CheckPhish

Details

ID	`CheckPhish`
Provider	BolsterAI
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Check any URL to detect supsicious behavior.

Configure CheckPhish in Cortex

Parameter	Description	Required
CheckPhish API URL		False
API Token		True
Good Dispositions (CheckPhish labels for non-phishing URLs. Default is “clean”)		False
Suspicious dispositions (CheckPhish labels for suspicious phishing URLs). Default is “drug_spam”, “gambling”, “hacked_website”, “streaming”, “suspicious”		False
Bad dispositions (CheckPhish labels for phishing URLs). Defaults are “cryptojacking”, “phish”, “likely_phish”, “scam”.		False
Source Reliability	Reliability of the source providing the intelligence data.	True
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

CheckPhish-check-urls

Checks URLs against the CheckPhish database and returns the results.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

CheckPhish-check-urls

Input

Argument Name	Description	Required
url	A CSV list of URLs to check.	Required

Context Output

Path	Type	Description
CheckPhish.URL.url	String	URL that was submitted.
CheckPhish.URL.status	String	CheckPhish job status of the URL.
CheckPhish.URL.jobID	String	CheckPhish jobID that was assigned to the URL when it was submitted.
CheckPhish.URL.disposition	String	The CheckPhish category (disposition) of the URL.
CheckPhish.URL.brand	String	The brand (attack target) countered by the URL.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.
URL.Data	String	URL that was submitted.
URL.Malicious.Vendor	String	CheckPhish.
URL.Malicious.Description	String	The brand (attack target) countered by the URL.

Command Example

!CheckPhish-check-urls url=`test.com

Context Example

{
    "CheckPhish": {
        "URL": {
            "brand": "unknown",
            "disposition": "clean",
            "jobID": "49a3a20b-ec4b-4581-9a55-56716d9e0c6e",
            "status": "DONE",
            "url": "http://test.com/"
        }
    },
    "DBotScore": {
        "Indicator": "http://test.com/",
        "Reliability": "B - Usually reliable",
        "Score": 1,
        "Type": "url",
        "Vendor": "CheckPhish"
    },
    "URL": {
        "Data": "http://test.com/"
    }
}

Human Readable Output

CheckPhish reputation for http://test.com/

url disposition brand status jobID

http://test.com/ clean unknown DONE 49a3a20b-ec4b-4581-9a55-56716d9e0c6e

url	disposition	brand	status	jobID
http://test.com/	clean	unknown	DONE	49a3a20b-ec4b-4581-9a55-56716d9e0c6e

url

Retrieves URL information from CheckPhish.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

url

Input

Argument Name	Description	Required
url	URL to query.	Required

Context Output

Path	Type	Description
CheckPhish.URL.url	String	URL that was submitted.
CheckPhish.URL.status	String	CheckPhish job status of the URL.
CheckPhish.URL.jobID	String	CheckPhish jobID that was assigned to the URL when it was submitted.
CheckPhish.URL.disposition	String	The CheckPhish category (disposition) of the URL.
CheckPhish.URL.brand	String	The brand (attack target) countered by the URL.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.
URL.Data	String	URL that was submitted.
URL.Malicious.Vendor	String	CheckPhish.
URL.Malicious.Description	String	The brand (attack target) countered by the URL.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.

Command Example

!url url=test.com

Context Example

{
    "CheckPhish": {
        "URL": {
            "brand": "unknown",
            "disposition": "clean",
            "jobID": "6df1ebef-3be3-48a9-8970-c5afeda8d58d",
            "status": "DONE",
            "url": "http://test.com/"
        }
    },
    "DBotScore": {
        "Indicator": "http://test.com/",
        "Reliability": "B - Usually reliable",
        "Score": 1,
        "Type": "url",
        "Vendor": "CheckPhish"
    },
    "URL": {
        "Data": "http://test.com/"
    }
}

Human Readable Output

CheckPhish reputation for http://test.com/

url disposition brand status jobID

http://test.com/ clean unknown DONE 6df1ebef-3be3-48a9-8970-c5afeda8d58d

url	disposition	brand	status	jobID
http://test.com/	clean	unknown	DONE	6df1ebef-3be3-48a9-8970-c5afeda8d58d

Configuration parameters

url — CheckPhish API URL
token — API Token
credentials_api_token —
good_disp — Good Dispositions (CheckPhish labels for non-phishing URLs. Default is "clean")
susp_disp — Suspicious dispositions (CheckPhish labels for suspicious phishing URLs). Default is "drug_spam", "gambling", "hacked_website", "streaming", "suspicious"
bad_disp — Bad dispositions (CheckPhish labels for phishing URLs). Defaults are "cryptojacking", "phish", "likely_phish", "scam".
integrationReliability — Source Reliability (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (2)

CheckPhish-check-urls
Checks URLs against the CheckPhish database and returns the results.
url
Retrieves URL information from CheckPhish.

Source

CheckPhish.py CheckPhish_test.py CheckPhish.yml CheckPhish_description.md command_examples.txt

Download History Raw

## Supported Dispositions
CheckPhish classifies URLs by the following dispositions (categories).
- Zero-day phishing
- Tech support scams
- Gift card scams
- Survey scams
- Adult websites
- Drug pharmacy (Drug Spam) websites
- Illegal/rogue streaming sites
- Gambling websites
- Hacked Websites
- Cryptojacking/cryptomining

## Sending URLs to Check
There is no limit to the number of URLs you can send in each call. The limit is determined by your API privileges. using commas between the URLs, 
for Example: www.demisto.com,www.google.com,www.youtube.com

## Modify Severity Levels
You can modify the severity levels of any disposition received from CheckPhish. We recommend the following default parameters:\
- Good = clean\
- Suspicious = drug_spam, gambling, hacked_website, streaming, suspicious\
- Bad = cryptojacking, phish, likely_phish, scam\

**Note**: The worst category in which a label is included will be the effective one. 

Notice: Submitting indicators using the following commands of this integration might make the indicator data publicly available.
- ***url***
- ***CheckPhish-check-urls***
See the vendor’s documentation for more details.