PhishLabs IOC DRP

Retrieves Digital Risk cases Protection from PhishLabs.

Data Enrichment & Threat Intelligence · PhishLabs

Details

IDPhishLabs IOC DRP
ProviderFortra
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

This integration was integrated and tested with V1.0 of PhishLabs IOC DRP

Use Cases

  • Get cases by filters from PhishLabs DRP service
  • Get live incidents from PhishLabs DRP service

Detailed Description

PhishLabs Digital Risk Protection (DRP) is a solution that provides proactive detection and rapid mitigation of digital risks across:

  • email
  • domain
  • social media
  • mobile
  • dark
  • deep
  • open web vectors

Configure PhishLabs IOC DRP on Cortex XSOAR

  1. Navigate to Settings > Integrations  > Servers & Services.
  2. Search for PhishLabs IOC DRP.
  3. Click Add instance to create and configure a new integration instance.
    • Name: a textual name for the integration instance.
    • Server URL (e.g. https://example.net)
    • User
    • Fetch incidents
    • Incident type
    • First fetch timestamp ( , e.g., 12 hours, 7 days) </strong></li>
    • Fetch by date field
    • Fetch limit (min 20)
    • Trust any certificate (not secure)
    • Use system proxy settings
      • </ul> </li>
    • Click Test to validate the new instance.
      • </ol>

      Fetch Incidents

      Fetch incidents done by the following configuration:

      • Limit - limit amount of incidents by fetch
      • Date field - Date field to fetch incidents by - created/modified/closed
      • Time to fetch - date for starting collecting incidents (1 days ago, 1 hours ago etc)
      • Incident type

      Incident data example:

        [
  {
    "name": "PhishLabs IOC - DRP: 12d329b7-13db-11ea-94e8-0ee0a3f3cb1c",
    "occurred": "2019-12-01T01:40:36Z",
    "rawJSON": {
      "caseId": "12d329b7-13db-11ea-94e8-0ee0a3f3cb1c",
      "title": "=? =?gb2312?Q?ted:_www.icloud.com.agona.cn?=",
      "description": "From: PhishLabs Security Operations <not@domain.com>\nSubject: =? =?gb2312?Q?ted:_www.icloud.com.agona.cn?=\n\n\r\n________________________________\r\nFrom: west263\r\nSent: Saturday, November 30, 2019 8:36:41 PM (UTC-05:00) Eastern Time (US & Canada)\r\nTo: PhishLabs Security Operations; not@domain.com; not@domain.com\r\nSubject: 回复：[PL-1405082] Malicious domain detected: www.icloud.com.agona.cn\r\n\r\n-- External email--\r\n\r\n\r\nThank you for allowing us an opportunity to assist you.\r\n\r\nWe have suspended our customer to use this domain. You can check it later.\r\n\r\nIf you have any questions, please do not hesitate to contact us. We look forward to assisting you.\r\n\r\nHave a wonderful day!\r\n\r\n\r\n\r\n------------------\r\n\r\nBest regards,\r\n\r\nLillian\r\n\r\n\r\n------------------ 原始邮件 ------------------\r\n\r\n发件人:  PhishLabs Security Operations<not@domain.com>;\r\n日  期:  2019-11-30 (星期六) 08:37:19\r\n收件人:  not@domain.com<not@domain.com>;not@domain.com<not@domain.com>;not@domain.com<not@domain.com>;\r\n主  题:  [PL-1405082] Malicious domain detected: www.icloud.com.agona.cn\r\n\r\n\r\nDuring an investigation of fraud, we discovered a domain(s) registered for the sole intent of malicious activity, which is being used to attack our client and their customers.\r\n\r\nWe have addressed this report to the responsible authoritative providers over this website who have the ability to disable the malicious content in question. This includes but is not limited to the hosting provider(s), nameserver, registrar and if applicable, the registry.  Based on your relationship to the content in question or services provided, please see our specific request below.\r\n\r\nThis threat has been active for at least 2.1 hours.\r\n\r\nhXXp www[.]icloud[.]com[.]agona[.]cn/ios/uy930glgr8yx54n4zkcw[.]asp?uy930glgr8yx54n4zkcw=\r\nhXXp www[.]icloud[.]com[.]agona[.]cn/ios/upvf7o4kon1kpt4vfy18[.]asp?upvf7o4kon1kpt4vfy18=\r\nhXXp www[.]icloud[.]com[.]agona[.]cn/ios/vweixhklbjw1t1ve3b4n[.]asp?vweixhklbjw1t1ve3b4n=\r\nhXXp www[.]icloud[.]com[.]agona[.]cn/an3n3abqqtkpuok9vw9c[.]asp?an3n3abqqtkpuok9vw9c\r\n\r\nFirst detection of malicious activity: 11-29-2019 22:26:17 UTC\r\nMost recent observation of malicious activity: 11-30-2019 00:35:06 UTC\r\nAssociated IP Addresses: 8.8.8.8\r\n\r\nEvidence of malicious content is provided below my signature.\r\n\r\n===   HOSTING  PROVIDER AND/OR WEBSITE OWNER    ===\r\nIf you agree that this is malicious, we kindly request that you take steps to have the content removed as soon as possible.  It is highly likely that the intruder who set up this phishing content has also left additional fraudulent material on this server such as illegitimate access points.\r\n\r\n===   REGISTRAR / REGISTRY   ===\r\nWe kindly request that this domain is placed on hold as soon as possible and all client related information sink holed. It is also very likely the registrant in question has registered various other domains through your service and it is suggested you investigate as you see fit.\r\n\r\n===   NAMESERVER, SOA   ===\r\nIf it is within your power, please consider disabling the routing to this domain to prevent further abuse to the public.\r\n\r\n===   CERT/CIRT, ETC.   ===\r\nIf you're able to assist in any means possible to see to the termination of this content, please do so.  Your local expertise and influence on this matter is critical to this effort.\r\n\r\nIf we have contacted you in error, or if there is a better way for us to report this incident, please let us know so that we may continue our investigation.\r\n\r\nWe are extremely grateful for your assistance.\r\n\r\nKind regards,\r\n\r\nYogender Chauhan\r\nPhishLabs Security Operations\r\n12023866001\r\nAvailable 24/7\r\n\r\n\r\nEvidence:\r\nPlease see attached screenshot.\r\n.\r\n\r\n[PL-1405082]\r\n\r\n\r\n ",
      "caseNumber": 1406220,
      "createdBy": {
        "id": "30c2e916-c72d-11e3-860e-002590387e36",
        "name": "soc.phishlabs",
        "displayName": "SOC PhishLabs"
      },
      "brand": "",
      "caseType": "Other",
      "resolutionStatus": "Accidental creation",
      "caseStatus": "Rejected",
      "dateCreated": "2019-12-01T01:37:02Z",
      "dateClosed": "2019-12-01T01:40:36Z",
      "dateModified": "2019-12-01T01:40:36Z",
      "customer": "PhishLabs",
      "attachments": [
        {
          "id": "12e5eeaa-13db-11ea-8247-0ad24386a0d6",
          "type": "Email",
          "description": "Source Email for case creation",
          "dateAdded": "2019-12-01T01:37:02Z",
          "fileName": "msg.oFAH.eml",
          "fileURL": "https://caseapi.phishlabs.com/v1/data/attachment/12e5eeaa-13db-11ea-8247-0ad24386a0d6"
        }
      ],
      "formReceiver": false,
      "brandAbuseFlag": false,
      "appDate": "0001-01-01T00:00:00Z",
      "primaryMarketplace": false
    }
  }
]

