Check Point - Phishing Takedown

Automates or semi-automates the takedown of high-confidence phishing websites detected by Cyberint. The playbook evaluates the confidence and severity of a Cyberint phishing-website alert, submits a takedown request via the Cyberint Takedown API (automatically or after analyst approval), polls the takedown request until it reaches a terminal status, and annotates the incident and notifies the SOC of the outcome. Requires the Cyberint Takedown integration to be configured.

Pack

Cyberint

Tasks

17

Inputs

• URL — The phishing website URL to submit for takedown. Expected format: full URL including the scheme, e.g. ``http://evil.example.com/login``. Defaults to the URL from the Cyberint alert data.
• CustomerID — The Cyberint customer ID, as configured in the Cyberint Takedown integration. Expected format: customer identifier string, e.g. ``acme-corp``. Used to submit and track the takedown request.
• Reason — The takedown reason. One of: phishing, brand_abuse, impersonating_application, unofficial_application_distribution, malicious_content, social_media_impersonation, social_media_employee_impersonation, fake_job_post, sensitive_file_on_antivirus_repository, instant_messaging_impersonation, other. Default is phishing.
• AlertID — The Cyberint alert ID associated with the phishing website. Expected format: numeric alert ID, e.g. ``123456``. Used to correlate the takedown request with the alert.
• Brand — The brand the phishing website is impersonating. Required by the takedown API to determine the original (legitimate) URL when the customer profile does not resolve it automatically. Defaults to the Cyberint alert targeted brand.
• OriginalURL — The URL of the original, legitimate content being impersonated (for example, ``https://example.com``). Required by the takedown API to determine the original URL when the customer profile does not resolve it automatically.
• Confidence — The confidence score (0-100) of the phishing website alert. Accepts a single number 0-100, e.g. ``80`` or ``95``. Defaults to the Cyberint alert confidence field.
• ConfidenceThreshold — Minimum confidence score (0-100) required to initiate a takedown. Accepts a single number 0-100, e.g. ``80``. Default is 80.
• Severity — The severity of the incident. Accepts a single integer 1-4: ``1`` Low, ``2`` Medium, ``3`` High, ``4`` Critical. Defaults to the incident severity.
• MinSeverity — Minimum incident severity required to initiate a takedown. Accepts a single integer 1-4 (Low/Medium/High/Critical), e.g. ``3``. Default is 3 (High).
• AutoTakedown — Whether to submit the takedown request automatically (``yes``) or to require analyst approval first (``no``). Default is ``no``.
• PollingInterval — How often, in minutes, to poll the Cyberint takedown request status. Accepts a positive integer, e.g. ``5`` or ``15``. Default is 5.
• PollingTimeout — How long, in minutes, to keep polling the takedown request status before timing out. Accepts a positive integer, e.g. ``1440`` (24 hours). Default is 1440.
• Note — Optional free-text note attached to the Cyberint takedown request. Accepts a single string, e.g. ``Ticket ABC-1234`` or the default value. Use this to embed an internal ticket reference into the takedown request without editing the playbook.

Outputs

• Cyberint.takedowns_submit — The submitted Cyberint takedown request.
• Cyberint.takedowns_list — The polled Cyberint takedown request, including its current status.

Commands used

• cyberint-takedown-url
• setIncident