Fortra Phishlabs Security

Fortra PhishLabs Security is a platform that provides threat intelligence and incident response services to combat phishing attacks.

Fortra Phishlabs Security is a comprehensive platform designed to automate phishing incident response and threat intelligence. This connector allows users to seamlessly integrate Fortra Phishlabs Security with Swimlane Turbine, enabling the retrieval of phishing incidents and detailed incident data. By leveraging this integration, security teams can enhance their incident response capabilities, streamline workflows, and improve threat detection and analysis within their security operations center (SOC).

Prerequisites

Before you can use the Fortra PhishLabs Security connector for Turbine, you'll need access to the Fortra PhishLabs API. This requires the following:

HTTP Basic authentication using the following parameters:

URL: The endpoint URL for accessing Fortra PhishLabs Security API.

Username: Your Fortra PhishLabs account username.

Password: Your Fortra PhishLabs account password.

Additional Documentation

Fortra Phishlabs Security Connector Documentation

Fortra Phishlabs Security API Documentation

Fortra Phishlabs Security Authentication Guide

Configurations

HTTP Basic Authentication

Authenticates using username and password.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
username	Username	string	Required
password	Password	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Get Incident

Returns a single incident from Fortra Phishlabs Security based on the given ID.

Endpoint

URL: /idapi/v1/incidents/{{service}}/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.service	string	Optional	Parameters for the Get Incident action
path_parameters.id	string	Optional	Parameters for the Get Incident action

Input Example

{"path_parameters":{"service":"EIR","id":"INC0094172"}}

Output

Parameter	Type	Description
metadata	object	Response data
metadata.count	number	Response data
incidents	array	Unique identifier
incidents.id	string	Unique identifier
incidents.title	string	Unique identifier
incidents.description	string	Unique identifier
incidents.status	string	Unique identifier
incidents.created	string	Unique identifier
incidents.modified	string	Unique identifier
incidents.closed	string	Unique identifier
incidents.duration	number	Unique identifier
incidents.service	string	Unique identifier
incidents.details	object	Unique identifier
incidents.details.caseType	string	Unique identifier
incidents.details.classification	string	Unique identifier
incidents.details.subClassification	string	Unique identifier
incidents.details.severity	string	Unique identifier
incidents.details.emailReportedBy	string	Unique identifier
incidents.details.emailReceivedDate	string	Unique identifier
incidents.details.emailBody	string	Request body data
incidents.details.messageID	string	Unique identifier
incidents.details.submissionMethod	string	HTTP method to use
incidents.details.sender	string	Unique identifier
incidents.details.furtherReviewReason	string	Unique identifier
incidents.details.offlineUponReview	boolean	Unique identifier

Output Example

{"metadata":{"count":1},"incidents":[{"id":"INC123456","title":"Fwd: Phishing Email","description":"This is a malicious phishing email.","status":"closed","created":"2019-09-24T16:17:49Z","modified":"2019-09-24T16:40:35Z","closed":"2019-09-24T16:40:35Z","duration":1366,"service":"SEA","details":{}}]}

Get Incidents

Return a set of incidents filtered by specified query parameters in Fortra Phishlabs Security. Requires the 'service' path parameter.

Endpoint

URL: /idapi/v1/incidents/{{service}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.service	string	Required	The service to query. EIR
parameters.status	string	Optional	Parameters for the Get Incidents action
parameters.created_after	string	Optional	Parameters for the Get Incidents action
parameters.created_before	string	Optional	Parameters for the Get Incidents action
parameters.closed_after	string	Optional	Parameters for the Get Incidents action
parameters.closed_before	string	Optional	Parameters for the Get Incidents action
parameters.limit	number	Optional	Parameters for the Get Incidents action
parameters.offset	number	Optional	Parameters for the Get Incidents action
parameters.sort	string	Optional	Parameters for the Get Incidents action
parameters.message_id	string	Optional	Parameters for the Get Incidents action

Input Example

{"parameters":{"status":"closed","created_after":"2019-04-12T23:20:50Z","created_before":"2019-04-12T23:20:50Z","closed_after":"2019-04-12T23:20:50Z","closed_before":"2019-04-12T23:20:50Z","limit":25,"offset":0,"sort":"asc","message_id":"1234567890"},"path_parameters":{"service":"EIR"}}

Output

Parameter	Type	Description
metadata	object	Response data
metadata.count	number	Response data
incidents	array	Unique identifier
incidents.id	string	Unique identifier
incidents.service	string	Unique identifier
incidents.title	string	Unique identifier
incidents.description	string	Unique identifier
incidents.status	string	Unique identifier
incidents.details	object	Unique identifier
incidents.details.caseType	string	Unique identifier
incidents.details.classification	string	Unique identifier
incidents.details.subClassification	string	Unique identifier
incidents.details.severity	object	Unique identifier
incidents.details.emailReportedBy	string	Unique identifier
incidents.details.emailReceivedDate	string	Unique identifier
incidents.details.submissionMethod	string	HTTP method to use
incidents.details.sender	string	Unique identifier
incidents.details.emailBody	string	Request body data
incidents.details.messageID	string	Unique identifier
incidents.details.urls	array	URL endpoint for the request
incidents.details.urls.url	string	URL endpoint for the request
incidents.details.urls.malicious	boolean	URL endpoint for the request
incidents.details.urls.maliciousDomain	boolean	URL endpoint for the request
incidents.details.attachments	array	Unique identifier
incidents.details.attachments.file_name	string	Unique identifier

Output Example

{"json_body":{"metadata":{"count":25},"incidents":[{},{}]}}

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT