisco Secure Email Cisco Secure Email Appliance is a virtual, all-in-one appliance that provides protection against spam, malware, viruses, and other inbound and outbound email threats and annoyances. Together, SIRP and Cisco Secure Email deliver advanced email security. SIRP’s integration with Cisco Secure Email allows security teams to execute response actions right from SIRP. ### Supported Actions SIRP’s Cisco Secure Email integration app allows you to execute the following actions: | **S.no** | **Action** | | --- | --- | | 1 | Push Domain to Blocklist | | 2 | Push IP to Blocklist | | 3 | Remove Domain from Blocklist | | 4 | Remove IP from Blocklist | | 5 | Push Domain To Dictionary | | 6 | Push IP To Dictionary | | 7 | Push Hash To Dictionary | | 8 | Push Email To Dictionary | | 9 | Remove Domain From Dictionary | | 10 | Remove IP from Dictionary | | 11 | Remove Hash From Dictionary | | 12 | Remove Email From Dictionary | ### Enable and Configure Cisco Secure Email ### Network Requirments: - Requirements: Port 22 (SSH Protocol) ### Create a new user on the Cisco Secure Email 1. Open your Cisco SE instance. 2. In the **System Administration,** go to **Users.** [![](https://downloads.intercomcdn.com/i/o/593767874/6aebaaf751802b43c722401d/image.png?expires=1752237000&signature=081286573b34721662c8059f64680b5817e4f5d1d465ed864088e47277528854&req=cSkkEc95lYZbFb4f3HP0gGoGsW9vDXH2UnCb3PnDGMDy0FKSvHyxvW%2FR9ElW%0Ax64%3D%0A)](https://downloads.intercomcdn.com/i/o/593767874/6aebaaf751802b43c722401d/image.png?expires=1752237000&signature=081286573b34721662c8059f64680b5817e4f5d1d465ed864088e47277528854&req=cSkkEc95lYZbFb4f3HP0gGoGsW9vDXH2UnCb3PnDGMDy0FKSvHyxvW%2FR9ElW%0Ax64%3D%0A) 3. Click on **Add User** [![](https://downloads.intercomcdn.com/i/o/593768246/1bd24a373c8128e0b292e5e9/image.png?expires=1752237000&signature=f2a7f1a1dd192196e5f2414bf258cffb1969d76be2d9f2f175d98628f3bd5057&req=cSkkEc92n4VZFb4f3HP0gFDtjQsRKbJ%2BF9wxCgGj6zDu7NbFFy48Y%2F6NiXT9%0AmPw%3D%0A)](https://downloads.intercomcdn.com/i/o/593768246/1bd24a373c8128e0b292e5e9/image.png?expires=1752237000&signature=f2a7f1a1dd192196e5f2414bf258cffb1969d76be2d9f2f175d98628f3bd5057&req=cSkkEc92n4VZFb4f3HP0gFDtjQsRKbJ%2BF9wxCgGj6zDu7NbFFy48Y%2F6NiXT9%0AmPw%3D%0A) 4. Enter User Name, Full Name, and assign a **Operator** role (at minimum) to this new user [![](https://downloads.intercomcdn.com/i/o/593768952/d4e776907f07facc332e6aff/image.png?expires=1752237000&signature=7fa4216df1d800ce4fb5b0eade536cf074822e498f21c00bde2ae407f54f237b&req=cSkkEc92lIRdFb4f3HP0gAvM749cuJCy5hDZvXk3fWZP0zTwkgJOGzibuRmL%0Atco%3D%0A)](https://downloads.intercomcdn.com/i/o/593768952/d4e776907f07facc332e6aff/image.png?expires=1752237000&signature=7fa4216df1d800ce4fb5b0eade536cf074822e498f21c00bde2ae407f54f237b&req=cSkkEc92lIRdFb4f3HP0gAvM749cuJCy5hDZvXk3fWZP0zTwkgJOGzibuRmL%0Atco%3D%0A) 5. Click **Submit** 6. Remember, to **Commit** changes at the end. ### Enable the Cisco Secure Email app in SIRP 1. First, log in to SIRP, then go to **Apps** from the left navigation bar. 2. Locate the app named **Secure Email CLI.** 3. **Enable** the Email Security app by clicking on the toggle button under the Status Column. [![](https://downloads.intercomcdn.com/i/o/593770516/48aa62714ae623126eee7614/image.png?expires=1752237000&signature=92166427eba631da598627c75b61856d80d5c215d5be482a1b89c900724d45b4&req=cSkkEc5%2BmIBZFb4f3HP0gCjbcsrN0RnurKwWBQKefJFyWN0cRfcDd0eWEM0z%0ARqU%3D%0A)](https://downloads.intercomcdn.com/i/o/593770516/48aa62714ae623126eee7614/image.png?expires=1752237000&signature=92166427eba631da598627c75b61856d80d5c215d5be482a1b89c900724d45b4&req=cSkkEc5%2BmIBZFb4f3HP0gCjbcsrN0RnurKwWBQKefJFyWN0cRfcDd0eWEM0z%0ARqU%3D%0A) Once you enable the App, click the **configure** option to add Cisco ESA login