FraudWatch

Manage incidents via the Fraudwatch API. FraudWatch International provides a fully managed Enterprise Digital Brand Protection Suite, including online brand management & monitoring as well as providing other brand protection solutions that protect organizations and their customers around the world against online brand-related abuse.
This integration was integrated and tested with version v1 of FraudWatch Phishportal

Retrieve FraudWatch API token

1. Navigate to the Phishportal site.
2. Enter your Username and Password.
3. On the left sidebar, click on ‘Portal API’.
4. On the top of the page, you should see your API Token.
5. If the API token is out of date, click on the Regenerate Token button adjacent to the API token, to generate a new token.
6. Set the API token in the Password parameter.
   NOTE: no need to set the Username parameter it can be left blank (visible only on 6.0.2 and lower versions).

Configure FraudWatch on Cortex XSOAR

1. Navigate to Settings > Integrations > Servers & Services.
2. Search for FraudWatch.

3. Click Add instance to create and configure a new integration instance.

   Parameter	Description	Required
   Fetch incidents		False
   API Token (leave empty. Fill in the API token in the password field.)		False
   Server URL	URL of the server.	True
   Brand	Fetch incidents that match the specified brand. An error is encountered if the brand does not exist. A list of the existing brands can be retrieved by the ‘fraudwatch-brands-list’ command.	False
   Status	Fetch incidents that have the specified status.	False
   Incident type		False
   Incidents Fetch Interval		False
   First fetch timestamp	format: (<number> <time unit>, e.g., 12 hours, 1 day)	False
   Maximum Incidents To Fetch		False
   Trust any certificate (not secure)		False
   Use system proxy settings		False

4. Click Test to validate the URLs, token, and connection.

Fetch Incidents

Due to limitations in FraudWatch API, first fetch timestamp can be at most 1 day.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

fraudwatch-incidents-list

Get a list of incidents from FraudWatch service.

Base Command

fraudwatch-incidents-list

Input

Context Output

Command Example

!fraudwatch-incidents-list brand="Testing Brand 2" from="2020-12-12" limit=3 status=monitor

Context Example

{
    "FraudWatch": {
        "Incident": [
            {
                "active_duration": null,
                "additional_urls": [
                    "http://www.malicious2.com",
                    "http://www.malicious3.com",
                    "http://www.malicious4.com",
                    "http://www.malicious5.com"
                ],
                "brand": "Testing Brand 2",
                "client": "Palo Alto",
                "content_ip": null,
                "created_by": "Client",
                "current_duration": "85882",
                "date_closed": null,
                "date_opened": "2021-02-07T15:37:12.000Z",
                "discovered_by": "client",
                "host": null,
                "host_country": null,
                "host_timezone": null,
                "identifier": "JJJ-595483",
                "link": "https://www.phishportal.com/client/incident/JJJ-595483",
                "reference_id": "abc1234",
                "status": "monitor",
                "type": "Vishing",
                "url": "http://www.malicious.com"
            },
            {
                "active_duration": null,
                "additional_urls": [
                    "http://www.malicious2.com",
                    "http://www.malicious3.com",
                    "http://www.malicious4.com",
                    "http://www.malicious5.com"
                ],
                "brand": "Testing Brand 2",
                "client": "Palo Alto",
                "content_ip": null,
                "created_by": "Client",
                "current_duration": "86649",
                "date_closed": null,
                "date_opened": "2021-02-07T15:24:25.000Z",
                "discovered_by": "client",
                "host": null,
                "host_country": null,
                "host_timezone": null,
                "identifier": "JJJ-992295",
                "link": "https://www.phishportal.com/client/incident/JJJ-992295",
                "reference_id": "abc1234",
                "status": "monitor",
                "type": "Vishing",
                "url": "http://www.malicious.com"
            },
            {
                "active_duration": null,
                "additional_urls": [
                    "abuse.com"
                ],
                "brand": "Testing Brand 2",
                "client": "Palo Alto",
                "content_ip": "192.168.0.1",
                "created_by": "Client",
                "current_duration": "340758",
                "date_closed": null,
                "date_opened": "2021-02-04T16:49:16.000Z",
                "discovered_by": "client",
                "host": null,
                "host_country": null,
                "host_timezone": null,
                "identifier": "JJJ-302171",
                "link": "https://www.phishportal.com/client/incident/JJJ-302171",
                "reference_id": "malicious1",
                "status": "monitor",
                "type": "Brand Abuse",
                "url": "http://malicious.com"
            }
        ]
    }
}

Human Readable Output

FraudWatch Incidents

identifier	reference_id	url	status	type	brand	client	content_ip	created_by	discovered_by	current_duration	date_opened	additional_urls	link
JJJ-595483	abc1234	http://www.malicious.com	monitor	Vishing	Testing Brand 2	Palo Alto		Client	client	85882	2021-02-07T15:37:12.000Z	http://www.malicious2.com, http://www.malicious3.com, http://www.malicious4.com, http://www.malicious5.com	https://www.phishportal.com/client/incident/JJJ-595483
JJJ-992295	abc1234	http://www.malicious.com	monitor	Vishing	Testing Brand 2	Palo Alto		Client	client	86649	2021-02-07T15:24:25.000Z	http://www.malicious2.com, http://www.malicious3.com, http://www.malicious4.com, http://www.malicious5.com	https://www.phishportal.com/client/incident/JJJ-992295
JJJ-302171	malicious1	http://malicious.com	monitor	Brand Abuse	Testing Brand 2	Palo Alto	192.168.0.1	Client	client	340758	2021-02-04T16:49:16.000Z	abuse.com	https://www.phishportal.com/client/incident/JJJ-302171

fraudwatch-incident-report

Report an incident to FraudWatch service.

