---
title: Fortra Phishlabs Security
slug: connectors/fortra-phishlabs-security
docTags: 
createdAt: 2026-06-09T16:29:42.014Z
---

Fortra PhishLabs Security is a platform that provides threat intelligence and incident response services to combat phishing attacks.

Fortra Phishlabs Security is a comprehensive platform designed to automate phishing incident response and threat intelligence. This connector allows users to seamlessly integrate Fortra Phishlabs Security with Swimlane Turbine, enabling the retrieval of phishing incidents and detailed incident data. By leveraging this integration, security teams can enhance their incident response capabilities, streamline workflows, and improve threat detection and analysis within their security operations center (SOC).

## Prerequisites

Before you can use the Fortra PhishLabs Security connector for Turbine, you'll need access to the Fortra PhishLabs API. This requires the following:

- HTTP Basic authentication using the following parameters:
  - URL: The endpoint URL for accessing Fortra PhishLabs Security API.
  - Username: Your Fortra PhishLabs account username.
  - Password: Your Fortra PhishLabs account password.

## Additional Documentation

- [Fortra Phishlabs Security Connector Documentation](https://docs.swimlane.com/connectors/fortra-phishlabs-security)
- [Fortra Phishlabs Security API Documentation](https://csi.phishlabs.com/)
- [Fortra Phishlabs Security Authentication Guide](https://docs.swimlane.com/authentication-guides/fortra-phishlabs-security)

# Configurations

## HTTP Basic Authentication

Authenticates using username and password.

### Configuration Parameters

| **Parameter** | **Description**                    | **Type** | **Required** |
| ------------- | ---------------------------------- | -------- | ------------ |
| url           | A URL to the target host.          | string   | Required     |
| username      | Username                           | string   | Required     |
| password      | Password                           | string   | Required     |
| verify\_ssl   | Verify SSL certificate             | boolean  | Optional     |
| http\_proxy   | A proxy to route requests through. | string   | Optional     |

# Actions

## Get Incident

Returns a single incident from Fortra Phishlabs Security based on the given ID.

### Endpoint

- **URL:** `/idapi/v1/incidents/{{service}}/{{id}}`
- **Method:** `GET`

### Input

| **Argument Name**         | **Type** | **Required** | **Description**                        |
| ------------------------- | -------- | ------------ | -------------------------------------- |
| `path_parameters.service` | string   | Optional     | Parameters for the Get Incident action |
| `path_parameters.id`      | string   | Optional     | Parameters for the Get Incident action |

### Input Example

`{"path_parameters":{"service":"EIR","id":"INC0094172"}}`

### Output

| **Parameter**                           | **Type** | **Description**    |
| --------------------------------------- | -------- | ------------------ |
| `metadata`                              | object   | Response data      |
| `metadata.count`                        | number   | Response data      |
| `incidents`                             | array    | Unique identifier  |
| `incidents.id`                          | string   | Unique identifier  |
| `incidents.title`                       | string   | Unique identifier  |
| `incidents.description`                 | string   | Unique identifier  |
| `incidents.status`                      | string   | Unique identifier  |
| `incidents.created`                     | string   | Unique identifier  |
| `incidents.modified`                    | string   | Unique identifier  |
| `incidents.closed`                      | string   | Unique identifier  |
| `incidents.duration`                    | number   | Unique identifier  |
| `incidents.service`                     | string   | Unique identifier  |
| `incidents.details`                     | object   | Unique identifier  |
| `incidents.details.caseType`            | string   | Unique identifier  |
| `incidents.details.classification`      | string   | Unique identifier  |
| `incidents.details.subClassification`   | string   | Unique identifier  |
| `incidents.details.severity`            | string   | Unique identifier  |
| `incidents.details.emailReportedBy`     | string   | Unique identifier  |
| `incidents.details.emailReceivedDate`   | string   | Unique identifier  |
| `incidents.details.emailBody`           | string   | Request body data  |
| `incidents.details.messageID`           | string   | Unique identifier  |
| `incidents.details.submissionMethod`    | string   | HTTP method to use |
| `incidents.details.sender`              | string   | Unique identifier  |
| `incidents.details.furtherReviewReason` | string   | Unique identifier  |
| `incidents.details.offlineUponReview`   | boolean  | Unique identifier  |

### Output Example

`{"metadata":{"count":1},"incidents":[{"id":"INC123456","title":"Fwd: Phishing Email","description":"This is a malicious phishing email.","status":"closed","created":"2019-09-24T16:17:49Z","modified":"2019-09-24T16:40:35Z","closed":"2019-09-24T16:40:35Z","duration":1366,"service":"SEA","details":{}}]}`

## Get Incidents

Return a set of incidents filtered by specified query parameters in Fortra Phishlabs Security. Requires the 'service' path parameter.

