Phish.AI Deprecated

Deprecated. Vendor has declared end of life for this integration. No available replacement.

Data Enrichment & Threat Intelligence · Phish.AI (Deprecated)

Details

ID	`Phish.AI`
Provider	PhishAI
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Supported Modules	Agentix

README

Closing the gap on traditional solutions, training, and talent with next-generation anti-phishing platform powered by AI & Computer Vision.

Configure Phish.AI on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for Phish.AI.
Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- Private API Key (Optional) get it from My Profile on your Phish.AI Web URL
- Use system proxy settings
Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

Scan a URL: phish-ai-scan-url
Check a URL status: phish-ai-check-status
Dispute a scan result: phish-ai-dispute-url

1. Scan a URL

Checks if a URL is phishing, and returns details about the brand that is being phished.

Base Command

phish-ai-scan-url

Input

Argument Name	Description	Required
url	The URL to check.	Required

Context Output

Path	Type	Description
URL.Data	string	The URL address.
URL.Malicious.Vendor	string	For malicious URLs, the vendor that made the decision.
URL.Malicious.Description	string	For malicious URLs, the reason that the vendor made the decision.
DBotScore.Indicator	string	The indicator that was tested.
DBotScore.Type	string	The indicator type.
DBotScore.Vendor	string	The vendor used to calculate the score.
DBotScore.Score	number	The actual score.
IP.Address	string	The IP address of the URL.
IP.Geo.Country	string	The geo-location of the URL.
PhishAI.ScanID	string	The Phish AI scan ID.
PhishAI.Status	string	The status of the scan.
PhishAI.URL	string	The URL address.

Command Example

!phish-ai-scan url=www.demisto.com

Human Readable Output

2. Check a URL status

Checks the status of a URL, for example, “completed” or “in progress”.

Base Command

phish-ai-check-status

Input

Argument Name	Description	Required
scan_id	The scan ID of the URL to check the status of. You must replace the url argument with the scan_id argument in automations and playbooks. Backward compatibility is not supported.	Required

Context Output

Path	Type	Description
URL.Data	string	The IP address of the URL.
PhishAI.Status	string	That status of the scan.
PhishAI.ScanID	string	The Phish.AI scan ID.

Command Example

!phish-ai-check-status scan_id="{CsFCgZ494mmW2JMI4hkK}"

Human Readable Output

3. Dispute a scan result

Disputes the result of a scan.

Base Command

phish-ai-dispute-url

Input

Argument Name	Description	Required
scan_id	The scan ID of the URL to dispute.	Required

Context Output

There is no context output for this command.

Command Example

!phish-ai-dispute-url scan_id="CsFCgZ494mmW2JMI4hkK"

Human Readable Output

Configuration parameters

apiKey — Private API Key (Optional)
proxy — Use system proxy settings

Commands (3)

phish-ai-check-status
Checks on url's status, e.g. completed, in progress
phish-ai-dispute-url
Dispute the result of the scan
phish-ai-scan-url
Check if url is phishing and get details about the brand that is being phished

Source

PhishAI.js PhishAI.yml

Download History Raw

var DONT_CHECK_CERTIFICATE = false;

function checkStatus(scan_id, apiKey){
    var res = http(
        'https://app.phish.ai/api/url/report?scan_id=' + scan_id,
        {
            Method: 'GET',
            Headers: {
                'Accept': ['application/json'],
                'Authorization': [apiKey]
            }
        },
        DONT_CHECK_CERTIFICATE,
        params.proxy
    );

    if (res.StatusCode !== 200) {
        throw 'Failed to get scan results for scan_id: ' + scan_id + '. Response error: ' + res.Body;
    }
    var report = JSON.parse(res.Body);

    md = tableToMarkdown('Phish.AI Scan report ' + scan_id, report);

    return {
        Type: entryTypes.note,
        Contents: report,
        ContentsFormat: formats.json,
        HumanReadable: md,
        EntryContext: {
            'URL(val.Data === obj.Data)' : {
                'Data': report.url,
            },
            'PhishAI(val.ScanID === obj.ScanID)': {
                'ScanID': scan_id,
                'Status': report.status
            }
        }
    };
}


function analayzeResult(report, url, scan_id) {
    delete report.user_email;
    var DBotScore = {
        Indicator: url,
        Score: 0,
        Type: 'url',
        Vendor: 'Phish.AI',
        ScanID: scan_id
    };
    if (report.verdict == 'malicious') {
        DBotScore.Score = 3;
        addMalicious(ec, url, {
            Data: url,
            Malicious: {
                Vendor: 'Phish.AI',
                Description: 'URL classified as phishing by Phish.AI'
            }
        });
    }

