Phishing

Details
Content
Dependencies
Version History

Phishing emails still hooking your end users? This Content Pack can drastically reduce the time your security team spends on phishing alerts.

Phishing emails are one of the most frequent, easily executable, and harmful security attacks that organizations – regardless of size – face today. High-volume, persistent phishing alerts are a time sink to manage, with incident response requiring coordination between multiple security products and communications with end users.

The Phishing content pack is the main pack for all phishing purposes. If you need to respond to phishing incidents based on user reports, this is the content pack for you. With this content pack, you can significantly reduce the time your security analysts spend on phishing alerts and standardize the way you manage phishing incidents.

This content pack includes playbooks that:

Facilitate analyst investigation by automating phishing alert response and custom phishing incident fields, views, and layouts.
Orchestrate across multiple products, including cross-referencing against your external threat databases.
On Cortex XSOAR, the pack also leverages machine learning to intelligently identify phishing campaigns targeting multiple users in the organization, linking them together and allowing full interaction and control over the campaign from within the incident layout.

What does this pack do?

Retrieves emails from user inboxes or ingests them using mail listeners.
Creates a phishing incident within Cortex XSOAR associated with the email.
Extracts and enriches all indicators from email attachments.
Analyzes files and provides reputation using your sandbox and threat intelligence integrations.
Generates a screenshot of the email and embedded links, and calculates reputation for all indicators involved.
Runs checks for SSL certificates of URLs, email address breach involvement, domain-squatting and email authenticity using SPF, DKIM and DMARC checks.
Identifies similar phishing incidents belonging to the same campaign, providing visibility and manual or automatic actions to respond to such incidents (supported on Cortex XSOAR only).
Calculates severity for the incident based on the provided initial severity, indicator reputations, email authenticity check, and critical assets if any are involved.
Remediates the incident by blocking malicious indicators, searching for and deleting malicious emails upon analyst approval.
Engages with the end user regarding the incident such as notifying them of receipt of email and providing further instructions if an email is found to be malicious.

As part of this pack, you will also get out-of-the-box phishing incident views, a full layout and automation scripts. All of these are easily customizable to suit the needs of your organization.

Additional Information

In order for the playbook to identify and create phishing campaign incidents, configure the Demisto Lock integration and, in addition to this pack, also install the Phishing Campaign content pack.

If you need to respond to phishing alerts ingested from email gateway integrations, see our documentation for the Phishing Alerts content pack. (This content pack requires the Phishing content pack).

If you're new to our Phishing Content Pack, check out our Setting Up a Phishing Incident in Cortex XSOAR tutorial.

This content pack includes playbooks that:

Facilitate analyst investigation by automating phishing alert response and custom phishing incident fields, views, and layouts.
Orchestrate across multiple products, including cross-referencing against your external threat databases.
On Cortex XSIAM, the pack also leverages machine learning to intelligently identify phishing campaigns targeting multiple users in the organization, linking them together and allowing full interaction and control over the campaign from within the incident layout.

What does this pack do?

Retrieves emails from user inboxes or ingests them using mail listeners.
Creates a phishing incident within Cortex XSIAM associated with the email.
Extracts and enriches all indicators from email attachments.
Analyzes files and provides reputation using your sandbox and threat intelligence integrations.
Generates a screenshot of the email and embedded links, and calculates reputation for all indicators involved.
Runs checks for SSL certificates of URLs, email address breach involvement, domain-squatting and email authenticity using SPF, DKIM and DMARC checks.
Identifies similar phishing incidents belonging to the same campaign, providing visibility and manual or automatic actions to respond to such incidents (supported on Cortex XSIAM only).
Calculates severity for the incident based on the provided initial severity, indicator reputations, email authenticity check, and critical assets if any are involved.
Remediates the incident by blocking malicious indicators, searching for and deleting malicious emails upon analyst approval.
Engages with the end user regarding the incident such as notifying them of receipt of email and providing further instructions if an email is found to be malicious.

