PhishLabs - Whitelist false positives

This playbook can be used in a job to add to the allow list indicators from PhishLabs that were classified as false positives, according to a defined period of time.

PhishLabs · 5 tasks · 1 input · 0 outputs

Inputs

  • Since — Whitelist indicators within this duration (from now).

Commands used

closeInvestigation

Flowchart

yes Start Start Whitelist false positives - PhishLabsPopulateIndicators Whitelist false positives PhishLabsPopulateIndicators Close investigation - closeInvestigation Close investigation closeInvestigation Is PhishLabs IOC enabled? Is PhishLabs IOC enabled? Done Done