      Commands

      You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

      1. Get cases by filters: phishlabs-ioc-drp-get-cases
      2. Get case by ID: phishlabs-ioc-drp-get-case-by-id
      3. Get open cases filters: phishlabs-ioc-drp-get-open-cases
      4. Get closed cases by filters: phishlabs-ioc-drp-get-closed-cases

      1. phishlabs-ioc-drp-get-cases

      Get cases by filters

      Base Command

      phishlabs-ioc-drp-get-cases

      Input
      </tr> </tbody> </table>
      Context Output
      Argument Name Description Required
      status Filter cases based on the case status Optional
      case_type Filter cases by case type Optional
      max_records Maximum number of cases to return, default is 20, maximum is 200 Optional
      offset Paginate results used in conjunction with maxRecords. Optional
      date_field Field to use to query using dateBegin and dateEnd parameters. Optional
      begin_date Date query beginning date Optional
      end_date Date query endining date Optional
      period timestamp ( , e.g., 12 hours, 7 days)</td> Optional
      Path Type Description
      PhishlabsIOC.DRP.CaseID String Case ID
      PhishlabsIOC.DRP.Title String Case title
      PhishlabsIOC.DRP.Description String Case description
      PhishlabsIOC.DRP.CaseNumber String Case number
      PhishlabsIOC.DRP.Resolution String Resolution
      PhishlabsIOC.DRP.ResolutionStatus String Resolution status
      PhishlabsIOC.DRP.CreatedBy.ID String Case creator ID
      PhishlabsIOC.DRP.CreatedBy.Name String Case creator name
      PhishlabsIOC.DRP.CreatedBy.DisplayName String Case creator display name
      PhishlabsIOC.DRP.Brand String Brand reported in case
      PhishlabsIOC.DRP.Email String Email of case creator
      PhishlabsIOC.DRP.CaseType String Type of the case
      PhishlabsIOC.DRP.CaseStatus String Status of the case
      PhishlabsIOC.DRP.DateCreated String Case creation date
      PhishlabsIOC.DRP.DateClosed String Case closing date
      PhishlabsIOC.DRP.DateModified String Case modification date
      PhishlabsIOC.DRP.Customer String Customer reporting the case
      PhishlabsIOC.DRP.AttackSources.URL String URL of the attack source
      PhishlabsIOC.DRP.AttackSources.UrlType String URL type of the attack source
      PhishlabsIOC.DRP.AttackSources.IP String IP of the attack source
      PhishlabsIOC.DRP.AttackSources.ISP String ISP of the attack source
      PhishlabsIOC.DRP.AttackSources.Country String ISP of the attack source
      PhishlabsIOC.DRP.AttackSources.TargetedBrands String Target brands of the attack source
      PhishlabsIOC.DRP.AttackSources.FQDN String FQDN of the attack source
      PhishlabsIOC.DRP.AttackSources.Domain String Domain of the attack source
      PhishlabsIOC.DRP.AttackSources.IsMaliciousDomain Boolean Detect if domain of attack source is malicious
      PhishlabsIOC.DRP.AttackSources.WhoIs.Registrant String URL of the registrant
      PhishlabsIOC.DRP.AttackSources.WhoIs.Registration.Created String Creation date of the registration
      PhishlabsIOC.DRP.AttackSources.WhoIs.Registration.Expires String Expiriation date of the registration
      PhishlabsIOC.DRP.AttackSources.WhoIs.Registration.Updated String Update date of the registration
      PhishlabsIOC.DRP.AttackSources.WhoIs.Registration.Registrar String Registrar of the URL
      PhishlabsIOC.DRP.AttackSources.WhoIs.NameServers String Name servers of the URL
      PhishlabsIOC.DRP.Attachments.ID String ID of case attachment
      PhishlabsIOC.DRP.Attachments.Type String Type of case attachment
      PhishlabsIOC.DRP.Attachments.Description String Description of case attachment
      PhishlabsIOC.DRP.Attachments.DateAdded String Date adding of case attachment
      PhishlabsIOC.DRP.Attachments.FileName String File name of case attachment
      PhishlabsIOC.DRP.Attachments.FileURL String File URL of case attachment
      PhishlabsIOC.DRP.ApplicationName String Application reported in the case
