Email Hippo

This is the Email Hippo integration used to verify email sources as fake emails that were used as part of phishing attacks.

Data Enrichment & Threat Intelligence · Email Hippo

Details

IDEmail Hippo
ProviderEmailHippo
CategoryData Enrichment & Threat Intelligence
From Version6.9.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

This is the Email Hippo integration used to verify email sources as fake emails that were used as part of phishing attacks.
.
This integration was integrated and tested with version 2.0.1551 of Email Hippo.

Configure Email Hippo in Cortex

Parameter Description Required
MORE Server URL (e.g., https://api.hippoapi.com)   True
Email Hippo WHOIS Server URL (e.g., https://api.whoishippo.com)   True
MORE API Key   True
WHOIS API Key   True
Source Reliability Reliability of the source providing the intelligence data. False
Create relationships Create relationships between indicators as part of enrichment. False
Trust any certificate (not secure)   False
Use system proxy settings   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

email-hippo-email-quota-get

Get the email quota from the API.

Base Command

email-hippo-email-quota-get

Input

There are no input arguments for this command.

Context Output

Path Type Description
EmailHippo.Quota.quotaUsed String Total quota used.
EmailHippo.Quota.quotaRemaining String The remaining quota.

Command example


#### Context Example

```json
{
    "EmailHippo": {
        "Quota": {
            "accountId": 7031,
            "errorSummary": "Valid",
            "nextQuotaResetDate": "2023-12-28T00:00:00",
            "quotaRemaining": 99,
            "quotaUsed": 1,
            "reportedDate": "2023-11-28T12:49:16.0260781Z"
        }
    }
}

Human Readable Output

Email quota

Email Quota remaining Email Quota used
99 1

email

Return email information and reputation.

Base Command

email

Input

Argument Name Description Required
email A comma-separated list of email addresses to validate. Required

Context Output

Path Type Description
DBotScore.Indicator String The indicator that was tested.
DBotScore.Reliability String Reliability of the source providing the intelligence data.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
Email.Address String The email address of the indicator.
Email.Domain string The email domain.
EmailHippo.Email.Address String The email address of the indicator.

Command example

!email email=test@example.com

Context Example

{
    "DBotScore": {
        "Indicator": "test@example.com",
        "Reliability": "C - Fairly reliable",
        "Score": 1,
        "Type": "email",
        "Vendor": "Email Hippo"
    },
    "Email": {
        "Address": "test@example.com",
        "Domain": "example.com"
    },
    "EmailHippo": {
        "Email": {
            "Address": "test@example.com",
            "diagnostic": {
                "key": "e4ddf797-f25b-410b-a753-58234759a67a"
            },
            "disposition": {
                "isFreeMail": false,
                "isRole": true
            },
            "domain": null,
            "emailVerification": {
                "dnsVerification": {
                    "isDomainHasDnsRecord": true,
                    "isDomainHasMxRecords": true,
                    "mxRecords": [
                        {
                            "exchange": ".",
                            "ipAddresses": null,
                            "preference": 0
                        }
                    ],
                    "recordRoot": {
                        "ipAddresses": [
                            "93.184.216.34"
                        ]
                    },
                    "recordWww": {
                        "ipAddresses": [
                            "93.184.216.34"
                        ]
                    },
                    "txtRecords": [
                        "\"wgyf8z8cgvm2qmxpnbnldrcltvk4xqfn\"",
                        "\"v=spf1 -all\""
                    ]
                },
                "mailboxVerification": {
                    "reason": "DomainIsWellKnownDea",
                    "result": "Unverifiable"
                },
                "syntaxVerification": {
                    "isSyntaxValid": true,
                    "reason": "Success"
                }
            },
            "hippoTrust": {
                "level": "Low",
                "score": 0
            },
            "infrastructure": {
                "mail": {
                    "mailServerLocation": null,
                    "serviceTypeId": "Other",
                    "smtpBanner": null
                },
                "web": {
                    "hasAliveWebServer": true
                }
            },
            "meta": {
                "domain": "example.com",
                "email": "test@example.com",
                "emailHashMd5": "55502f40dc8b7c769880b10874abc9d0",
                "emailHashSha1": "567159d622ffbb50b11b0efd307be358624a26ee",
                "emailHashSha256": "973dfe463ec85785f5f95af5ba3906eedb2d931c24e69824a89ea65dba4e813b",
                "expires": "Sat, 24 Feb 2024 23:31:57 GMT",
                "lastModified": "Mon, 28 Aug 2023 23:31:57 GMT",
                "subDomain": null,
                "tld": "com",
                "user": "test"
            },
            "performance": {
                "dnsLookup": 740,
                "mailboxVerification": 0,
                "other": 0,
                "overallExecutionTime": 818,
                "spamAssessment": 0,
                "syntaxCheck": 0,
                "webInfrastructurePing": 78
