category: Data Enrichment & Threat Intelligence provider: BolsterAI commonfields: id: CheckPhish version: -1 configuration: - defaultvalue: https://developers.checkphish.ai/api/neo/scan display: CheckPhish API URL name: url type: 0 required: false - display: API Token name: token type: 4 hidden: true required: false - displaypassword: API Token name: credentials_api_token hiddenusername: true type: 9 required: false - display: 'Good Dispositions (CheckPhish labels for non-phishing URLs. Default is "clean")' name: good_disp options: - adult - cryptojacking - drug_spam - gambling - hacked_website - likely_phish - phish - scam - streaming - suspicious type: 16 required: false - display: 'Suspicious dispositions (CheckPhish labels for suspicious phishing URLs). Default is "drug_spam", "gambling", "hacked_website", "streaming", "suspicious"' name: susp_disp options: - adult - cryptojacking - drug_spam - gambling - hacked_website - likely_phish - phish - scam - streaming - suspicious type: 16 required: false - display: 'Bad dispositions (CheckPhish labels for phishing URLs). Defaults are "cryptojacking", "phish", "likely_phish", "scam".' name: bad_disp options: - adult - cryptojacking - drug_spam - gambling - hacked_website - likely_phish - phish - scam - streaming - suspicious type: 16 required: false - additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: B - Usually reliable display: Source Reliability name: integrationReliability options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged required: true type: 15 - display: Trust any certificate (not secure) name: insecure type: 8 required: false - display: Use system proxy settings name: proxy type: 8 required: false description: Check any URL to detect supsicious behavior. display: CheckPhish name: CheckPhish script: commands: - arguments: - description: A CSV list of URLs to check. isArray: true name: url required: true description: Checks URLs against the CheckPhish database and returns the results. name: CheckPhish-check-urls outputs: - contextPath: CheckPhish.URL.url description: URL that was submitted. type: String - contextPath: CheckPhish.URL.status description: CheckPhish job status of the URL. type: String - contextPath: CheckPhish.URL.jobID description: CheckPhish jobID that was assigned to the URL when it was submitted. type: String - contextPath: CheckPhish.URL.disposition description: The CheckPhish category (disposition) of the URL. type: String - contextPath: CheckPhish.URL.brand description: The brand (attack target) countered by the URL. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: URL.Data description: URL that was submitted. type: String - contextPath: URL.Malicious.Vendor description: CheckPhish. type: String - contextPath: URL.Malicious.Description description: The brand (attack target) countered by the URL. type: String - arguments: - default: true description: URL to query. isArray: true name: url required: true description: Retrieves URL information from CheckPhish. name: url outputs: - contextPath: CheckPhish.URL.url description: URL that was submitted. type: String - contextPath: CheckPhish.URL.status description: CheckPhish job status of the URL. type: String - contextPath: CheckPhish.URL.jobID description: CheckPhish jobID that was assigned to the URL when it was submitted. type: String - contextPath: CheckPhish.URL.disposition description: The CheckPhish category (disposition) of the URL. type: String - contextPath: CheckPhish.URL.brand description: The brand (attack target) countered by the URL. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String - contextPath: URL.Data description: URL that was submitted. type: String - contextPath: URL.Malicious.Vendor description: CheckPhish. type: String - contextPath: URL.Malicious.Description description: The brand (attack target) countered by the URL. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Reliability description: Reliability of the source providing the intelligence data. type: String runonce: false script: '-' type: python subtype: python3 dockerimage: demisto/python3:3.12.13.10116658 fromversion: 5.0.0 tests: - No tests