credentials. [![](https://content.sirp.io/hubfs/Knowledge%20Base%20Import/image-Jul-11-2025-11-55-47-2185-AM.png)](https://downloads.intercomcdn.com/i/o/635642304/a33803c6523b4297addffaef/image.png?expires=1752237000&signature=d36935818e84f0fb9b5d6b23133c3dc6bd07dabce2da54d6a47139782e14be82&req=ciMiEM18noFbFb4f3HP0gFk7tJxDjT1x8eaUxodx3wpd9wPe%2FEJr%2FKs0GV4G%0AjP9%2BXkdH3fy%2BbFmPmA%3D%3D%0A) Add the following details and click **Save**: 1. **Configuration Name:** \ 2. **Host:** \ 3. **Username:** \ 4. **Password:** \ 5. **Port: \<**Port defined to SSH into Secure Email\> 6. **Cluster:** true **or** false 7. **IP-Dictionary:** \ 8. **Domain-Dictionary: \<**ID of respective dictionary\> 9. **Hash-Dictionary:\<**ID of respective dictionary\> 10. **Email**-**Dictionary:\<**ID of respective dictionary\> ### Integration in Action Both IPs and Domains can be pushed from SIRP into Secure Email's HAT (Host Access Table). [![](https://content.sirp.io/hubfs/Knowledge%20Base%20Import/image-Jul-11-2025-11-55-52-9352-AM.png)](https://downloads.intercomcdn.com/i/o/593774398/d37976781f9b89dc11e64eca/image.png?expires=1752237000&signature=62e705eee3d5568ff69b4c837f41b2dc3fa1960c102c724382e46d81b622d0d0&req=cSkkEc56nohXFb4f3HP0gCTAAhkSyApAbx6oUl4AyN3EMV7AW%2Bi%2FzPVoTqmD%0Ad0dLPoL1uTn3IbgMXQ%3D%3D%0A) The pushed entry can be found in **Mail Policies \> HAT Overview \> BLOCKED\_LIST** [![](https://content.sirp.io/hubfs/Knowledge%20Base%20Import/image-Jul-11-2025-11-55-58-2365-AM.png)](https://downloads.intercomcdn.com/i/o/593775653/be3fe30776177a259ef6d484/image.png?expires=1752237000&signature=9d7c112de614e02033adb29cb9400885ef33e33c2863d0c40589147c69508e3a&req=cSkkEc57m4RcFb4f3HP0gG4fTAiqJBs%2BujJo5xluNS3phPuzih2VrRJxjbl9%0AnCKpo6%2Fmuk8bpFBo4g%3D%3D%0A) The following snippet shows you the steps taken by the integration script to block an IP address. ``` myesa.local> listenerconfig[]> editEnter the name or number of the listener you wish to edit.[]> 1Choose the operation you want to perform:- NAME - Change the name of the listener.- INTERFACE - Change the interface.- CERTIFICATE - Choose the certificate.- LIMITS - Change the injection limits.- SETUP - Configure general options.- HOSTACCESS - Modify the Host Access Table.- RCPTACCESS - Modify the Recipient Access Table.- BOUNCECONFIG - Choose the bounce profile to use for messages injected on thislistener.- MASQUERADE - Configure the Domain Masquerading Table.- DOMAINMAP - Configure domain mappings.- LDAPACCEPT - Configure an LDAP query to determine whether a recipient addressshould be accepted or bounced/dropped.- LDAPGROUP - Configure an LDAP query to determine whether a sender or recipientis in a specified group.[]> hostaccessChoose the operation you want to perform:- NEW - Create a new entry.- EDIT - Modify an entry.- DELETE - Remove an entry.- MOVE - Move an entry.- DEFAULT - Set the defaults.- PRINT - Display the table.- IMPORT - Import a table from a file.- EXPORT - Export the table to a file.- RESET - Remove senders and set policies to system default.[]> edit1. Edit Sender Group2. Edit Policy[1]> 1Currently configured HAT sender groups:1. ALLOWSPOOF2. MY_INBOUND_RELAY3. WHITELIST (My trusted senders have no anti-spam scanning or rate limiting)4. BLACKLIST (Spammers are rejected)5. SUSPECTLIST (Suspicious senders are throttled)6. UNKNOWNLIST (Reviewed but undecided, continue normal acceptance)7. (no name, first host = ALL) (Everyone else)Enter the sender group number or name you wish to edit.[]> 4Choose the operation you want to perform:- NEW - Add a new host.- DELETE - Remove a host.- POLICY - Change the policy settings and options.- PRINT - Display the current definition.- RENAME - Rename this sender group.[]> newame such as crm.example.com- a partial hostname such as .example.com- a range of SenderBase Reputation Scores in the form SBRS[7.5:10.0]- a SenderBase Network Owner ID in the form SBO:12345- a remote blacklist query in the form dnslist[query.blacklist.example]Separate multiple entries with commas.