6437c006-1d86-4cdc-89d5-23305f207e3a

Details

ID	`6437c006-1d86-4cdc-89d5-23305f207e3a`
Provider	Proofpoint
Category	Data Enrichment & Threat Intelligence
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

PhishUp prevents phishing attacks, protects your staff and your brand with AI

If you don’t have PhishUp Api Key please create an account on PhishUp and get a free Api Key.
Also you can visit and test PhishUp Web Demo.

If you have any question feel free to concat us: info@phishup.com

Configure PhishUp in Cortex

Parameter	Description	Required
API KEY		True
Incident type		False
Trust any certificate (not secure)		False
Use system proxy settings		False
PhishUp Playbook Actions	If there is any Phishing activity in mail, what should PhishUp do?	True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

url

PhishUp Url investigation

Base Command

url

Input

Argument Name	Description	Required
Url	URL for phishup investigation.	Required

Context Output

Path	Type	Description
PhishUp.Url	String	Incoming Url
PhishUp.Result	String	response types “Clean”, “Phish”
PhishUp.Score	Number	Phishup Engine Url Score
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Score	Number	The actual score.
URL.Data	String	The URL

Base Command

phishup-get-chosen-action

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
PhishUp.Action	String	Chosen action from PhishUp instance

Base Command

phishup-evaluate-response

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
PhishUp.Evaluation	String	Evaluating PhishUp Results and Return Phish If There is an Phish Website

Configuration parameters

credentials — (required)
incidentType — Incident type
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
phishup-playbook-action — PhishUp Playbook Actions (required)
integrationReliability — Source Reliability
feedExpirationPolicy —
feedExpirationInterval —

Commands (3)

phishup-evaluate-response
Evaluation PhishUp URLs Response.
phishup-get-chosen-action
Get chosen action from PhishUp instance.
url
Url for PhishUp Reputation Investigation.

Source

PhishUp.py PhishUp_test.py PhishUp.yml PhishUp_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Proofpoint
commonfields:
  id: 6437c006-1d86-4cdc-89d5-23305f207e3a
  version: -1
configuration:
- additionalinfo: PhishUp Api Key
  displaypassword: API Key
  hiddenusername: true
  name: credentials
  required: true
  type: 9
- display: Incident type
  name: incidentType
  type: 13
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- additionalinfo: If there is any Phishing activity in mail, what should PhishUp do?
  defaultvalue: Nothing
  display: PhishUp Playbook Actions
  name: phishup-playbook-action
  options:
  - Nothing
  - ' Delete Mail'
  - ' Move to SPAM'
  required: true
  type: 15
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  required: false
- defaultvalue: indicatorType
  name: feedExpirationPolicy
  display: ''
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
- defaultvalue: '20160'
  name: feedExpirationInterval
  display: ''
  type: 1
  required: false
description: PhishUp prevents phishing attacks, protects your staff and your brand with AI.
display: PhishUp
name: 6437c006-1d86-4cdc-89d5-23305f207e3a
script:
  commands:
  - arguments:
    - default: true
      description: Url for PhishUp Reputation Investigation.
      isArray: true
      name: url
      required: true
    description: Url for PhishUp Reputation Investigation.
    name: url
    outputs:
    - contextPath: PhishUp.Url
      description: Incoming URL.
      type: String
    - contextPath: PhishUp.Result
      description: response types "Clean", "Phish", "Error".
      type: String
    - contextPath: PhishUp.Score
      description: Phishup Engine Url Score.
      type: Number
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: URL.Data
      description: The URL.
      type: String
  - description: Get chosen action from PhishUp instance.
    name: phishup-get-chosen-action
    outputs:
    - contextPath: PhishUp.Action
      description: Chosen action from PhishUp instance.
      type: String
  - arguments:
    - description: takes investigate-url command result.
      isArray: true
      name: URLs
    description: Evaluation PhishUp URLs Response.
    name: phishup-evaluate-response
    outputs:
    - contextPath: PhishUp.Evaluation
      description: returns "Phish" if any response has "Phish" result.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests (auto formatted)
fromversion: 6.0.0