IsItPhishing

Details

ID	`IsItPhishing`
Provider	Open Source
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Supported Modules	Agentix XSIAM

README

Collaborative web service that provides validation on whether a URL is a phishing page or not by analyzing the content of the webpage.

Configure IsItPhishing in Cortex

Parameter	Description	Required
Server URL (e.g. https://192.168.0.1)		False
Customer’s name		True
Customer’s License		True
Use system proxy settings		False
Trust any certificate (not secure)		False
Source Reliability	Reliability of the source providing the intelligence data.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

url

Checks if URL is phishing

Base Command

url

Input

Argument Name	Description	Required
url	URL to be checked if phishing.	Required
force	Set true to analyze URL, or false to check whether URL may cause collateral damage to the end user. Default is false.	Optional
smart	Set true to force checks on URLs that may cause collateral damage to the end user, or false to ignore the argument. Default is true.	Optional
area	The regional area to force using a proxy.	Optional
timeout	Timeout in milliseconds. Default value set to 10000, with a minimum value of 1000. Once timeout is reached, TIMEOUT response is returned.	Optional

Context Output

Path	Type	Description
URL.Status	unknown	URL identification result.
URL.Url	unknown	The URL that was tested.
URL.Malicious.Vendor	unknown	For malicious URLs, the vendor that made the decision.
URL.Malicious.Description	unknown	For malicious URLs, the reason for the vendor to make the decision.
DBotScore.Indicator	unknown	The indicator that was tested.
DBotScore.Type	unknown	The indicator type.
DBotScore.Vendor	unknown	The vendor used to calculate the score.
DBotScore.Score	unknown	The actual score.

Configuration parameters

url — Server URL (e.g. https://192.168.0.1)
name — Customer's name
license — Customer's License
credentials — Customer's name
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)
integrationReliability — Source Reliability
feedExpirationPolicy —
feedExpirationInterval —

Commands (1)

url
Checks if URL is phishing.

Source

IsItPhishing.js IsItPhishing.yml

Download History Raw

commonfields:
  id: IsItPhishing
  version: -1
name: IsItPhishing
display: IsItPhishing
category: Data Enrichment & Threat Intelligence
provider: Open Source
description: Collaborative web service that provides validation on whether a URL is a phishing page or not by analyzing the content of the webpage.
configuration:
- display: Server URL (e.g. https://192.168.0.1)
  name: url
  defaultvalue: https://ws.isitphishing.org
  type: 0
  required: false
- display: Customer's name
  name: name
  defaultvalue: ""
  type: 0
  hidden: true
- display: Customer's License
  name: license
  defaultvalue: ""
  type: 4
  hidden: true
- display: Customer's name
  name: credentials
  type: 9
  displaypassword: Customer's License
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- defaultvalue: B - Usually reliable
  name: integrationReliability
  display: 'Source Reliability'
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  required: false
  additionalinfo: Reliability of the source providing the intelligence data.
- defaultvalue: 'indicatorType'
  name: feedExpirationPolicy
  display: ''
  type: 17
  required: false
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
- defaultvalue: '20160'
  display: ''
  name: feedExpirationInterval
  required: false
  type: 1
script:
  script: ''
  type: javascript
  commands:
  - name: url
    arguments:
    - name: url
      required: true
      description: Comma separated list of URLs to be checked if phishing.
      default: true
      isArray: true
    - name: force
      description: Set true to analyze URL, or false to check whether URL may cause collateral damage to the end user.
      defaultValue: "false"
    - name: smart
      description: Set true to force checks on URLs that may cause collateral damage to the end user, or false to ignore the argument.
      defaultValue: "true"
    - name: area
      description: The regional area to force using a proxy.
    - name: timeout
      description: Timeout in milliseconds. Default value set to 10000, with a minimum value of 1000. Once timeout is reached, TIMEOUT response is returned.
    outputs:
    - contextPath: URL.Status
      description: URL identification result.
    - contextPath: URL.Url
      description: The URL that was tested.
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision.
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the reason for the vendor to make the decision.
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
    - contextPath: DBotScore.Type
      description: The indicator type.
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
    - contextPath: DBotScore.Score
      description: The actual score.
    description: Checks if URL is phishing.
tests:
- No tests
fromversion: 5.0.0