### Endpoint

- **URL:** `/idapi/v1/incidents/{{service}}`
- **Method:** `GET`

### Input

| **Argument Name**           | **Type** | **Required** | **Description**                         |
| --------------------------- | -------- | ------------ | --------------------------------------- |
| `path_parameters.service`   | string   | Required     | The service to query. EIR               |
| `parameters.status`         | string   | Optional     | Parameters for the Get Incidents action |
| `parameters.created_after`  | string   | Optional     | Parameters for the Get Incidents action |
| `parameters.created_before` | string   | Optional     | Parameters for the Get Incidents action |
| `parameters.closed_after`   | string   | Optional     | Parameters for the Get Incidents action |
| `parameters.closed_before`  | string   | Optional     | Parameters for the Get Incidents action |
| `parameters.limit`          | number   | Optional     | Parameters for the Get Incidents action |
| `parameters.offset`         | number   | Optional     | Parameters for the Get Incidents action |
| `parameters.sort`           | string   | Optional     | Parameters for the Get Incidents action |
| `parameters.message_id`     | string   | Optional     | Parameters for the Get Incidents action |

### Input Example

`{"parameters":{"status":"closed","created_after":"2019-04-12T23:20:50Z","created_before":"2019-04-12T23:20:50Z","closed_after":"2019-04-12T23:20:50Z","closed_before":"2019-04-12T23:20:50Z","limit":25,"offset":0,"sort":"asc","message_id":"1234567890"},"path_parameters":{"service":"EIR"}}`

### Output

| **Parameter**                             | **Type** | **Description**              |
| ----------------------------------------- | -------- | ---------------------------- |
| `metadata`                                | object   | Response data                |
| `metadata.count`                          | number   | Response data                |
| `incidents`                               | array    | Unique identifier            |
| `incidents.id`                            | string   | Unique identifier            |
| `incidents.service`                       | string   | Unique identifier            |
| `incidents.title`                         | string   | Unique identifier            |
| `incidents.description`                   | string   | Unique identifier            |
| `incidents.status`                        | string   | Unique identifier            |
| `incidents.details`                       | object   | Unique identifier            |
| `incidents.details.caseType`              | string   | Unique identifier            |
| `incidents.details.classification`        | string   | Unique identifier            |
| `incidents.details.subClassification`     | string   | Unique identifier            |
| `incidents.details.severity`              | object   | Unique identifier            |
| `incidents.details.emailReportedBy`       | string   | Unique identifier            |
| `incidents.details.emailReceivedDate`     | string   | Unique identifier            |
| `incidents.details.submissionMethod`      | string   | HTTP method to use           |
| `incidents.details.sender`                | string   | Unique identifier            |
| `incidents.details.emailBody`             | string   | Request body data            |
| `incidents.details.messageID`             | string   | Unique identifier            |
| `incidents.details.urls`                  | array    | URL endpoint for the request |
| `incidents.details.urls.url`              | string   | URL endpoint for the request |
| `incidents.details.urls.malicious`        | boolean  | URL endpoint for the request |
| `incidents.details.urls.maliciousDomain`  | boolean  | URL endpoint for the request |
| `incidents.details.attachments`           | array    | Unique identifier            |
| `incidents.details.attachments.file_name` | string   | Unique identifier            |

### Output Example

`{"json_body":{"metadata":{"count":25},"incidents":[{},{}]}}`

# Response Headers

| **Header**   | **Description**                                       | **Example**                   |
| ------------ | ----------------------------------------------------- | ----------------------------- |
| Content-Type | The media type of the resource                        | application/json              |
| Date         | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |