CheckPhish

Check any URL to detect supsicious behavior.

Data Enrichment & Threat Intelligence · CheckPhish

Details

IDCheckPhish
ProviderBolsterAI
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Check any URL to detect supsicious behavior.

Configure CheckPhish in Cortex

Parameter Description Required
CheckPhish API URL   False
API Token   True
Good Dispositions (CheckPhish labels for non-phishing URLs. Default is “clean”)   False
Suspicious dispositions (CheckPhish labels for suspicious phishing URLs). Default is “drug_spam”, “gambling”, “hacked_website”, “streaming”, “suspicious”   False
Bad dispositions (CheckPhish labels for phishing URLs). Defaults are “cryptojacking”, “phish”, “likely_phish”, “scam”.   False
Source Reliability Reliability of the source providing the intelligence data. True
Trust any certificate (not secure)   False
Use system proxy settings   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

CheckPhish-check-urls

Checks URLs against the CheckPhish database and returns the results.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

CheckPhish-check-urls

Input

Argument Name Description Required
url A CSV list of URLs to check. Required

Context Output

Path Type Description
CheckPhish.URL.url String URL that was submitted.
CheckPhish.URL.status String CheckPhish job status of the URL.
CheckPhish.URL.jobID String CheckPhish jobID that was assigned to the URL when it was submitted.
CheckPhish.URL.disposition String The CheckPhish category (disposition) of the URL.
CheckPhish.URL.brand String The brand (attack target) countered by the URL.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
DBotScore.Reliability String Reliability of the source providing the intelligence data.
URL.Data String URL that was submitted.
URL.Malicious.Vendor String CheckPhish.
URL.Malicious.Description String The brand (attack target) countered by the URL.

Command Example

!CheckPhish-check-urls url=`test.com

Context Example

{
    "CheckPhish": {
        "URL": {
            "brand": "unknown",
            "disposition": "clean",
            "jobID": "49a3a20b-ec4b-4581-9a55-56716d9e0c6e",
            "status": "DONE",
            "url": "http://test.com/"
        }
    },
    "DBotScore": {
        "Indicator": "http://test.com/",
        "Reliability": "B - Usually reliable",
        "Score": 1,
        "Type": "url",
        "Vendor": "CheckPhish"
    },
    "URL": {
        "Data": "http://test.com/"
    }
}

Human Readable Output

CheckPhish reputation for http://test.com/

url disposition brand status jobID
http://test.com/ clean unknown DONE 49a3a20b-ec4b-4581-9a55-56716d9e0c6e

url

Retrieves URL information from CheckPhish.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

url

Input

Argument Name Description Required
url URL to query. Required

Context Output

Path Type Description
CheckPhish.URL.url String URL that was submitted.
CheckPhish.URL.status String CheckPhish job status of the URL.
CheckPhish.URL.jobID String CheckPhish jobID that was assigned to the URL when it was submitted.
CheckPhish.URL.disposition String The CheckPhish category (disposition) of the URL.
CheckPhish.URL.brand String The brand (attack target) countered by the URL.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
DBotScore.Reliability String Reliability of the source providing the intelligence data.
URL.Data String URL that was submitted.
URL.Malicious.Vendor String CheckPhish.
URL.Malicious.Description String The brand (attack target) countered by the URL.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
DBotScore.Reliability String Reliability of the source providing the intelligence data.

Command Example

!url url=test.com

Context Example

{
    "CheckPhish": {
        "URL": {
            "brand": "unknown",
            "disposition": "clean",
            "jobID": "6df1ebef-3be3-48a9-8970-c5afeda8d58d",
            "status": "DONE",
            "url": "http://test.com/"
        }
    },
    "DBotScore": {
        "Indicator": "http://test.com/",
        "Reliability": "B - Usually reliable",
        "Score": 1,
        "Type": "url",
        "Vendor": "CheckPhish"
    },
    "URL": {
        "Data": "http://test.com/"
    }
}

Human Readable Output

CheckPhish reputation for http://test.com/

url disposition brand status jobID
http://test.com/ clean unknown DONE 6df1ebef-3be3-48a9-8970-c5afeda8d58d

Configuration parameters

  • url — CheckPhish API URL
  • token — API Token
  • credentials_api_token —
  • good_disp — Good Dispositions (CheckPhish labels for non-phishing URLs. Default is "clean")
  • susp_disp — Suspicious dispositions (CheckPhish labels for suspicious phishing URLs). Default is "drug_spam", "gambling", "hacked_website", "streaming", "suspicious"
  • bad_disp — Bad dispositions (CheckPhish labels for phishing URLs). Defaults are "cryptojacking", "phish", "likely_phish", "scam".
  • integrationReliability — Source Reliability (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (2)

  • CheckPhish-check-urls

    Checks URLs against the CheckPhish database and returns the results.

  • url

    Retrieves URL information from CheckPhish.

Source

CheckPhish.py CheckPhish_test.py CheckPhish.yml CheckPhish_description.md command_examples.txt
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: BolsterAI
commonfields:
  id: CheckPhish
  version: -1
configuration:
- defaultvalue: https://developers.checkphish.ai/api/neo/scan
  display: CheckPhish API URL
  name: url
  type: 0
  required: false
- display: API Token
  name: token
  type: 4
  hidden: true
  required: false
- displaypassword: API Token
  name: credentials_api_token
  hiddenusername: true
  type: 9
  required: false
- display: 'Good Dispositions (CheckPhish labels for non-phishing URLs. Default is "clean")'
  name: good_disp
  options:
  - adult
  - cryptojacking
  - drug_spam
  - gambling
  - hacked_website
  - likely_phish
  - phish
  - scam
  - streaming
  - suspicious
  type: 16
  required: false
- display: 'Suspicious dispositions (CheckPhish labels for suspicious phishing URLs). Default is "drug_spam", "gambling", "hacked_website", "streaming", "suspicious"'
  name: susp_disp
  options:
  - adult
  - cryptojacking
  - drug_spam
  - gambling
  - hacked_website
  - likely_phish
  - phish
  - scam
  - streaming
  - suspicious
  type: 16
  required: false
- display: 'Bad dispositions (CheckPhish labels for phishing URLs). Defaults are "cryptojacking", "phish", "likely_phish", "scam".'
  name: bad_disp
  options:
  - adult
  - cryptojacking
  - drug_spam
  - gambling
  - hacked_website
  - likely_phish
  - phish
  - scam
  - streaming
  - suspicious
  type: 16
  required: false
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
description: Check any URL to detect supsicious behavior.
display: CheckPhish
name: CheckPhish
script:
  commands:
  - arguments:
    - description: A CSV list of URLs to check.
      isArray: true
      name: url
      required: true
    description: Checks URLs against the CheckPhish database and returns the results.
    name: CheckPhish-check-urls
    outputs:
    - contextPath: CheckPhish.URL.url
      description: URL that was submitted.
      type: String
    - contextPath: CheckPhish.URL.status
      description: CheckPhish job status of the URL.
      type: String
    - contextPath: CheckPhish.URL.jobID
      description: CheckPhish jobID that was assigned to the URL when it was submitted.
      type: String
    - contextPath: CheckPhish.URL.disposition
      description: The CheckPhish category (disposition) of the URL.
      type: String
    - contextPath: CheckPhish.URL.brand
      description: The brand (attack target) countered by the URL.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: URL.Data
      description: URL that was submitted.
      type: String
    - contextPath: URL.Malicious.Vendor
      description: CheckPhish.
      type: String
    - contextPath: URL.Malicious.Description
      description: The brand (attack target) countered by the URL.
      type: String
  - arguments:
    - default: true
      description: URL to query.
      isArray: true
      name: url
      required: true
    description: Retrieves URL information from CheckPhish.
    name: url
    outputs:
    - contextPath: CheckPhish.URL.url
      description: URL that was submitted.
      type: String
    - contextPath: CheckPhish.URL.status
      description: CheckPhish job status of the URL.
      type: String
    - contextPath: CheckPhish.URL.jobID
      description: CheckPhish jobID that was assigned to the URL when it was submitted.
      type: String
    - contextPath: CheckPhish.URL.disposition
      description: The CheckPhish category (disposition) of the URL.
      type: String
    - contextPath: CheckPhish.URL.brand
      description: The brand (attack target) countered by the URL.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: URL.Data
      description: URL that was submitted.
      type: String
    - contextPath: URL.Malicious.Vendor
      description: CheckPhish.
      type: String
    - contextPath: URL.Malicious.Description
      description: The brand (attack target) countered by the URL.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 5.0.0
tests:
- No tests