      PhishlabsIOC.DRP.Platform String Platform reported in the case
      PhishlabsIOC.DRP.Severity String Sevirity of DRP
      PhishlabsIOC.DRP.Developer String Developer of the application reported
      PhishlabsIOC.DRP.DeveloperWebsite String Developer website of the application reported
      PhishlabsIOC.DRP.ApplicationDescription String Descripion of the application reported
      PhishlabsIOC.DRP.Language String Language of the application reported
      PhishlabsIOC.DRP.Phone String Phone number of case creator
      PhishlabsIOC.DRP.Hardware String Hardware used by the application
      PhishlabsIOC.DRP.AssociatedURLs.URL String URL of the attack source
      PhishlabsIOC.DRP.AssociatedURLs.UrlType String URL type of the attack source
      PhishlabsIOC.DRP.AssociatedURLs.TargetedBrands String Target brands of the attack source
      PhishlabsIOC.DRP.AssociatedURLs.WhoIs.Registrant String URL of the registrant
      PhishlabsIOC.DRP.AssociatedURLs.WhoIs.Registration.Created String Creation date of the registration
      PhishlabsIOC.DRP.AssociatedURLs.WhoIs.Registration.Expires String Expiriation date of the registration
      PhishlabsIOC.DRP.AssociatedURLs.WhoIs.Registration.Updated String Update date of the registration
      PhishlabsIOC.DRP.AssociatedURLs.WhoIs.Registration.Registrar String Registrar of the URL
      PhishlabsIOC.DRP.AssociatedURLs.WhoIs.NameServers String Name servers of the URL

       

      Command Example

      !phishlabs-ioc-drp-get-cases max_records=2

      Context Example
      {
    "PhishLabsIOC": {
        "DRP": [
            {
                "Attachments": [
                    {
                        "DateAdded": "2019-12-09T07:56:02Z",
                        "Description": "Source Email for case creation",
                        "FileName": "msg.mFAH.eml",
                        "FileURL": "https://caseapi.phishlabs.com/v1/data/attachment/",
                        "ID": "581ba28d-1a59-11ea-8247-0ad24386a0d6",
                        "Type": "Email"
                    }
                ],
                "CaseID": "5808ec5a-1a59-11ea-94e8-0ee0a3f3cb1c",
                "CaseNumber": 1417871,
                "CaseStatus": "Rejected",
                "CaseType": "Other",
                "CreatedBy": {
                    "DisplayName": "SOC PhishLabs",
                    "ID": "30c2e916",
                    "Name": "soc.phishlabs"
                },
                "Customer": "PhishLabs",
                "DateClosed": "2019-12-09T08:01:34Z",
                "DateCreated": "2019-12-09T07:56:01Z",
                "DateModified": "2019-12-09T08:01:34Z",
                "Description": "From: ",
                "ResolutionStatus": "Accidental creation",
                "Title": "=?gb2312?B?"
            },
            {
                "Attachments": [
                    {
                        "DateAdded": "2019-12-09T07:46:02Z",
                        "Description": "Source Email for case creation",
                        "FileName": "msg.fKAH.eml",
                        "FileURL": "https://caseapi.phishlabs.com/v1/data/",
                        "ID": "f24c36a6",
                        "Type": "Email"
                    }
                ],
                "CaseID": "f239fe62",
                "CaseNumber": 1417866,
                "CaseStatus": "Rejected",
                "CaseType": "Other",
                "CreatedBy": {
                    "DisplayName": "SOC PhishLabs",
                    "ID": "30c2e916",
                    "Name": "soc.phishlabs"
                },
                "Customer": "PhishLabs",
                "DateClosed": "2019-12-09T07:49:11Z",
                "DateCreated": "2019-12-09T07:46:01Z",
                "DateModified": "2019-12-09T07:49:11Z",
                "Description": "From: ",
                "ResolutionStatus": "Accidental creation",
                "Title": "=?gb231"
            }
        ]
    }
}
      Human Readable Output

