PhishTank V2

Details

ID	`PhishTank V2`
Provider	Open Source
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10325753`
Supported Modules	Agentix XSIAM

README

PhishTank is a free community site where anyone can submit, verify, track and share phishing data.
This integration was integrated and tested with version 1.0.1 of PhishTank.

Configure PhishTankV2 in Cortex

Parameter	Description	Required
use_https	Use HTTPS connection	False
Source Reliability	Reliability of the source providing the intelligence data.	B - Usually reliable
proxy	Use system proxy settings	False
insecure	Trust any certificate (not secure)	False
fetchIntervalHours	Database refresh interval (hours)	False

Best Practice

When using the PhishTank V2 integration, we recommend that you use an engine to run the integration instance,
and to use different engines for different tenants.
You should open a platform feature request (FR) to request separate egress IPs for the different tenants.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

url

Checks the reputation of the supplied URLs.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

url

Input

Argument Name	Description	Required
url	A comma-separated list of URLs to check the reputation of.	Required

Context Output

Path	Type	Description
URL.Data	String	A list of URLs with a bad reputation.
URL.Malicious.Vendor	String	For malicious URLs, the vendor that tagged the URL as malicious.
URL.Malicious.Description	String	For malicious URLs, the reason the vendor tagged the URL as malicious.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
DBotScore.Reliability	String	Reliability of the source providing the intelligence data.

Command Example

!url url=hxxp://login.rakuten.co.jp.reise

Human Readable Output

PhishTankV2 Database - URL Query

Found matches for URL hxxp://login.rakuten.co.jp.reise

online phish_id submission_time target verification_time verified

yes 6784982 2020-09-27T19:04:35+00:00 Other 2020-09-27T19:10:20+00:00 yes

Additional details at http://www.phishtank.com/phish_detail.php?phish_id=6784982

online	phish_id	submission_time	target	verification_time	verified
yes	6784982	2020-09-27T19:04:35+00:00	Other	2020-09-27T19:10:20+00:00	yes

phishtank-reload

Reload PhishTank database

Base Command

phishtank-reload

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example

!phishtank-reload

Human Readable Output

PhishTankV2 Database reloaded

Total 13181 URLs loaded

phishtank-status

Show PhishTank database status

Base Command

phishtank-status

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example

!phishtank-status

Human Readable Output

PhishTankV2 Database Status

Total 13181 URLs loaded

Last Load time Sun Oct 04 2020 09:43:01 (UTC)

Configuration parameters

username — Username
use_https — Use HTTPS connection
integrationReliability — Source Reliability (required)
fetchIntervalHours — Database refresh interval (number of hours to wait between each loading)
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)

Commands (3)

phishtank-reload
Reloads the PhishTank downloadable database. PhishTank database is an up to date phishing detection file (updated hourly) .
phishtank-status
Shows the status (timestamp) of the last time that PhishTank database was loaded.
url
Checks the reputation of the supplied URLs.

Source

PhishTankV2.py PhishTankV2_test.py PhishTankV2.yml PhishTankV2_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Open Source
sectionorder:
- Connect
- Collect
commonfields:
  id: PhishTank V2
  version: -1
configuration:
- display: Username
  section: Connect
  name: username
  type: 0
- defaultvalue: 'false'
  section: Connect
  display: Use HTTPS connection
  name: use_https
  type: 8
  required: false
- additionalinfo: Reliability of the source providing the intelligence data.
  section: Collect
  defaultvalue: C - Fairly reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
- defaultvalue: '1'
  display: Database refresh interval (number of hours to wait between each loading)
  name: fetchIntervalHours
  section: Collect
  type: 0
  required: false
- display: Use system proxy settings
  section: Connect
  name: proxy
  type: 8
  required: false
- display: Trust any certificate (not secure)
  section: Connect
  name: insecure
  type: 8
  required: false
description: PhishTank is a free community site where anyone can submit, verify, track, and share phishing data.
display: PhishTank v2
name: PhishTank V2
script:
  commands:
  - arguments:
    - default: true
      defaultValue: ""
      description: A comma-separated list of URLs to check the reputation of.
      isArray: true
      name: url
      required: true
    description: Checks the reputation of the supplied URLs.
    name: url
    outputs:
    - contextPath: URL.Data
      description: A list of URLs with a bad reputation.
      type: String
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that tagged the URL as malicious.
      type: String
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the reason the vendor tagged the URL as malicious.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String
  - description: Reloads the PhishTank downloadable database. PhishTank database is an up to date phishing detection file (updated hourly) .
    name: phishtank-reload
  - description: Shows the status (timestamp) of the last time that PhishTank database was loaded.
    name: phishtank-status
  dockerimage: demisto/python3:3.12.13.10325753
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests
fromversion: 5.0.0