Base Command

fraudwatch-incident-report

Input

Context Output

Command Example

!fraudwatch-incident-report brand="Testing Brand 1" primary_url="http://www.maliciousaddress.com" type="vishing" reference_id="abc123" urls="http://abuse.com"

Context Example

{
    "FraudWatch": {
        "Incident": {
            "active_duration": null,
            "additional_urls": [
                "http://abuse.com"
            ],
            "brand": "Testing Brand 1",
            "client": "Palo Alto",
            "content_ip": null,
            "created_by": "FraudWatch",
            "current_duration": "0",
            "date_closed": null,
            "date_opened": "2021-02-08T15:28:37.000Z",
            "discovered_by": "client",
            "host": null,
            "host_country": null,
            "host_timezone": null,
            "identifier": "JJJ-358877",
            "link": "https://www.phishportal.com/client/incident/JJJ-358877",
            "reference_id": "abc123",
            "status": "monitor",
            "type": "Vishing",
            "url": "http://www.maliciousaddress.com"
        }
    }
}

Human Readable Output

Created FraudWatch Incident

additional_urls	brand	client	created_by	current_duration	date_opened	discovered_by	identifier	link	reference_id	status	type	url
http://abuse.com	Testing Brand 1	Palo Alto	FraudWatch	0	2021-02-08T15:28:37.000Z	client	JJJ-358877	https://www.phishportal.com/client/incident/JJJ-358877	abc123	monitor	Vishing	http://www.maliciousaddress.com

fraudwatch-incident-update

Updates the incident associated with the ‘incident_id’ with the specified argument values.

Base Command

fraudwatch-incident-update

Input

Context Output

There is no context output for this command.

Command Example

!fraudwatch-incident-update incident_id=JJJ-504830 brand="Testing Brand 2" reference_id="reference123"

Human Readable Output

Incident with ID JJJ-504830 was updated successfully

fraudwatch-incident-get-by-identifier

Gets an incident from FraudWatch service by its reference ID or incident ID. Single values of ‘reference_id’ and ‘incident_id’ should be specified.

Base Command

fraudwatch-incident-get-by-identifier

Input

Context Output

Command Example

!fraudwatch-incident-get-by-identifier incident_id=JJJ-168840

Context Example

{
    "FraudWatch": {
        "Incident": {
            "active_duration": null,
            "additional_urls": [
                "http://malicious1.com",
                "http://malicious2.com"
            ],
            "brand": "Testing Brand 1",
            "client": "Palo Alto",
            "content_ip": null,
            "created_by": "Client",
            "current_duration": "514313",
            "date_closed": null,
            "date_opened": "2021-02-02T16:36:50.000Z",
            "discovered_by": "client",
            "host": null,
            "host_country": null,
            "host_timezone": null,
            "identifier": "JJJ-168840",
            "link": "https://www.phishportal.com/client/incident/JJJ-168840",
            "reference_id": null,
            "status": "monitor",
            "type": "Vishing",
            "url": "test.com"
        }
    }
}

Human Readable Output

FraudWatch Incident

additional_urls	brand	client	created_by	current_duration	date_opened	discovered_by	identifier	link	status	type	url
http://malicious1.com, http://malicious2.com	Testing Brand 1	Palo Alto	Client	514313	2021-02-02T16:36:50.000Z	client	JJJ-168840	https://www.phishportal.com/client/incident/JJJ-168840	monitor	Vishing	test.com

fraudwatch-incident-forensic-get

Gets the forensic data of the incident associated with the specified incident ID.

Base Command

fraudwatch-incident-forensic-get

Input

Context Output

Command Example

!fraudwatch-incident-forensic-get incident_id=JJJ-397266

Context Example

{
    "FraudWatch": {
        "IncidentForensicData": {
            "host_domain_registrar": {
                "country": "abuse@address.com",
                "email": "http://www.abuseaddress.com",
                "name": "Moniker Online Services LLC"
            },
            "host_nameservers": [
                "NS1.IRAN.COM",
                "NS2.IRAN.COM"
            ],
            "identifier": "JJJ-397266"
        }
    }
}

Human Readable Output

FraudWatch Incident Forensic Data

host_domain_registrar	host_nameservers	identifier
name: Moniker Online Services LLC email: http://www.abuseaddress.com country: abuse@address.com	NS1.IRAN.COM, NS2.IRAN.COM	JJJ-397266

fraudwatch-incident-contact-emails-list

Provides a list of the messages related to the incident associated with the specified incident ID.