      PhishLabs IOC - DRP - cases

      CaseID Title CaseStatus DateCreated ResolutionStatus CreatedBy
      5808ec5a-1a59-11ea-94e8-0ee0a3f3cb1c ?Q?idenform[.]top?= Rejected 2019-12-09T07:56:01Z Accidental creation ID: 30c2e916
      Name: soc.phishlabs
      DisplayName: SOC PhishLabs
      f239fe62-1a57-11ea-94e8-0ee0a3f3cb1c =?gb2312?B?R Rejected 2019-12-09T07:46:01Z Accidental creation ID: 30c2e916
      Name: soc.phishlabs
      DisplayName: SOC PhishLabs

      2. phishlabs-ioc-drp-get-case-by-id

      Get case by ID of Phishlabs DRP service

      Base Command

      phishlabs-ioc-drp-get-case-by-id

      Input
      Argument Name Description Required
      case_id ID of case, for expample ID from previous command Required

       

      Context Output
      Path Type Description
      PhishlabsIOC.DRP.CaseID String Case ID
      PhishlabsIOC.DRP.Title String Case title
      PhishlabsIOC.DRP.Description String Case description
      PhishlabsIOC.DRP.CaseNumber String Case number
      PhishlabsIOC.DRP.Resolution String Resolution
      PhishlabsIOC.DRP.ResolutionStatus String Resolution status
      PhishlabsIOC.DRP.CreatedBy.ID String Case creator ID
      PhishlabsIOC.DRP.CreatedBy.Name String Case creator name
      PhishlabsIOC.DRP.CreatedBy.DisplayName String Case creator display name
      PhishlabsIOC.DRP.Brand String Brand reported in case
      PhishlabsIOC.DRP.Email String Email of case creator
      PhishlabsIOC.DRP.CaseType String Type of the case
      PhishlabsIOC.DRP.CaseStatus String Status of the case
      PhishlabsIOC.DRP.DateCreated String Case creation date
      PhishlabsIOC.DRP.DateClosed String Case closing date
      PhishlabsIOC.DRP.DateModified String Case modification date
      PhishlabsIOC.DRP.Customer String Customer reporting the case
      PhishlabsIOC.DRP.AttackSources.URL String URL of the attack source
      PhishlabsIOC.DRP.AttackSources.UrlType String URL type of the attack source
      PhishlabsIOC.DRP.AttackSources.IP String IP of the attack source
      PhishlabsIOC.DRP.AttackSources.ISP String ISP of the attack source
      PhishlabsIOC.DRP.AttackSources.Country String ISP of the attack source
      PhishlabsIOC.DRP.AttackSources.TargetedBrands String Target brands of the attack source
      PhishlabsIOC.DRP.AttackSources.FQDN String FQDN of the attack source
      PhishlabsIOC.DRP.AttackSources.Domain String Domain of the attack source
      PhishlabsIOC.DRP.AttackSources.IsMaliciousDomain Boolean Detect if domain of attack source is malicious
      PhishlabsIOC.DRP.AttackSources.WhoIs.Registrant String URL of the registrant
      PhishlabsIOC.DRP.AttackSources.WhoIs.Registration.Created String Creation date of the registration
      PhishlabsIOC.DRP.AttackSources.WhoIs.Registration.Expires String Expiriation date of the registration
      PhishlabsIOC.DRP.AttackSources.WhoIs.Registration.Updated String Update date of the registration
      PhishlabsIOC.DRP.AttackSources.WhoIs.Registration.Registrar String Registrar of the URL
      PhishlabsIOC.DRP.AttackSources.WhoIs.NameServers String Name servers of the URL
      PhishlabsIOC.DRP.Attachments.ID String ID of case attachment
      PhishlabsIOC.DRP.Attachments.Type String Type of case attachment
      PhishlabsIOC.DRP.Attachments.Description String Description of case attachment
      PhishlabsIOC.DRP.Attachments.DateAdded String Date adding of case attachment
      PhishlabsIOC.DRP.Attachments.FileName String File name of case attachment
      PhishlabsIOC.DRP.Attachments.FileURL String File URL of case attachment
      PhishlabsIOC.DRP.ApplicationName String Application reported in the case
      PhishlabsIOC.DRP.Platform String Platform reported in the case
      PhishlabsIOC.DRP.Severity String Sevirity of DRP
      PhishlabsIOC.DRP.Developer String Developer of the application reported
      PhishlabsIOC.DRP.DeveloperWebsite String Developer website of the application reported
      PhishlabsIOC.DRP.ApplicationDescription String Descripion of the application reported
      PhishlabsIOC.DRP.Language String Language of the application reported
      PhishlabsIOC.DRP.Hardware String Hardware used by the application
      PhishlabsIOC.DRP.Phone String Phone number of case creator
      PhishlabsIOC.DRP.Hardware String Hardware used by the application
      PhishlabsIOC.DRP.AssociatedURLs.URL String URL of the attack source
      PhishlabsIOC.DRP.AssociatedURLs.UrlType String URL type of the attack source
      PhishlabsIOC.DRP.AssociatedURLs.TargetedBrands String Target brands of the attack source
      PhishlabsIOC.DRP.AssociatedURLs.WhoIs.Registrant String URL of the registrant
      PhishlabsIOC.DRP.AssociatedURLs.WhoIs.Registration.Created String Creation date of the registration
      PhishlabsIOC.DRP.AssociatedURLs.WhoIs.Registration.Expires String Expiriation date of the registration
      PhishlabsIOC.DRP.AssociatedURLs.WhoIs.Registration.Updated String Update date of the registration
      PhishlabsIOC.DRP.AssociatedURLs.WhoIs.Registration.Registrar String Registrar of the URL
      PhishlabsIOC.DRP.AssociatedURLs.WhoIs.NameServers String Name servers of the URL