[]> badhost.example.org, 10.1.1.10 ``` ### Integration in Action through Dictionaries IPs, Domains, Hashes, and Email Addresses can be pushed into Secure Email's dictionaries, which are in turn called into its Incoming and Outgoing Mail Policies [![](https://content.sirp.io/hubfs/Knowledge%20Base%20Import/image-Jul-11-2025-11-56-03-3538-AM.png)](https://downloads.intercomcdn.com/i/o/635652105/89597287045986e5901e8414/image.png?expires=1752237000&signature=db69700ee1badbf5e356b65758b9ba7813c81aca3985ee1cf2e91bfa75967031&req=ciMiEMx8nIFaFb4f3HP0gDS%2Bq2DPGjQv7m%2Bk5e6PqAU32%2FuwlpGfKeYX8Nd5%0A94b81hR6hNeUd01JzQ%3D%3D%0A) The pushed entry can be found in **Mail Policies \> Dictionaries \> IP** [![](https://content.sirp.io/hubfs/Knowledge%20Base%20Import/image-Jul-11-2025-11-56-07-2820-AM.png)](https://downloads.intercomcdn.com/i/o/635655538/3ced120a1104dda67cf6fabe/image.png?expires=1752237000&signature=e6a2360d852f3eae7bc07a963c7c12f65da7eaf69bdc2e3786c62389a4a01212&req=ciMiEMx7mIJXFb4f3HP0gIz7G2M6pkgrz1wvRjM%2FB8vxB2H3Qe5z%2Ft%2BRi%2BKW%0AOg7Oh%2BEUSqIgz4qdag%3D%3D%0A) ### Why opt for CLI-based integration: Currently, there is a limitation in the AsyncOS API provided by Cisco. It can only block domains for one recipient or sender at a time. Due to this limitation, we rolled out CLI-based integration which blocks domains and IPs for the entire organization by pushing the values into the HAT (Host Access Table). Additionally, we rolled another set of actions that push IOCs into their designated dictionaries The following snippet shows you the steps taken by the integration script to push an IP into its dictionary in Secure Email ``` esa.sirp.com> dictionaryconfigCurrently configured content dictionaries:1. Domain2. Emails3. Hashes4. IPChoose the operation you want to perform:- NEW - Create a new content dictionary.- EDIT - Modify a content dictionary.- DELETE - Remove a content dictionary.- DICTIONARYLIMITS - Configure maximum number of content dictionaries that you can create in your email gateway.- RENAME - Change the name of a content dictionary.[]> editEnter the number of the dictionary you want to edit:1. Domain2. Emails3. Hashes4. IP[]> 4Choose the operation you want to perform on dictionary 'IP':- NEW - Create new entries in this dictionary.- IMPORT - Replace all of the words in this dictionary.- EXPORT - Export the words in this dictionary.- DELETE - Remove an entry in this dictionary.- PRINT - List the entries in this dictionary.- SETTINGS - Change settings for this dictionary.[]> newEnter new words or regular expressions. Separate multiple entries with line breaks. Optionally define weights by separating the word or expression with a comma and number. Enter ablank line to finish.65.52.198.174esa.sirp.com> commitPlease enter some comments describing your changes:[]>Do you want to save the current configuration for rollback? [Y]> nChanges committed: Thu Dec 15 14:28:56 2022 PKT ``` - [SIRP Community](https://content.sirp.io/knowledge-base/sirp-community?hsLang=en) - [Playbook Guide](https://content.sirp.io/knowledge-base/playbook-guide?hsLang=en) - [User Guide](https://content.sirp.io/knowledge-base/user-guide?hsLang=en#main-content) - [IM Guide](https://content.sirp.io/knowledge-base/user-guide?hsLang=en#im-guide) - [Admin Guide](https://content.sirp.io/knowledge-base/admin-guide?hsLang=en) - [Integration Guide](https://content.sirp.io/knowledge-base/integration-guide?hsLang=en) - [Release Notes](https://content.sirp.io/knowledge-base/release-notes?hsLang=en) - [Add on Apps](https://content.sirp.io/knowledge-base/add-on-apps?hsLang=en) - [Architecture](https://content.sirp.io/knowledge-base/architecture?hsLang=en) - [Use Cases](https://content.sirp.io/knowledge-base/use-cases?hsLang=en) [![SIRP-Logo-4c-KO](https://content.sirp.io/hs-fs/hubfs/SIRP-Logo-4c-KO.png?width=200&height=90&name=SIRP-Logo-4c-KO.png "SIRP-Logo-4c-KO")](https://sirp.io) ### Global Headquarter ##### United States 7735 Old Georgetown Rd, Suite 510 Bethesda, MD 20814 [+1 888 701 9252](tel:+18887019252) [mailto:email@email.com](mailto:email@email.com) Copyright © 2025, SIRP Labs Inc