Base Command

fraudwatch-incident-contact-emails-list

Input

Context Output

Command Example

!fraudwatch-incident-contact-emails-list incident_id=JJJ-898410 limit=2

Context Example

{
    "FraudWatch": {
        "IncidentContacts": [
            {
                "content": "This incident is very malicious, please monitor it\r\n",
                "creator": "Client",
                "date": "2021-02-08T15:26:19.000Z",
                "noteId": "11081853",
                "subject": "Client Reply"
            },
            {
                "content": "This incident is very malicious, please monitor it\r\n",
                "creator": "Client",
                "date": "2021-02-08T15:21:58.000Z",
                "noteId": "11081828",
                "subject": "Client Reply"
            }
        ]
    }
}

Human Readable Output

FraudWatch Incident Contacts Data

noteId	subject	creator	content	date
11081853	Client Reply	Client	This incident is very malicious, please monitor it	2021-02-08T15:26:19.000Z
11081828	Client Reply	Client	This incident is very malicious, please monitor it	2021-02-08T15:21:58.000Z

fraudwatch-incident-messages-add

Add a new related message to the incident associated with the specified incident ID.

Base Command

fraudwatch-incident-messages-add

Input

Context Output

There is no context output for this command.

Command Example

!fraudwatch-incident-messages-add incident_id=JJJ-898410 message_content="This incident is very malicious, please monitor it"

Human Readable Output

Message for incident id JJJ-898410 was added successfully

fraudwatch-incident-urls-add

Adds additional URLs to the incident associated with the specified incident ID. Fails if one of the new urls already exists.

Base Command

fraudwatch-incident-urls-add

Input

Context Output

Command Example

!fraudwatch-incident-urls-add incident_id=JJJ-162968 urls=http://www.malicious1.com,http://www.malicious2.com

Context Example

{
    "FraudWatch": {
        "IncidentUrls": {
            "new_urls": [
                "http://www.malicious1.com",
                "http://www.malicious2.com"
            ],
            "success": "Add additional urls successfully"
        }
    }
}

Human Readable Output

FraudWatch Incident Urls

new_urls	success
http://www.malicious1.com, http://www.malicious2.com	Add additional urls successfully

fraudwatch-incident-attachment-upload

Adds a new file attachment to the incident associated with the specified incident ID.

Base Command

fraudwatch-incident-attachment-upload

Input

Context Output

There is no context output for this command.

Command Example

!fraudwatch-incident-attachment-upload entry_id=fmSNZSY2fSCA2WptU8rddf@d382f488-92db-400c-87ff-fdd71f3b7408 incident_id=JJJ-604206

Human Readable Output

File fraud_test.txt was uploaded successfully to incident with an incident id JJJ-604206

fraudwatch-brands-list

Gets a list of brands from FraudWatch service.

Base Command

fraudwatch-brands-list

Input

Context Output

Command Example

#### Context Example

```json
{
    "FraudWatch": {
        "Brand": [
            {
                "active": true,
                "alternate business name": "",
                "client": "Palo Alto",
                "name": "Testing Brand 1",
                "services": [
                    {
                        "action": "takedown",
                        "name": "Phishing"
                    },
                    {
                        "action": "monitor",
                        "name": "Vishing"
                    },
                    {
                        "action": "monitor",
                        "name": "Brand Abuse"
                    },
                    {
                        "action": "monitor",
                        "name": "Malware"
                    },
                    {
                        "action": "monitor",
                        "name": "Social Media Brand Abuse"
                    },
                    {
                        "action": "monitor",
                        "name": "Mobile App (Unauthorized)"
                    },
                    {
                        "action": "monitor",
                        "name": "PAC File"
                    },
                    {
                        "action": "monitor",
                        "name": "Messaging"
                    },
                    {
                        "action": "monitor",
                        "name": "DMARC Email Server"
                    }
                ]
            },
            {
                "active": true,
                "alternate business name": "",
                "client": "Palo Alto",
                "name": "Testing Brand 2",
                "services": [
                    {
                        "action": "takedown",
                        "name": "Phishing"
                    },
                    {
                        "action": "monitor",
                        "name": "Vishing"
                    },
                    {
                        "action": "monitor",
                        "name": "Brand Abuse"
                    },
                    {
                        "action": "monitor",
                        "name": "Malware"
                    },
                    {
                        "action": "monitor",
                        "name": "Social Media Brand Abuse"
                    },
                    {
                        "action": "monitor",
                        "name": "Mobile App (Unauthorized)"
                    },
                    {
                        "action": "monitor",
                        "name": "PAC File"
                    },
                    {
                        "action": "monitor",
                        "name": "Messaging"
                    },
                    {
                        "action": "monitor",
                        "name": "DMARC Email Server"
                    }
                ]
            }
        ]
    }
}

Human Readable Output

FraudWatch Brands

name	active	client
Testing Brand 1	true	Palo Alto
Testing Brand 2	true	Palo Alto