       

      Command Example

      !phishlabs-ioc-drp-get-case-by-id case_id=08baa0d0-1a54-11ea-94e8-0ee0a3f3cb1c

      Context Example
      {
    "PhishLabsIOC": {
        "DRP": [
            {
                "Attachments": [
                    {
                        "DateAdded": "2019-12-09T07:18:01Z",
                        "Description": "Source Email for case creation",
                        "FileName": "msg.nFAH.eml",
                        "FileURL": "https://caseapi.phishlabs.com/v1/data/attachment/08d0611d",
                        "ID": "08d0611d",
                        "Type": "Email"
                    }
                ],
                "CaseID": "08baa0d0",
                "CaseNumber": 1417854,
                "CaseStatus": "Rejected",
                "CaseType": "Other",
                "CreatedBy": {
                    "DisplayName": "SOC PhishLabs",
                    "ID": "30c2e916",
                    "Name": "soc.phishlabs"
                },
                "Customer": "PhishLabs",
                "DateClosed": "2019-12-09T07:18:46Z",
                "DateCreated": "2019-12-09T07:18:01Z",
                "DateModified": "2019-12-09T07:18:46Z",
                "Description": "From: PhishLabs Security Operations <soc@phishlabs.com>",
                "ResolutionStatus": "Accidental creation",
                "Title": "=?gb2312?"
            }
        ]
    }
}
      Human Readable Output

      PhishLabs IOC - DRP - case ID None

      CaseID Title CaseStatus DateCreated ResolutionStatus CreatedBy
      08baa0d0-1a54-11ea-94e8-0ee0a3f3cb1c =?gb2312?B? Rejected 2019-12-09T07:18:01Z Accidental creation ID: 30c2e916
      Name: soc.phishlabs
      DisplayName: SOC PhishLabs

      3. phishlabs-ioc-drp-get-open-cases

      Get open cases of Phishlabs DRP service by filters

      Base Command

      phishlabs-ioc-drp-get-open-cases

      Input
      </tr> </tbody> </table>

       

