Check Point - Phishing Takedown

id: Check Point - Phishing Takedown
version: -1
name: Check Point - Phishing Takedown
description: |-
  Automates or semi-automates the takedown of high-confidence phishing websites detected by Cyberint.

  The playbook evaluates the confidence and severity of a Cyberint phishing-website alert, submits a takedown request via the Cyberint Takedown API (automatically or after analyst approval), polls the takedown request until it reaches a terminal status, and annotates the incident and notifies the SOC of the outcome.

  Requires the Cyberint Takedown integration to be configured.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 94a7e583-c1e5-4d2e-9de2-b22adee8c411
    type: start
    task:
      id: 94a7e583-c1e5-4d2e-9de2-b22adee8c411
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "14"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "14":
    id: "14"
    taskid: bcc8b85f-7acd-4003-8cb4-09a85dcd4ad7
    type: condition
    task:
      id: bcc8b85f-7acd-4003-8cb4-09a85dcd4ad7
      version: -1
      name: Is the Check Point EM Takedowns integration enabled?
      description: Runs the IsIntegrationAvailable script against the Check Point EM Takedowns integration so the playbook can short-circuit gracefully if no instance is configured.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: Builtin
    nexttasks:
      "no":
      - "16"
      "yes":
      - "1"
    scriptarguments:
      brandname:
        simple: Cyberint Takedowns
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -15
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "16":
    id: "16"
    taskid: 5db01688-a89a-488e-8371-0b77f72d58eb
    type: title
    task:
      id: 5db01688-a89a-488e-8371-0b77f72d58eb
      version: -1
      name: Check Point EM Takedowns Not Available
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      \'#none#\':
      - "17"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 990,
          "y": 225
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 39007e94-8bd2-4a06-92ec-ab55580610ec
    type: condition
    task:
      id: 39007e94-8bd2-4a06-92ec-ab55580610ec
      version: -1
      name: Is there a phishing website URL?
      type: condition
      iscommand: false
      brand: ""
      description: Verifies that the incident contains a phishing website URL to submit for takedown.
    nexttasks:
      '#default#':
      - "13"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.URL
            iscontext: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: 1edba630-8413-419f-929d-670f9e02b4e6
    type: condition
    task:
      id: 1edba630-8413-419f-929d-670f9e02b4e6
      version: -1
      name: Does the alert meet the takedown threshold?
      type: condition
      iscommand: false
      brand: ""
      description: Checks whether the alert confidence and severity are at or above the configured thresholds for initiating a takedown.
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: inputs.Confidence
            iscontext: true
          right:
            value:
              simple: inputs.ConfidenceThreshold
            iscontext: true
      - - operator: greaterThanOrEqual
          left:
            value:
              simple: inputs.Severity
            iscontext: true
          right:
            value:
              simple: inputs.MinSeverity
            iscontext: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": 380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: ddd6cb22-f504-47fa-a2fb-e95e55d0dc7d
    type: condition
    task:
      id: ddd6cb22-f504-47fa-a2fb-e95e55d0dc7d
      version: -1
      name: Is automated takedown enabled?
      type: condition
      iscommand: false
      brand: ""
      description: Determines whether to submit the takedown request automatically or to require analyst approval first (semi-automated).
    nexttasks:
      '#default#':
      - "4"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.AutoTakedown
            iscontext: true
          right:
            value:
              simple: "yes"
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 340,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: 9f7b97cd-d7b5-44b3-a690-399581f7c4c0
    type: regular
    task:
      id: 9f7b97cd-d7b5-44b3-a690-399581f7c4c0
      version: -1
      name: Approve phishing takedown request
      type: regular
      iscommand: false
      brand: ""
      description: |-
        Review the phishing website details (URL, registrar, detection reasons, SSL and password-field indicators) and approve the takedown request.

