AgentSOC Mail Block token setup

A short walkthrough for producing the credential AgentSOC needs to block inbound email from a sender domain via the AgentSOC managed mail blocklist.

Screenshots: image placeholders below point at docs/images/mailblock-*.png. Capture each screenshot and drop it in at that path — the captions describe exactly what to show.

How the connection works

AgentSOC Mail Block is a managed integration — it talks to the AgentSOC phishing blocklist service, so there is no third-party cloud console to configure. Authentication is a single bearer token issued by that service. One value goes into the credential form:

ValueWhat it is
TokenA bearer token issued by the AgentSOC blocklist service

The blocklist service endpoint itself is configured on the platform (the PHISHING_BLOCKLIST_URL environment variable) and is not entered here.

Step 1 — Obtain a blocklist token

The token is issued by the AgentSOC managed blocklist service, not by an external provider.

  • If your deployment is operated by AgentSOC, request a blocklist token from your AgentSOC contact or support.
  • If you self-host the blocklist service, issue a token from that service following its own documentation.

Treat the token like a password — it authorizes adding and removing entries on the shared blocklist. Store it securely and rotate it on your usual schedule.

Step 1 — Blocklist token

Step 2 — Add the credential in AgentSOC and validate

  1. In AgentSOC, open AgentSOAR → Settings → Credentials (/agentsoar/settings/credentials).
  2. Add an AgentSOC Mail Block credential and paste the Token from Step 1.
  3. Save. AgentSOC validates the token against the blocklist service.
  4. Once it shows Healthy, the mail-block action is ready to use.

Step 2 — AgentSOC Add Mail Block credential form

Troubleshooting

ErrorLikely cause and fix
AgentSOC blocklist rejected the token (401/403)The token is wrong, expired, or revoked. Request a new token.
Network error reaching AgentSOC blocklistThe blocklist service is unreachable. Confirm the platform's PHISHING_BLOCKLIST_URL is set correctly and the service is up.
AgentSOC blocklist returned 5xxThe blocklist service is failing. Retry shortly, or contact your AgentSOC administrator.

Reference: Contact your AgentSOC administrator for blocklist service access.