category: Data Enrichment & Threat Intelligence
provider: Fortra
commonfields:
  id: PhishLabs IOC EIR
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- defaultvalue: https://caseapi.phishlabs.com
  display: Server URL (e.g. https://example.net)
  name: url
  required: true
  type: 0
  section: Connect
- display: User
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Source Reliability
  name: integrationReliability
  type: 15
  required: true
  additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  section: Collect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- defaultvalue: '1 hours'
  section: Collect
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: fetchTime
  type: 0
  required: false
- display: Fetch limit
  name: fetchLimit
  section: Collect
  type: 0
  required: false
  defaultvalue: '25'
- display: Trust any certificate (not secure)
  name: insecure
  section: Connect
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  required: false
description: Get Email Incident Reports from PhishLabs.
display: PhishLabs IOC EIR
name: PhishLabs IOC EIR
script:
  commands:
  - arguments:
    - auto: PREDEFINED
      description: Filter incidents by status. Can be "open" or "closed".
      name: status
      predefined:
      - open
      - closed
    - description: |-
        Return incidents created on or after this timestamp.
        The timestamp is in RFC3339 format (2019-04-12T23:20:50Z).
      name: created_after
    - description: |-
        Return Incidents created on or before this timestamp.
        The timestamp is in RFC3339 format (2019-04-12T23:20:50Z).
      name: created_before
    - description: |-
        Return Incidents closed on or after this timestamp.
        The timestamp is in RFC3339 format (2019-04-12T23:20:50Z).
      name: closed_after
    - description: |-
        Returns Incidents closed on or before the given timestamp
        Timestamp is in RFC3339 format(2019-04-12T23:20:50Z).
      name: closed_before
    - auto: PREDEFINED
      description: Returns incidents sorted by a column. Can be "created_at" or "closed_at".
      name: sort
      predefined:
      - created_at
      - closed_at
    - auto: PREDEFINED
      description: How to sort returned incidents. This will be applied to the given sort parameter. Can be "asc" (ascending) or "desc" (descending).
      name: direction
      predefined:
      - asc
      - desc
    - defaultValue: '25'
      description: The maximum number of incidents to return (0-50). Default is 25.
      name: limit
    - defaultValue: '0'
      description: Offset from last incident.
      name: offset
    - description: The time range for which to return incidents (<number> <time unit>, e.g., 12 hours, 7 days).
      name: period
    description: Returns EIR incidents from PhishLabs-IOC EIR service. The default number of incidents returned is 25.
    name: phishlabs-ioc-eir-get-incidents
    outputs:
    - contextPath: PhishLabsIOC.EIR.CaseType
      description: Incident reason type.
      type: String
    - contextPath: PhishLabsIOC.EIR.Classification
      description: Incident classification.
      type: String
    - contextPath: PhishLabsIOC.EIR.SubClassification
      description: Detailed classification.
      type: String
    - contextPath: PhishLabsIOC.EIR.Severity
      description: Incident severity.
      type: String
    - contextPath: PhishLabsIOC.EIR.SubmissionMethod
      description: Email submission method.
      type: String
    - contextPath: PhishLabsIOC.EIR.FurtherReviewReason
      description: Incident further review reason.
      type: String
    - contextPath: PhishLabsIOC.EIR.ID
      description: ID of the incident.
      type: String
    - contextPath: PhishLabsIOC.EIR.Title
      description: Title of the reported incident.
      type: String
    - contextPath: PhishLabsIOC.EIR.Description
      description: Description of the reported incident.
      type: String
    - contextPath: PhishLabsIOC.EIR.Status
      description: Status of the reported incident.
      type: Boolean
    - contextPath: PhishLabsIOC.EIR.Created
      description: Date that the incident was created.
      type: Date
    - contextPath: PhishLabsIOC.EIR.Modified
      description: Date that the incident was last modified.
      type: Date
    - contextPath: PhishLabsIOC.EIR.Closed
      description: Date that the incident was closed.
      type: Date
    - contextPath: PhishLabsIOC.EIR.Duration
      description: Time until the incident will be closed (in seconds).
      type: Number
    - contextPath: PhishLabsIOC.EIR.EmailReportedBy
      description: User who reported the incident.
      type: String
    - contextPath: PhishLabsIOC.EIR.Email.EmailBody
      description: Email body.
      type: String
    - contextPath: PhishLabsIOC.EIR.Email.Sender
      description: Email sender.
      type: String
    - contextPath: PhishLabsIOC.EIR.Email.URL.URL
      description: URL found in the email body.
      type: String
    - contextPath: PhishLabsIOC.EIR.Email.URL.Malicious
      description: Whether the URL is malicious.
      type: Boolean
    - contextPath: PhishLabsIOC.EIR.Email.URL.MaliciousDomain
      description: Whether the URL domain is malicious.
      type: Boolean
    - contextPath: PhishLabsIOC.EIR.Email.Attachment.FileName
      description: Name of the attached file.
      type: String
    - contextPath: PhishLabsIOC.EIR.Email.Attachment.MimeType
      description: Attachment MIME type.
      type: String
    - contextPath: PhishLabsIOC.EIR.Email.Attachment.MD5
      description: MD5 hash of the attachment.
      type: String
    - contextPath: PhishLabsIOC.EIR.Email.Attachment.SHA256
      description: SHA256 hash of the attachment.
      type: String
    - contextPath: PhishLabsIOC.EIR.Email.Attachment.Malicious
      description: Whether the file is malicious.
      type: Boolean
    - contextPath: Email.To
      description: The recipient of the email.
      type: String
    - contextPath: Email.From
      description: The sender of the email.
      type: String
    - contextPath: Email.Body/HTML
      description: The plain-text version of the email.
      type: String
    - contextPath: File.Name
      description: The full file name (including file extension).
