SlashNext Phishing Incident Response
SlashNext Phishing Incident Response integration allows Cortex XSOAR users to fully automate analysis of suspicious URLs. For example, IR teams responsible for abuse inbox management can extract links or domains out of suspicious emails and automatically analyze them with the SlashNext SEER threat detection cloud to get definitive, binary verdicts (malicious or benign) along with IOCs, screen shots, and more. Automating URL analysis can save IR teams hundreds of hours versus manually triaging these emails or checking URLs and domains against less accurate phishing databases and domain reputation services.
- Category
- Data Enrichment & Threat Intelligence
- Pack
- SlashNextPhishingIncidentResponse
Configuration parameters
- apiurl — SlashNext API Base URL (required)
- apikey — SlashNext API Key (required)
- unsecure — Trust any certificate (not secure)
- proxy — Use system proxy settings
- integrationReliability — Source Reliability
- feedExpirationPolicy —
- feedExpirationInterval —
Commands (14)
- domain — Looks up a Fully Qualified Domain Name (FQDN) indicator in the SlashNext Threat Intelligence database.
- ip — Looks up an IP address indicator in the SlashNext Threat Intelligence database.
- slashnext-api-quota — Queries the SlashNext cloud database and retrieves the details of API quota.
- slashnext-download-html — Downloads a web page HTML against a previous URL scan request.
- slashnext-download-screenshot — Downloads a screenshot of a web page against a previous URL scan request.
- slashnext-download-text — Downloads the text of a web page against a previous URL scan request.
- slashnext-host-report — Queries the SlashNext Cloud database and retrieves a detailed report for a host and associated URL.
- slashnext-host-reputation — Queries the SlashNext Cloud database and retrieves the reputation of a host.
- slashnext-host-urls — Queries the SlashNext Cloud database and retrieves a list of all URLs associated with the specified host.
- slashnext-scan-report — Retrieves the results of a URL scan against a previous scan request. If the scan is finished, results will be returned immediately; otherwise the message "check back later" will be returned.
- slashnext-url-reputation — Queries the SlashNext Cloud database and retrieves the reputation of a url.
- slashnext-url-scan — Performs a real-time URL scan with SlashNext cloud-based SEER Engine. If the specified URL already exists in the cloud database, scan results will be returned immediately. If not, this command will submit a URL scan request and return with the message "check back later" and include a unique Scan ID. You can check the results of this scan using the "slashnext-scan-report" command anytime after 60 seconds using the returned Scan ID.
- slashnext-url-scan-sync — Performs a real-time URL scan with SlashNext cloud-based SEER Engine in a blocking mode. If the specified URL already exists in the cloud database, scan result will be returned immediately. If not, this command will submit a URL scan request and wait for the scan to finish. The scan may take up to 60 seconds to finish.
- url — Queries the SlashNext Cloud database and retrieves the reputation of a url.