      Context Output
      Argument Name Description Required
      case_type Filter cases by case type Optional
      max_records Maximum number of cases to return, default is 20, maximum is 200 Optional
      offset Paginate results used in conjunction with maxRecords, first 200 records maxRecords=200&offset=0 second 200 records maxRecords=200&offset=200 Optional
      date_field Field to use to query using dateBegin and dateEnd parameters. Optional
      begin_date Date query beginning date Optional
      end_date Date query beginning date Optional
      period timestamp ( , e.g., 12 hours, 7 days)</td> Optional
      Path Type Description
      PhishlabsIOC.DRP.CaseID String Case ID
      PhishlabsIOC.DRP.Title String Case title
      PhishlabsIOC.DRP.Description String Case description
      PhishlabsIOC.DRP.CaseNumber String Case number
      PhishlabsIOC.DRP.Resolution String Resolution
      PhishlabsIOC.DRP.ResolutionStatus String Resolution status
      PhishlabsIOC.DRP.CreatedBy.ID String Case creator ID
      PhishlabsIOC.DRP.CreatedBy.Name String Case creator name
      PhishlabsIOC.DRP.CreatedBy.DisplayName String Case creator display name
      PhishlabsIOC.DRP.Brand String Brand reported in case
      PhishlabsIOC.DRP.Email String Email of case creator
      PhishlabsIOC.DRP.CaseType String Type of the case
      PhishlabsIOC.DRP.CaseStatus String Status of the case
      PhishlabsIOC.DRP.DateCreated String Case creation date
      PhishlabsIOC.DRP.DateClosed String Case closing date
      PhishlabsIOC.DRP.DateModified String Case modification date
      PhishlabsIOC.DRP.Customer String Customer reporting the case
      PhishlabsIOC.DRP.AttackSources.URL String URL of the attack source
      PhishlabsIOC.DRP.AttackSources.UrlType String URL type of the attack source
      PhishlabsIOC.DRP.AttackSources.IP String IP of the attack source
      PhishlabsIOC.DRP.AttackSources.ISP String ISP of the attack source
      PhishlabsIOC.DRP.AttackSources.Country String ISP of the attack source
      PhishlabsIOC.DRP.AttackSources.TargetedBrands String Target brands of the attack source
      PhishlabsIOC.DRP.AttackSources.FQDN String FQDN of the attack source
      PhishlabsIOC.DRP.AttackSources.Domain String Domain of the attack source
      PhishlabsIOC.DRP.AttackSources.IsMaliciousDomain Boolean Detect if domain of attack source is malicious
      PhishlabsIOC.DRP.AttackSources.WhoIs.Registrant String URL of the registrant
      PhishlabsIOC.DRP.AttackSources.WhoIs.Registration.Created String Creation date of the registration
      PhishlabsIOC.DRP.AttackSources.WhoIs.Registration.Expires String Expiriation date of the registration
      PhishlabsIOC.DRP.AttackSources.WhoIs.Registration.Updated String Update date of the registration
      PhishlabsIOC.DRP.AttackSources.WhoIs.Registration.Registrar String Registrar of the URL
      PhishlabsIOC.DRP.AttackSources.WhoIs.NameServers String Name servers of the URL
      PhishlabsIOC.DRP.Attachments.ID String ID of case attachment
      PhishlabsIOC.DRP.Attachments.Type String Type of case attachment
      PhishlabsIOC.DRP.Attachments.Description String Description of case attachment
      PhishlabsIOC.DRP.Attachments.DateAdded String Date adding of case attachment
      PhishlabsIOC.DRP.Attachments.FileName String File name of case attachment
      PhishlabsIOC.DRP.Attachments.FileURL String File URL of case attachment
      PhishlabsIOC.DRP.ApplicationName String Application reported in the case
      PhishlabsIOC.DRP.Platform String Platform reported in the case
      PhishlabsIOC.DRP.Severity String Sevirity of DRP
      PhishlabsIOC.DRP.Developer String Developer of the application reported
      PhishlabsIOC.DRP.DeveloperWebsite String Developer website of the application reported
      PhishlabsIOC.DRP.ApplicationDescription String Descripion of the application reported
      PhishlabsIOC.DRP.Language String Language of the application reported
      PhishlabsIOC.DRP.Hardware String Hardware used by the application
      PhishlabsIOC.DRP.Phone String Phone number of case creator
      PhishlabsIOC.DRP.Hardware String Hardware used by the application
      PhishlabsIOC.DRP.AssociatedURLs.URL String URL of the attack source
      PhishlabsIOC.DRP.AssociatedURLs.UrlType String URL type of the attack source
      PhishlabsIOC.DRP.AssociatedURLs.TargetedBrands String Target brands of the attack source
      PhishlabsIOC.DRP.AssociatedURLs.WhoIs.Registrant String URL of the registrant
      PhishlabsIOC.DRP.AssociatedURLs.WhoIs.Registration.Created String Creation date of the registration
      PhishlabsIOC.DRP.AssociatedURLs.WhoIs.Registration.Expires String Expiriation date of the registration
      PhishlabsIOC.DRP.AssociatedURLs.WhoIs.Registration.Updated String Update date of the registration
      PhishlabsIOC.DRP.AssociatedURLs.WhoIs.Registration.Registrar String Registrar of the URL
      PhishlabsIOC.DRP.AssociatedURLs.WhoIs.NameServers String Name servers of the URL

       

      Command Example

      !phishlabs-ioc-drp-get-open-cases max_records=2

      Context Example
      {
    "PhishLabsIOC": {
        "DRP": [
            {
                "Attachments": [
                    {
                        "DateAdded": "2019-08-16T18:10:53Z",
                        "Description": "Proof CBS owns Maxpreps brand. Requesting take down of maxpreps.us",
                        "FileName": "CBS Maxpreps.png",
                        "FileURL": "https://caseapi.phishlabs.com/v1/data/attachment/2fca6455",
                        "ID": "2fca6455",
                        "Type": "Email"
                    }
                ],
                "CaseID": "7cc6d097",
                "CaseNumber": 1254167,
                "CaseStatus": "Assigned",
                "CaseType": "Other",
                "CreatedBy": {
                    "DisplayName": "Matt T.",
                    "ID": "1e59f06d",
                    "Name": "mtwitty"
                },
                "Customer": "PhishLabs",
                "DateClosed": "0001-01-01T00:00:00Z",
                "DateCreated": "2019-08-09T21:20:18Z",
                "DateModified": "2019-11-01T18:13:21Z",
                "Description": "Courtesy case for CBS ",
                "Title": " Brand Abuse"
            }
        ]
    }
}
      Human Readable Output

      PhishLabs IOC - DRP - open cases

      CaseID Title CaseStatus DateCreated CreatedBy
      7cc6d097-baeb-11e9-94e8-0ee0a3f3cb1c Brand Abuse Assigned 2019-08-09T21:20:18Z ID: 1e59f06d-7b03-11e4-b9b0-0025902add30
      Name: mtwitty
      DisplayName: Matt T.