    // if we sending both domain and url to the war-room in the human readable we would
    // run the test again for the domain since it doesn't have the http:// part
    if (url === report.url){
        delete report.domain;
    } else if (url === report.domain){
        delete report.url;

    }
    md = tableToMarkdown('Phish.AI Scan report ' + url + '. Scan ID: ' + scan_id, report);
    return {
        Type: entryTypes.note,
        Contents: report,
        ContentsFormat: formats.json,
        HumanReadable: md,
        EntryContext: {
            'URL(val.Data === obj.Data)' : {
                'Data': url
            },
            'IP(val.Hostname === obj.Hostname)' : {
                'Address': report.ip_address,
                'Hostname': report.domain,
                'Geo':{
                    'Country':report.iso_code
                }
            },
            'DBotScore' : DBotScore,
            'PhishAI(val.ScanID === obj.ScanID)': {
                'ScanID': scan_id,
                'URL': url,
                'Status': report.status
            }
        }
    };
}


function phishAiScan(url, apiKey) {
    var initialRes = http(
        'https://app.phish.ai/api/url/scan',
        {
            Method: 'POST',
            Headers: {
                'Content-Type': ['application/json'],
                'Accept': ['application/json'],
                'Authorization': [apiKey]
            },
            Body: JSON.stringify({'url': url})
        },
        DONT_CHECK_CERTIFICATE,
        params.proxy
    );

    // check status code is valid
    if (initialRes.StatusCode !== 200 && initialRes.StatusCode !== 201) {
        throw 'Failed to send url ' + url + ' for scan. Response error: ' + initialRes.Body;
    }

    var scan_id = JSON.parse(initialRes.Body).scan_id;
    var res = http(
        'https://app.phish.ai/api/url/report?scan_id=' + scan_id,
        {
            Method: 'GET',
            Headers: {
                'Accept': ['application/json'],
                'Authorization': [apiKey]
            }
        },
        DONT_CHECK_CERTIFICATE,
        params.proxy
    );

    if (res.StatusCode !== 200) {
        throw 'Failed to get scan results for ' + url + '. scan_id: ' + scan_id + '. Response error: ' + res.Body;
    }

    var report = JSON.parse(res.Body);

    return analayzeResult(report, url, scan_id);
}


function phishAiDispute(scan_id, apiKey) {
    var res = http(
        'https://app.phish.ai/api/url/dispute?scan_id=' + scan_id,
        {
            Method: 'GET',
            Headers: {
                'Accept': ['application/json'],
                'Authorization': [apiKey]
            }
        },
        DONT_CHECK_CERTIFICATE,
        params.proxy
    );

    if (res.StatusCode !== 200) {
        throw 'Failed to get scan results for ' + url + '. scan_id: ' + scan_id + '. Response error: ' + res.Body;
    }

    textRes = JSON.parse(res.Body);
    if (textRes == 'OK') {
        return {
            Type: entryTypes.note,
            Contents: textRes,
            ContentsFormat: formats.text,
            HumanReadable: 'Scan ID: ' + scan_id + ' was disputed'
        };
    }
    else {
        throw 'Failed to dispute url ' + url + ', Scan ID: ' + scan_id + '. Response error: ' + textRes;
    }
}

switch (command) {
    case 'test-module':
        var res = phishAiScan('https://www.demisto.com/', params.apiKey);
        if (res && res.Type){
            return 'ok';
        } else {
            return 'error';
        }
        break;

    case 'phish-ai-scan-url':
        return phishAiScan(args.url, params.apiKey);

    case 'phish-ai-check-status':
        return checkStatus(args.scan_id, params.apiKey);

    case 'phish-ai-dispute-url':
        return phishAiDispute(args.scan_id, params.apiKey);

    default:
        break;
}