            },
            "sendAssess": {
                "inboxQualityScore": 0.1,
                "sendRecommendation": "DoNotSend"
            },
            "social": {
                "gravatar": {
                    "imageUrl": "//www.gravatar.com/avatar/55502f40dc8b7c769880b10874abc9d0",
                    "profileUrl": "//www.gravatar.com/55502f40dc8b7c769880b10874abc9d0"
                }
            },
            "spamAssess": {
                "actionRecomendation": "Block",
                "blockLists": [
                    {
                        "blockListName": "spamhaus",
                        "isListed": false,
                        "listedMoreInfo": null,
                        "listedReason": null
                    }
                ],
                "domainRiskScore": 10,
                "formatRiskScore": 0,
                "isDarkWebEmailAddress": false,
                "isDisposableEmailAddress": true,
                "isGibberishDomain": false,
                "isGibberishUser": false,
                "overallRiskScore": 10,
                "profanityRiskScore": 0
            },
            "spamTrapAssess": {
                "isSpamTrap": false,
                "spamTrapDescriptor": null
            },
            "version": {
                "doc": "https://api-docs.emailhippo.com/en/latest/",
                "v": "More-(1.2.1091)"
            }
        }
    }
}

Human Readable Output

Email test@example.com

Hippo Trust Score Inbox quality score Result Spam risk score
Low DoNotSend result: Unverifiable
reason: DomainIsWellKnownDea		 Block

domain

Returns domain information and reputation.

Base Command

domain

Input

Argument Name Description Required
domain The domain to query (CSV). Required

Context Output

Path Type Description
DBotScore.Indicator String The indicator that was tested.
DBotScore.Reliability String The reliability score of the vendor.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
Domain.Name String The name of the domain that was checked.
Domain.NameServers String Name of the servers of the domain.
Domain.UpdatedDate Date The date that the domain was last updated.
Domain.CreationDate Date The creation date of the domain. Format is ISO8601 (i.e.,’2020-04-30T10:35:00.000Z’).
Domain.Registrar.Name String The name of the registrar.
Domain.Registrar.AbuseEmail String The email address of the contact for reporting abuse.
Domain.Registrar.AbusePhone String The phone number of the contact for reporting abuse.
Domain.Admin.Country String The country of the domain administrator.
Domain.Admin.Email String The email address of the domain administrator.
Domain.Admin.Name String The name of the domain administrator.
Domain.Admin.Phone String The phone number of the domain administrator.
Domain.Tech.Country String The country of tech administrator.
Domain.Tech.Name String The name of the tech administrator.
Domain.Tech.Email String The email of the tech administrator.
Domain.Tech.Organization String The organization of the tech administrator.
Domain.WHOIS.NameServers String A CSV string of name servers, for example ‘ns1.bla.com, ns2.bla.com’.
Domain.WHOIS.CreationDate Date The creation date of the domain. Format is ISO8601 (i.e., ‘2020-04-30T10:35:00.000Z’).
Domain.WHOIS.UpdatedDate Date The date when the domain was last updated. Format is ISO8601 (i.e., ‘2020-04-30T10:35:00.000Z’).
Domain.WHOIS.ExpirationDate Date The expiration date of the domain.

Command example

!domain domain=example.com

Context Example

{
    "DBotScore": {
        "Indicator": "example.com",
        "Reliability": "C - Fairly reliable",
        "Score": 0,
        "Type": "domain",
        "Vendor": "Email Hippo"
    },
    "Domain": {
        "CreationDate": "2018-08-21T14:02:43.000Z",
        "Name": "example.com",
        "NameServers": [
            {
                "Address": "A.example.NET"
            },
            {
                "Address": "B.example.NET"
            }
        ],
        "UpdatedDate": "2018-08-21T14:02:43.000Z",
        "WHOIS": {
            "CreationDate": "2018-08-21T14:02:43.000Z",
            "NameServers": [
                {
                    "Address": "A.example.NET"
                },
                {
                    "Address": "B.example.NET"
                }
            ],
            "UpdatedDate": "2018-08-21T14:02:43.000Z"
        }
    },
    "EmailHippo": {
        "Domain": {
            "creation_date": "2018-08-21T14:02:43.000Z",
            "domain": "example.com",
            "meta": {
                "domain": "example.com",
                "domainAge": "0 year(s), 0 month(s), 0 week(s), 0 day(s)",
                "domainAgeIso8601": "P0D",
                "domainAgeSeconds": 0,
                "executionTime": 2092,
                "parseCode": "Success",
                "recordAge": "5 year(s), 3 months, 0 week(s), 6 day(s), 22 hour(s), 46 minute(s)",
                "recordAgeIso8601": "P5Y3M6DT22H46M23.4811208S",
                "recordCreatedDate": "2018-08-21T14:02:43Z",
                "recordUpdatedDate": "2018-08-21T14:02:43Z",
                "timeToExpiry": "0 year(s), 0 months, 0 week(s), 0 day(s)",
                "timeToExpiryIso8601": "P0D",
                "timeToExpirySeconds": 0,
                "tld": "com"
            },
            "updated_date": "2018-08-21T14:02:43.000Z",
            "version": {
                "doc": "https://emailhippo.github.io/whois-developers",
                "v": "1.0.511"
            },
            "whoisServerRecord": {
                "adminContact": {
                    "city": "",
