Phisher

Details

ID	`Phisher`
Provider	Vista Equity Partners
Category	Network Security
From Version	5.5.0
Docker Image	`demisto/python3:3.12.13.10404775`
Supported Modules	Agentix XSIAM

README

KnowBe4 PhishER integration allows to pull events from PhishER system and do mutations.
This integration was integrated and tested with version 6.0.0 of XSOAR

Configure Phisher in Cortex

Parameter	Description	Required
Your server URL		True
API Key		True
First Fetch Time	First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)	False
Fetch incidents		False
Fetch Limit	Maximum number of alerts per fetch. Default is 50, maximum is 100.	False
Incident type		False
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

phisher-message-list

Command to get messages from PhishER

Base Command

phisher-message-list

Input

Argument Name	Description	Required
limit	The maximum number of messages to fetch. Default is 50.	Optional
query	The Lucene query to search against.	Optional
id	ID of specific message to retrieve. If ID is given query will be ignored.	Optional
include_events	Whether to include all message events in the result. Possible values are: False, True. Default is False.	Optional

Context Output

Path	Type	Description
Phisher.Message.actionStatus	String	Action Status
Phisher.Message.attachments	String	A collection of attachments associated with this message
Phisher.Message.category	String	The message’s category
Phisher.Message.comments	String	A collection of comments associated with this message.
Phisher.Message.events	String	A collection of events associated with this message.
Phisher.Message.from	String	Sender’s email
Phisher.Message.id	String	Unique identifier for the message.
Phisher.Message.links	String	A collection of links that were found in the message.
Phisher.Message.phishmlReport	String	The PhishML report associated with this message
Phisher.Message.pipelineStatus	String	Pipeline Status
Phisher.Message.reportedBy	String	The person who reported the message.
Phisher.Message.rawUrl	String	URL where to download the raw message
Phisher.Message.rules	String	A collection of rules associated with this message.
Phisher.Message.severity	String	The message’s severity
Phisher.Message.subject	String	Subject of the message.
Phisher.Message.tags	String	A collection of tags associated with this message.

Command Example

!phisher-message-list id=00a43d65-5802-4df6-9c3c-f7d2024ddb0b

Context Example

{
    "Phisher": {
        "Message": {
            "actionStatus": "IN_REVIEW",
            "attachments": [],
            "category": "CLEAN",
            "comments": [
                {
                    "body": "Folarin Balogun",
                    "createdAt": "2021-08-17T14:43:22Z"
                },
                {
                    "body": "Emile Smith Rowe 10",
                    "createdAt": "2021-08-17T14:21:17Z"
                },
                {
                    "body": "Emile Smith Rowe",
                    "createdAt": "2021-08-17T14:20:32Z"
                },
                {
                    "body": "Chupi & Toto",
                    "createdAt": "2021-08-16T12:39:15Z"
                }
            ],
            "created at": "2021-07-07T15:18:58+00:00",
            "from": "ekatsenelson@example.com",
            "id": "00a43d65-5802-4df6-9c3c-f7d2024ddb0b",
            "links":[],
            "phishmlReport": null,
            "pipelineStatus": "PROCESSED",
            "rawUrl": "https://phisher.example.com",
            "reportedBy": "ekatsenelson@example.com",
            "rules": [],
            "severity": "MEDIUM",
            "subject": "Fwd: Your next career opportunity is... Right Here!",
            "tags": [
                {
                    "name": "SIA",
                    "type": "STANDARD"
                },
                {
                    "name": "DAVY KLAASEN",
                    "type": "STANDARD"
                },
                {
                    "name": "DUSAN TADIC",
                    "type": "STANDARD"
                },
                {
                    "name": "LENO",
                    "type": "STANDARD"
                },
                {
                    "name": "BALOGUN",
                    "type": "STANDARD"
                },
                {
                    "name": "RYAN GRAVENBERGH",
                    "type": "STANDARD"
                }
            ]
        }
    }
}