      4. phishlabs-ioc-drp-get-closed-cases

      Get closed cases of Phishlabs DRP service by filters

      Base Command

      phishlabs-ioc-drp-get-closed-cases

      Input
      </tr> </tbody> </table>

       

      Context Output
      Argument Name Description Required
      case_type Filter cases by case type Optional
      max_records maximum number of cases to return, default is 20, maximum is 200 Optional
      offset Paginate results used in conjunction with maxRecords, first 200 records maxRecords=200&offset=0 second 200 records maxRecords=200&offset=200 Optional
      Date_field Field to use to query using dateBegin and dateEnd parameters. Optional
      begin_date Date query beginning date Optional
      end_date Date query beginning date Optional
      period timestamp ( , e.g., 12 hours, 7 days)</td> Optional
      Path Type Description
      PhishlabsIOC.DRP.CaseID String Case ID
      PhishlabsIOC.DRP.Title String Case title
      PhishlabsIOC.DRP.Description String Case description
      PhishlabsIOC.DRP.CaseNumber String Case number
      PhishlabsIOC.DRP.Resolution String Resolution
      PhishlabsIOC.DRP.ResolutionStatus String Resolution status
      PhishlabsIOC.DRP.CreatedBy.ID String Case creator ID
      PhishlabsIOC.DRP.CreatedBy.Name String Case creator name
      PhishlabsIOC.DRP.CreatedBy.DisplayName String Case creator display name
      PhishlabsIOC.DRP.Brand String Brand reported in case
      PhishlabsIOC.DRP.Email String Email of case creator
      PhishlabsIOC.DRP.CaseType String Type of the case
      PhishlabsIOC.DRP.CaseStatus String Status of the case
      PhishlabsIOC.DRP.DateCreated String Case creation date
      PhishlabsIOC.DRP.DateClosed String Case closing date
      PhishlabsIOC.DRP.DateModified String Case modification date
      PhishlabsIOC.DRP.Customer String Customer reporting the case
      PhishlabsIOC.DRP.AttackSources.URL String URL of the attack source
      PhishlabsIOC.DRP.AttackSources.UrlType String URL type of the attack source
      PhishlabsIOC.DRP.AttackSources.IP String IP of the attack source
      PhishlabsIOC.DRP.AttackSources.ISP String ISP of the attack source
      PhishlabsIOC.DRP.AttackSources.Country String ISP of the attack source
      PhishlabsIOC.DRP.AttackSources.TargetedBrands String Target brands of the attack source
      PhishlabsIOC.DRP.AttackSources.FQDN String FQDN of the attack source
      PhishlabsIOC.DRP.AttackSources.Domain String Domain of the attack source
      PhishlabsIOC.DRP.AttackSources.IsMaliciousDomain Boolean Detect if domain of attack source is malicious
      PhishlabsIOC.DRP.AttackSources.WhoIs.Registrant String URL of the registrant
      PhishlabsIOC.DRP.AttackSources.WhoIs.Registration.Created String Creation date of the registration
      PhishlabsIOC.DRP.AttackSources.WhoIs.Registration.Expires String Expiriation date of the registration
      PhishlabsIOC.DRP.AttackSources.WhoIs.Registration.Updated String Update date of the registration
      PhishlabsIOC.DRP.AttackSources.WhoIs.Registration.Registrar String Registrar of the URL
      PhishlabsIOC.DRP.AttackSources.WhoIs.NameServers String Name servers of the URL
      PhishlabsIOC.DRP.Attachments.ID String ID of case attachment
      PhishlabsIOC.DRP.Attachments.Type String Type of case attachment
      PhishlabsIOC.DRP.Attachments.Description String Description of case attachment
      PhishlabsIOC.DRP.Attachments.DateAdded String Date adding of case attachment
      PhishlabsIOC.DRP.Attachments.FileName String File name of case attachment
      PhishlabsIOC.DRP.Attachments.FileURL String File URL of case attachment
      PhishlabsIOC.DRP.ApplicationName String Application reported in the case
      PhishlabsIOC.DRP.Platform String Platform reported in the case
      PhishlabsIOC.DRP.Severity String Sevirity of DRP
      PhishlabsIOC.DRP.Developer String Developer of the application reported
      PhishlabsIOC.DRP.DeveloperWebsite String Developer website of the application reported
      PhishlabsIOC.DRP.ApplicationDescription String Descripion of the application reported
      PhishlabsIOC.DRP.Language String Language of the application reported
      PhishlabsIOC.DRP.Hardware String Hardware used by the application
      PhishlabsIOC.DRP.Phone String Phone number of case creator
      PhishlabsIOC.DRP.Hardware String Hardware used by the application
      PhishlabsIOC.DRP.AssociatedURLs.URL String URL of the attack source
      PhishlabsIOC.DRP.AssociatedURLs.UrlType String URL type of the attack source
      PhishlabsIOC.DRP.AssociatedURLs.TargetedBrands String Target brands of the attack source
      PhishlabsIOC.DRP.AssociatedURLs.WhoIs.Registrant String URL of the registrant
      PhishlabsIOC.DRP.AssociatedURLs.WhoIs.Registration.Created String Creation date of the registration
      PhishlabsIOC.DRP.AssociatedURLs.WhoIs.Registration.Expires String Expiriation date of the registration
      PhishlabsIOC.DRP.AssociatedURLs.WhoIs.Registration.Updated String Update date of the registration
      PhishlabsIOC.DRP.AssociatedURLs.WhoIs.Registration.Registrar String Registrar of the URL
      PhishlabsIOC.DRP.AssociatedURLs.WhoIs.NameServers String Name servers of the URL