                    "country": "",
                    "email": "",
                    "faxNumber": "",
                    "faxNumberExt": "",
                    "name": "",
                    "organization": "",
                    "phoneNumber": "",
                    "phoneNumberExt": "",
                    "postalCode": "",
                    "state": "",
                    "street1": "",
                    "street2": null,
                    "street3": null,
                    "street4": null,
                    "userId": ""
                },
                "billingContact": {
                    "city": null,
                    "country": null,
                    "email": null,
                    "faxNumber": null,
                    "faxNumberExt": null,
                    "name": null,
                    "organization": null,
                    "phoneNumber": null,
                    "phoneNumberExt": null,
                    "postalCode": null,
                    "state": null,
                    "street1": null,
                    "street2": null,
                    "street3": null,
                    "street4": null,
                    "userId": null
                },
                "changed": null,
                "created": null,
                "customFields": null,
                "dnsSec": "",
                "domainHandle": "",
                "domainName": "example.com",
                "domainOwnerContact": {
                    "city": "",
                    "country": "",
                    "email": "",
                    "faxNumber": "",
                    "faxNumberExt": "",
                    "name": "",
                    "organization": "",
                    "phoneNumber": "",
                    "phoneNumberExt": "",
                    "postalCode": "",
                    "state": "",
                    "street1": "",
                    "street2": null,
                    "street3": null,
                    "street4": null,
                    "userId": ""
                },
                "domainStati": null,
                "expiry": null,
                "nameServers": [
                    {
                        "Address": "A.example.NET"
                    },
                    {
                        "Address": "B.example.NET"
                    }
                ],
                "recordFound": true,
                "registrar": {
                    "abuseEmail": "",
                    "abusePhone": "",
                    "name": "",
                    "registrarId": "",
                    "url": "",
                    "whois": "--UNSPECIFIED--"
                },
                "registrarContact": {
                    "city": null,
                    "country": null,
                    "email": null,
                    "faxNumber": null,
                    "faxNumberExt": null,
                    "name": null,
                    "organization": null,
                    "phoneNumber": null,
                    "phoneNumberExt": null,
                    "postalCode": null,
                    "state": null,
                    "street1": null,
                    "street2": null,
                    "street3": null,
                    "street4": null,
                    "userId": null
                },
                "remarks": null,
                "reseller": "",
                "techContact": {
                    "city": "",
                    "country": "",
                    "email": "",
                    "faxNumber": "",
                    "faxNumberExt": "",
                    "name": "",
                    "organization": "",
                    "phoneNumber": "",
                    "phoneNumberExt": "",
                    "postalCode": "",
                    "state": "",
                    "street1": "",
                    "street2": null,
                    "street3": null,
                    "street4": null,
                    "userId": ""
                },
                "tld": "com",
                "zoneContact": {
                    "city": null,
                    "country": null,
                    "email": null,
                    "faxNumber": null,
                    "faxNumberExt": null,
                    "name": null,
                    "organization": null,
                    "phoneNumber": null,
                    "phoneNumberExt": null,
                    "postalCode": null,
                    "state": null,
                    "street1": null,
                    "street2": null,
                    "street3": null,
                    "street4": null,
                    "userId": null
                }
            }
        }
    }
}

Human Readable Output

Domain example.com

Domain Age Expires On Name servers Registered On Registrar Status Time To Expiry Updated On
0 year(s), 0 month(s), 0 week(s), 0 day(s)   {‘Address’: ‘A.example.NET’},
{‘Address’: ‘B.example.NET’}		       0 year(s), 0 months, 0 week(s), 0 day(s)  

Configuration parameters

  • more_server_url — MORE Server URL (e.g., https://api.hippoapi.com) (required)
  • whois_server_url — Email Hippo WHOIS Server URL (e.g., https://api.whoishippo.com) (required)
  • more_credentials — (required)
  • whois_credentials — (required)
  • integrationReliability — Source Reliability
  • create_relationships — Create relationships
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (3)

  • domain

    Returns domain information and reputation.

  • email

    Return email information and reputation.

  • email-hippo-email-quota-get