        Mark this task complete to submit the takedown request to Cyberint.
    nexttasks:
      '#none#':
      - "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 240,
          "y": 740
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: f055ad73-a342-4f56-bf76-e386d4c52feb
    type: regular
    task:
      id: f055ad73-a342-4f56-bf76-e386d4c52feb
      version: -1
      name: Submit takedown request
      description: Submits a takedown request to Cyberint for the phishing website URL. The task is skipped if the Check Point EM Takedowns integration is not enabled, allowing the playbook to continue gracefully.
      script: '|||cyberint-takedown-url'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      customer:
        complex:
          root: inputs.CustomerID
      reason:
        complex:
          root: inputs.Reason
      url:
        complex:
          root: inputs.URL
      brand:
        complex:
          root: inputs.Brand
      original_url:
        complex:
          root: inputs.OriginalURL
      alert_id:
        complex:
          root: inputs.AlertID
      note:
        complex:
          root: inputs.Note
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "6":
    id: "6"
    taskid: 57a97310-cbf6-4f17-bb0a-d10d7bd285fa
    type: regular
    task:
      id: 57a97310-cbf6-4f17-bb0a-d10d7bd285fa
      version: -1
      name: Annotate incident - takedown requested
      description: Tags the incident to indicate that a Cyberint takedown request has been submitted and is being tracked.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      tags:
        simple: cyberint-takedown-requested
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: d78661a9-3930-4e5c-b738-d33133e56d65
    type: playbook
    task:
      id: d78661a9-3930-4e5c-b738-d33133e56d65
      version: -1
      name: Poll Cyberint takedown status
      description: Polls the Cyberint takedown request on a schedule until its status changes to a terminal value (anything other than pending or request_sent).
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      Ids:
        complex:
          root: Cyberint.takedowns_submit
          accessor: id
      PollingCommandName:
        simple: cyberint-retrieve-takedowns
      PollingCommandArgName:
        simple: id
      AdditionalPollingCommandArgNames:
        simple: customer_id
      AdditionalPollingCommandArgValues:
        complex:
          root: inputs.CustomerID
      dt:
        simple: Cyberint.takedowns_list(val.status == "pending" || val.status == "request_sent").id
      Interval:
        complex:
          root: inputs.PollingInterval
      Timeout:
        complex:
          root: inputs.PollingTimeout
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: 5682d783-eb6e-4601-9d6f-a8d132d80436
    type: regular
    task:
      id: 5682d783-eb6e-4601-9d6f-a8d132d80436
      version: -1
      name: Annotate incident - takedown status updated
      description: Tags the incident to indicate that the Cyberint takedown request has reached a terminal status.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      tags:
        simple: cyberint-takedown-status-updated
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 084e857f-66e1-4ac4-99d8-08e6451fcaab
    type: regular
    task:
      id: 084e857f-66e1-4ac4-99d8-08e6451fcaab
      version: -1
      name: Notify SOC of takedown outcome
      type: regular
      iscommand: false
      brand: Builtin
      script: Print
      scriptName: Print
      description: |-
        Notify the SOC team of the final takedown status (see Cyberint.takedowns_list in the context).

        If Cyberint requires additional information to proceed (the takedown status indicates pending details), provide this information to the SOC as a high-priority item. Connect this task to your notification integration to automate this step.
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      value:
        simple: "Phishing takedown outcome for ${inputs.URL} (alert ${inputs.AlertID}): status=${Cyberint.takedowns_list.status}, status_reason=${Cyberint.takedowns_list.status_reason}, last_action=${Cyberint.takedowns_list.last_action_date}.\nIf the status indicates pending details, supply the additional information Cyberint is requesting (e.g. registrar correspondence, brand/copyright proof). Wire this task to your notification integration (email, Slack, Microsoft Teams) to dispatch a real alert to the SOC."
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1595
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: e0e46451-0783-404e-90fb-788315937f23
    type: regular
    task:
      id: e0e46451-0783-404e-90fb-788315937f23
      version: -1
      name: Manual review - confidence below threshold
      type: regular
      iscommand: false
      brand: Builtin
      script: Print
      scriptName: Print
      description: |-
        The phishing website alert did not meet the configured confidence and severity thresholds for an automated takedown.