       

      Command Example

      !phishlabs-ioc-drp-get-closed-cases max_records=2

      Context Example
      {
    "PhishLabsIOC": {
        "DRP": [
            {
                "Attachments": [
                    {
                        "DateAdded": "2019-12-09T07:56:02Z",
                        "Description": "Source Email for case creation",
                        "FileName": "msg.mFAH.eml",
                        "FileURL": "https://caseapi.phishlabs.com/v1/data/attachment/581ba28d",
                        "ID": "581ba28d-1a59-11ea-8247-0ad24386a0d6",
                        "Type": "Email"
                    }
                ],
                "CaseID": "5808ec5a",
                "CaseNumber": 1417871,
                "CaseStatus": "Rejected",
                "CaseType": "Other",
                "CreatedBy": {
                    "DisplayName": "SOC PhishLabs",
                    "ID": "30c2e916",
                    "Name": "soc.phishlabs"
                },
                "Customer": "PhishLabs",
                "DateClosed": "2019-12-09T08:01:34Z",
                "DateCreated": "2019-12-09T07:56:01Z",
                "DateModified": "2019-12-09T08:01:34Z",
                "Description": "From: PhishLabs Security Operations <soc@phishlabs.com>\nSubject:",
                "ResolutionStatus": "Accidental creation",
                "Title": "=?gb2312?B?Rlc6I"
            },
            {
                "Attachments": [
                    {
                        "DateAdded": "2019-12-09T07:46:02Z",
                        "Description": "Source Email for case creation",
                        "FileName": "msg.fKAH.eml",
                        "FileURL": "https://caseapi.phishlabs.com/v1/data/attachment/f24c36a3",
                        "ID": "f24c36a3",
                        "Type": "Email"
                    }
                ],
                "CaseID": "f239fe62",
                "CaseNumber": 1417866,
                "CaseStatus": "Rejected",
                "CaseType": "Other",
                "CreatedBy": {
                    "DisplayName": "SOC PhishLabs",
                    "ID": "30c2e916",
                    "Name": "soc.phishlabs"
                },
                "Customer": "PhishLabs",
                "DateClosed": "2019-12-09T07:49:11Z",
                "DateCreated": "2019-12-09T07:46:01Z",
                "DateModified": "2019-12-09T07:49:11Z",
                "Description": "From: PhishLabs Security ",
                "ResolutionStatus": "Accidental creation",
                "Title": "?="
            }
        ]
    }
}
      Human Readable Output

      PhishLabs IOC - DRP - Closed cases

      CaseID Title CaseStatus DateCreated ResolutionStatus CreatedBy
      5808ec5a ?= Rejected 2019-12-09T07:56:01Z Accidental creation ID: 30c2e916 SOC PhishLabs
      f239fe62c =1?= Rejected 2019-12-09T07:46:01Z Accidental creation ID: 30c2e916
      Name: soc.phishlabs
      DisplayName: SOC PhishLabs

Configuration parameters

  • url — Server URL (e.g. https://example.net) (required)
  • credentials — User (required)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • fetchTime — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • fetchByDate — Fetch by date field
  • fetchLimit — Fetch limit (minimum is 20)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (4)

  • phishlabs-ioc-drp-get-case-by-id

    Retrieves a case by the case ID.

  • phishlabs-ioc-drp-get-cases

    Retrieves cases by the specified filters.

  • phishlabs-ioc-drp-get-closed-cases

    Get closed cases by filters.

  • phishlabs-ioc-drp-get-open-cases

    Retrieves open cases by the specified filters.

Source

PhishLabsIOC_DRP.py PhishLabsIOC_DRP_test.py PhishLabsIOC_DRP.yml PhishLabsIOC_DRP_description.md
Download History Raw 
[Digital Risk Protection](https://www.phishlabs.com/digital-risk-protection/) is a comprehensive service that provides proactive detection and rapid mitigation of digital\ 
risks across email, domain, social media, mobile, dark, deep, and open web vectors.