Human Readable Output

Messages

ID Status Category From Severity Created At

00a43d65-5802-4df6-9c3c-f7d2024ddb0b IN_REVIEW CLEAN ekatsenelson@example.com MEDIUM 2021-07-07T15:18:58+00:00

ID	Status	Category	From	Severity	Created At
00a43d65-5802-4df6-9c3c-f7d2024ddb0b	IN_REVIEW	CLEAN	ekatsenelson@example.com	MEDIUM	2021-07-07T15:18:58+00:00

phisher-create-comment

Adds a comment to a PhishER message

Base Command

phisher-create-comment

Input

Argument Name	Description	Required
id	Message ID.	Required
comment	The comment to add.	Required

Context Output

There is no context output for this command.

Command Example

!phisher-create-comment id=00a43d65-5802-4df6-9c3c-f7d2024ddb0b comment="Test Comment"

Human Readable Output

The comment was added successfully

phisher-update-message

Updates a PhishER message status. User must provide at least one argument.

Base Command

phisher-update-message

Input

Argument Name	Description	Required
category	Message Category, can be: UNKNOWN,CLEAN,SPAM,THREAT . Possible values are: UNKNOWN, CLEAN, SPAM, THREAT.	Optional
status	Message Status, can be: RECEIVED,IN_REVIEW,RESOLVED. Possible values are: RECEIVED, IN_REVIEW, RESOLVED.	Optional
severity	Message Severity, can be: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL. Possible values are: UNKNOWN, LOW, MEDIUM, HIGH, CRITICAL.	Optional
id	Message ID.	Required

Context Output

There is no context output for this command.

Command Example

!phisher-update-message id=00a43d65-5802-4df6-9c3c-f7d2024ddb0b category=THREAT severity=MEDIUM status=IN_REVIEW

Human Readable Output

The message was updated successfully

phisher-tags-create

Add tags to a given message

Base Command

phisher-tags-create

Input

Argument Name	Description	Required
id	Message ID.	Required
tags	Comma separated list of tags to add.	Required

Context Output

There is no context output for this command.

Command Example

!phisher-tags-create id=00a43d65-5802-4df6-9c3c-f7d2024ddb0b tags="Tag1, Tag2"

Human Readable Output

The tags were updated successfully

phisher-tags-delete

Removes tags from a given message.

Base Command

phisher-tags-delete

Input

Argument Name	Description	Required
id	Message ID.	Required
tags	Comma separated list of tags to remove.	Required

Context Output

There is no context output for this command.

Command Example

!phisher-tags-delete id=00a43d65-5802-4df6-9c3c-f7d2024ddb0b tags="Tag2"

Human Readable Output

The tags were deleted successfully

Configuration parameters

url — Your server URL (required)
apikey —
first_fetch — First Fetch Time
isFetch — Fetch incidents
max_fetch — Fetch Limit
look_back — Advanced: Minutes to look back when fetching
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (5)

phisher-create-comment
Adds a comment to a PhishER message.
phisher-message-list
Command to get messages from PhishER.
phisher-tags-create
Add tags to a given message. If you have existing PhishER actions that would trigger for the tag that you're adding, you'll need to manually run the actions.
phisher-tags-delete
Removes tags from a given message.
phisher-update-message
Updates a PhishER message status. User must provide at least one argument.

Source

knowbe4Phisher.py knowbe4Phisher_test.py knowbe4Phisher.yml command_examples.txt knowbe4Phisher_description.md

Download History Raw

phisher-message-list id=00a43d65-5802-4df6-9c3c-f7d2024ddb0b
phisher-message-list include_events=True
phisher-create-comment id=00a43d65-5802-4df6-9c3c-f7d2024ddb0b comment="Test Comment"
phisher-update-message id=00a43d65-5802-4df6-9c3c-f7d2024ddb0b category=THREAT severity=MEDIUM status=IN_REVIEW
phisher-tags-create id=00a43d65-5802-4df6-9c3c-f7d2024ddb0b tags="Tag1, Tag2"
phisher-tags-delete id=00a43d65-5802-4df6-9c3c-f7d2024ddb0b tags="Tag2"