    Get the email quota from the API.

Source

EmailHippo.py EmailHippo_test.py EmailHippo.yml EmailHippo_description.md command_examples.txt
Download History Raw 
commonfields:
  id: Email Hippo
  version: -1
name: Email Hippo
display: Email Hippo
category: Data Enrichment & Threat Intelligence
provider: EmailHippo
description: "This is the Email Hippo integration used to verify email sources as fake emails that were used as part of phishing attacks."
configuration:
- section: Connect
  display: MORE Server URL (e.g., https://api.hippoapi.com)
  name: more_server_url
  defaultvalue: https://api.hippoapi.com
  type: 0
  required: true
- section: Connect
  display: Email Hippo WHOIS Server URL (e.g., https://api.whoishippo.com)
  name: whois_server_url
  defaultvalue: https://api.whoishippo.com
  type: 0
  required: true
- section: Connect
  display: ''
  displaypassword: MORE API Key
  name: more_credentials
  type: 9
  required: true
  hiddenusername: true
- section: Connect
  display: ''
  displaypassword: WHOIS API Key
  name: whois_credentials
  type: 9
  required: true
  hiddenusername: true
- section: Collect
  display: Source Reliability
  name: integrationReliability
  defaultvalue: C - Fairly reliable
  type: 15
  required: false
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  additionalinfo: Reliability of the source providing the intelligence data.
- section: Collect
  display: Create relationships
  name: create_relationships
  defaultvalue: 'true'
  type: 8
  required: false
  additionalinfo: Create relationships between indicators as part of enrichment.
- section: Connect
  advanced: true
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- section: Connect
  advanced: true
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
script:
  script: ''
  type: python
  commands:
  - name: email-hippo-email-quota-get
    outputs:
    - contextPath: EmailHippo.Quota.quotaUsed
      description: Total quota used.
      type: String
    - contextPath: EmailHippo.Quota.quotaRemaining
      description: The remaining quota.
      type: String
    description: Get the email quota from the API.
  - name: email
    arguments:
    - name: email
      required: true
      isArray: true
      description: A comma-separated list of email addresses to validate.
      default: true
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: Email.Address
      description: The email address of the indicator.
      type: String
    - contextPath: Email.Domain
      description: The email domain.
      type: string
    - contextPath: EmailHippo.Email.Address
      description: The email address of the indicator.
      type: String
    description: Return email information and reputation.
  - name: domain
    arguments:
    - name: domain
      required: true
      isArray: true
      description: The domain to query (CSV).
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Reliability
      description: The reliability score of the vendor.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: Domain.Name
      description: The name of the domain that was checked.
      type: String
    - contextPath: Domain.NameServers
      description: Name of the servers of the domain.
      type: String
    - contextPath: Domain.UpdatedDate
      description: The date that the domain was last updated.
      type: Date
    - contextPath: Domain.CreationDate
      description: The creation date of the domain. Format is ISO8601 (i.e., '2020-04-30T10:35:00.000Z').
      type: Date
    - contextPath: Domain.Registrar.Name
      description: The name of the registrar.
      type: String
    - contextPath: Domain.Registrar.AbuseEmail
      description: The email address of the contact for reporting abuse.
      type: String
    - contextPath: Domain.Registrar.AbusePhone
      description: The phone number of the contact for reporting abuse.
      type: String
    - contextPath: Domain.Admin.Country
      description: The country of the domain administrator.
      type: String
    - contextPath: Domain.Admin.Email
      description: The email address of the domain administrator.
      type: String
    - contextPath: Domain.Admin.Name
      description: The name of the domain administrator.
      type: String
    - contextPath: Domain.Admin.Phone
      description: The phone number of the domain administrator.
      type: String
    - contextPath: Domain.Tech.Country
      description: The country of the tech administrator.
      type: String
    - contextPath: Domain.Tech.Name
      description: The name of the tech administrator.
      type: String
    - contextPath: Domain.Tech.Email
      description: The email of the tech administrator.
      type: String
    - contextPath: Domain.Tech.Organization
      description: The organization of the tech administrator.
      type: String
    - contextPath: Domain.WHOIS.NameServers
      description: A CSV string of name servers, for example 'ns1.bla.com, ns2.bla.com'.
      type: String
    - contextPath: Domain.WHOIS.CreationDate
      description: The creation date of the domain. Format is ISO8601 (i.e., '2020-04-30T10:35:00.000Z').
      type: Date
    - contextPath: Domain.WHOIS.UpdatedDate
      description: The date when the domain was last updated. Format is ISO8601 (i.e., '2020-04-30T10:35:00.000Z').
      type: Date
    - contextPath: Domain.WHOIS.ExpirationDate
      description: The expiration date of the domain.
      type: Date
    description: Returns domain information and reputation.
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: false
  subtype: python3
fromversion: 6.9.0
tests:
- No tests (auto formatted)