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: Unknown
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.Malicious.Vendor
      description: The vendor that reported the file as malicious.
      type: String
    - contextPath: File.Malicious.Description
      description: A description explaining why the file was determined to be malicious.
      type: String
    - contextPath: URL.Data
      description: The URL.
      type: String
    - contextPath: URL.Malicious.Vendor
      description: The vendor reporting the URL as malicious.
      type: String
    - contextPath: URL.Malicious.Description
      description: A description of the malicious URL.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: String
  - arguments:
    - description: The ID of the incident.
      name: incident_id
      required: true
    description: Returns a single Incident based on the given ID.
    name: phishlabs-ioc-eir-get-incident-by-id
    outputs:
    - contextPath: PhishLabsIOC.EIR.CaseType
      description: Incident reason type.
      type: String
    - contextPath: PhishLabsIOC.EIR.Classification
      description: Incident classification.
      type: String
    - contextPath: PhishLabsIOC.EIR.SubClassification
      description: Detailed classification..
      type: String
    - contextPath: PhishLabsIOC.EIR.Severity
      description: Incident severity.
      type: String
    - contextPath: PhishLabsIOC.EIR.SubmissionMethod
      description: Email submission method.
      type: String
    - contextPath: PhishLabsIOC.EIR.FurtherReviewReason
      description: Incident further review reason.
      type: String
    - contextPath: PhishLabsIOC.EIR.ID
      description: ID of the incident.
      type: String
    - contextPath: PhishLabsIOC.EIR.Title
      description: Title of the reported incident.
      type: String
    - contextPath: PhishLabsIOC.EIR.Description
      description: Description of the reported incident.
      type: String
    - contextPath: PhishLabsIOC.EIR.Status
      description: Status of the reported incident.
      type: Boolean
    - contextPath: PhishLabsIOC.EIR.Created
      description: Date that the incident was created.
      type: Date
    - contextPath: PhishLabsIOC.EIR.Modified
      description: Date that the incident was last modified.
      type: Date
    - contextPath: PhishLabsIOC.EIR.Closed
      description: Date that the incident was closed.
      type: Date
    - contextPath: PhishLabsIOC.EIR.Duration
      description: Time until the incident will be closed (in seconds).
      type: Number
    - contextPath: PhishLabsIOC.EIR.EmailReportedBy
      description: User who reported the incident.
      type: String
    - contextPath: PhishLabsIOC.EIR.Email.EmailBody
      description: Email body.
      type: String
    - contextPath: PhishLabsIOC.EIR.Email.Sender
      description: Email sender.
      type: String
    - contextPath: PhishLabsIOC.EIR.Email.URL.URL
      description: URL found in the email body.
      type: String
    - contextPath: PhishLabsIOC.EIR.Email.URL.Malicious
      description: Whether the URL is malicious.
      type: Boolean
    - contextPath: PhishLabsIOC.EIR.Email.URL.MaliciousDomain
      description: Whether the URL domain is malicious.
      type: Boolean
    - contextPath: PhishLabsIOC.EIR.Email.Attachment.FileName
      description: Name of the attached file.
      type: String
    - contextPath: PhishLabsIOC.EIR.Email.Attachment.MimeType
      description: Attachment MIME type.
      type: String
    - contextPath: PhishLabsIOC.EIR.Email.Attachment.MD5
      description: MD5 hash of the attachment.
      type: String
    - contextPath: PhishLabsIOC.EIR.Email.Attachment.SHA256
      description: SHA256 hash of the attachment.
      type: String
    - contextPath: PhishLabsIOC.EIR.Email.Attachment.Malicious
      description: Whether the file is malicious.
      type: Boolean
    - contextPath: Email.To
      description: The recipient of the email.
      type: String
    - contextPath: Email.From
      description: The sender of the email.
      type: String
    - contextPath: Email.Body/HTML
      description: The plain-text version of the email.
      type: String
    - contextPath: File.Name
      description: The full file name (including file extension).
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: Unknown
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.Malicious.Vendor
      description: The vendor that reported the file as malicious.
      type: String
    - contextPath: File.Malicious.Description
      description: A description explaining why the file was determined to be malicious.
      type: String
    - contextPath: URL.Data
      description: The URL.
      type: String
    - contextPath: URL.Malicious.Vendor
      description: The vendor reporting the URL as malicious.
      type: String
    - contextPath: URL.Malicious.Description
      description: A description of the malicious URL.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- PhishlabsIOC_EIR-Test
fromversion: 5.0.0