        Review the alert and, if appropriate, submit a takedown request manually using the cyberint-takedown-url command.
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      value:
        simple: "Phishing alert did not meet the configured automated-takedown thresholds.\nURL: ${inputs.URL} Alert ID: ${inputs.AlertID} Confidence: ${inputs.Confidence} (threshold ${inputs.ConfidenceThreshold}) Severity: ${inputs.Severity} (minimum ${inputs.MinSeverity})\nReview the alert; if appropriate, submit a takedown request manually via cyberint-takedown-url customer=${inputs.CustomerID} url=${inputs.URL} reason=${inputs.Reason}."
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 760,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: bc7573f9-7482-48a6-9d4c-8007aa8713d7
    type: title
    task:
      id: bc7573f9-7482-48a6-9d4c-8007aa8713d7
      version: -1
      name: Takedown Flow Complete
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      \'#none#\':
      - "17"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: 3bfb6026-faa9-42a9-a5d6-15ff65d98509
    type: title
    task:
      id: 3bfb6026-faa9-42a9-a5d6-15ff65d98509
      version: -1
      name: Manual Review Required
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      \'#none#\':
      - "17"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 760,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "13":
    id: "13"
    taskid: cc44ed76-a9e8-4780-9d23-139389525260
    type: title
    task:
      id: cc44ed76-a9e8-4780-9d23-139389525260
      version: -1
      name: Not a Phishing Website Alert
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      \'#none#\':
      - "17"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 0,
          "y": 395
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "17":
    id: "17"
    taskid: b368697c-d6ba-44d7-ac05-8cb503f116d4
    type: title
    task:
      id: b368697c-d6ba-44d7-ac05-8cb503f116d4
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 760,
          "y": 1940
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "16_17_none": 0.83
    },
    "paper": {
      "dimensions": {
        "height": 2155,
        "width": 1370,
        "x": 0,
        "y": -150
      }
    }
  }
inputs:
- key: URL
  value:
    simple: ${incident.cyberintalerturl}
  required: false
  description: 'The phishing website URL to submit for takedown. Expected format: full URL including the scheme, e.g. ``http://evil.example.com/login``. Defaults to the URL from the Cyberint alert data.'
  playbookInputQuery:
- key: CustomerID
  value: {}
  required: true
  description: 'The Cyberint customer ID, as configured in the Cyberint Takedown integration. Expected format: customer identifier string, e.g. ``acme-corp``. Used to submit and track the takedown request.'
  playbookInputQuery:
- key: Reason
  value:
    simple: phishing
  required: false
  description: 'The takedown reason. One of: phishing, brand_abuse, impersonating_application, unofficial_application_distribution, malicious_content, social_media_impersonation, social_media_employee_impersonation, fake_job_post, sensitive_file_on_antivirus_repository, instant_messaging_impersonation, other. Default is phishing.'
  playbookInputQuery:
- key: AlertID
  value:
    simple: ${incident.alertid}
  required: false
  description: 'The Cyberint alert ID associated with the phishing website. Expected format: numeric alert ID, e.g. ``123456``. Used to correlate the takedown request with the alert.'
  playbookInputQuery:
- key: Brand
  value:
    simple: ${incident.cyberinttargetedbrand}
  required: false
  description: 'The brand the phishing website is impersonating. Required by the takedown API to determine the original (legitimate) URL when the customer profile does not resolve it automatically. Defaults to the Cyberint alert targeted brand.'
  playbookInputQuery:
- key: OriginalURL
  value: {}
  required: false
  description: 'The URL of the original, legitimate content being impersonated (for example, ``https://example.com``). Required by the takedown API to determine the original URL when the customer profile does not resolve it automatically.'
  playbookInputQuery:
- key: Confidence
  value:
    simple: ${incident.cyberintconfidence}
  required: false
  description: 'The confidence score (0-100) of the phishing website alert. Accepts a single number 0-100, e.g. ``80`` or ``95``. Defaults to the Cyberint alert confidence field.'
  playbookInputQuery:
- key: ConfidenceThreshold
  value:
    simple: "80"
  required: false
  description: 'Minimum confidence score (0-100) required to initiate a takedown. Accepts a single number 0-100, e.g. ``80``. Default is 80.'
  playbookInputQuery:
- key: Severity
  value:
    simple: ${incident.severity}
  required: false
  description: 'The severity of the incident. Accepts a single integer 1-4: ``1`` Low, ``2`` Medium, ``3`` High, ``4`` Critical. Defaults to the incident severity.'
  playbookInputQuery:
- key: MinSeverity
  value:
    simple: "3"
  required: false
  description: 'Minimum incident severity required to initiate a takedown. Accepts a single integer 1-4 (Low/Medium/High/Critical), e.g. ``3``. Default is 3 (High).'
  playbookInputQuery:
- key: AutoTakedown
  value:
    simple: "no"
  required: false
  description: 'Whether to submit the takedown request automatically (``yes``) or to require analyst approval first (``no``). Default is ``no``.'
  playbookInputQuery:
- key: PollingInterval
  value:
    simple: "5"
  required: false
  description: 'How often, in minutes, to poll the Cyberint takedown request status. Accepts a positive integer, e.g. ``5`` or ``15``. Default is 5.'
  playbookInputQuery:
- key: PollingTimeout
  value:
    simple: "1440"
  required: false
  description: 'How long, in minutes, to keep polling the takedown request status before timing out. Accepts a positive integer, e.g. ``1440`` (24 hours). Default is 1440.'
  playbookInputQuery:
- key: Note
  value:
    simple: Submitted automatically by the Check Point - Phishing Takedown SOAR playbook.
  required: false
  description: 'Optional free-text note attached to the Cyberint takedown request. Accepts a single string, e.g. ``Ticket ABC-1234`` or the default value. Use this to embed an internal ticket reference into the takedown request without editing the playbook.'
  playbookInputQuery:
outputs:
- contextPath: Cyberint.takedowns_submit
  description: The submitted Cyberint takedown request.
  type: unknown
- contextPath: Cyberint.takedowns_list
  description: The polled Cyberint takedown request, including its current status.
  type: unknown
tests:
- Check Point - Phishing Takedown - Test
fromversion: 6.10.0
marketplaces:
- xsoar
- marketplacev2
- platform