As part of this pack, you will also get out-of-the-box phishing incident views, a full layout and automation scripts. All of these are easily customizable to suit the needs of your organization.

Additional Information

If you're new to our Phishing Content Pack, check out our Setting Up a Phishing Incident in Cortex XSIAM tutorial.

Automations

Name	Description
LinkToPhishingCampaign	Links a Phishing incident to its related Phishing Campaign incident.
FindDuplicateEmailIncidents	Can be used to find duplicate emails for incidents of type phishing, including malicious, spam, and legitimate emails.
PhishingDedupPreprocessingRule	Deprecated. Use the FindDuplicateEmailIncidents script instead.
GetBrandDeleteReportedEmail	Gets all the enabled instances of integrations that can be used by the DeleteReportedEmail script, in the output format of a single select field.
CheckEmailAuthenticity	Checks the authenticity of an email based on the email's SPF, DMARC, and DKIM.
DeleteReportedEmail	Use this script to delete a reported phishing email from the mailbox it was reported to

Incident Fields

Name	Description
Email Delete Reason
Email HTML Image
Email Labels
Email In Reply To	The mail to whom you reply
Email From
Email Sender IP
Malicious URL Viewed	Whether a malicious url was viewed by the user, for example in a scenario where a user clicked on a malicious url inside an email and was able to view a malicious site. The value will be True also in a scenario where the URL was blocked initially, but the user decided to proceed and view the URL anyway.
Malicious URL Clicked	Whether a URL with a verdict of "Malicious" was clicked.
Reported Email To	The email address of the recipient in a reported (forwarded or attached) phishing email.
Phishing Reporter Email Headers
Clicked URLs	List of URLs which were clicked inside an email.
Email Delete From Brand
Email Reply To
Email Latest Message
Email Headers	A list of all of the email headers.
Attachment Name
Email Keywords
Reported Email Origin	The origin of the reported (phishing) email. "Attached" - The email was attached originally, "Retrieved" - The email was retrieved during the playbook run", "None" - The email wasn't attached or retrieved.
Phishing BCL Score	Bulk Complaint Level score (Microsoft headers)
Email Authenticity Check	Indicates the authenticity of the email. This check is done using the CheckEmailAuthenticity script.
Attachment ID
Phishing Sub-type	Phishing incident sub-type. Can be "Spear Phishing", "Whaling", "Credential Harvesting", "Malware", "Scam", or "Automatic".
Attachment Hash
Attachment Extension
Email Keywords Found
Email To Count
Email Body HTML
Reported Email From	The email address of the sender in a reported (forwarded or attached) phishing email.
Email Message ID
Reported Email Subject	The subject of a reported (forwarded or attached) phishing email.
Email CC
Email Delete Type
Email Internal Message ID
Email HTML
Total Malicious URLs Clicks	The total number of malicious URLs clicks. In a phishing incident, it will represent the total clicks in all of the emails which were found containing the malicious URLs.
Attachment Count
Email Return Path
Email Size
Email Body
DBotPredictionProbability	The confidence level, presented as a value between 0 and 1, of the predicted phishing sub-type verdict by the machine-learning model.
DBotTextSuggestionHighlighted	Indicates the words in the text that contributed to the decision made by the machine-learning model.
Attachment type
Email Classification	Classification of the email. Can be "Legitimate", "Spam", or "Malicious".
Phishing SCL Score	Spam confidence level score (Microsoft headers)
DBotPrediction	The phishing sub-type verdict that was predicted by the machine-learning model.
Email Body Format
Reported Email CC
Attachment size
Email Recipients Count	The number of the recipients in the "To" field of an email.
Email Subject
Email Received
Email Client Name
Email BCC
Phishing PCL Score	Phishing Confidence Level score (Microsoft headers)
Reported Email Message ID	The message ID of the reported email in a reported (forwarded or attached) phishing email. For example, if Email A is a phishing email, and Email A is attached to Email B in the phishing report, the value of this field is the message ID of Email A.
Email Delete Result
Email Source
Email To
Email URL Clicked

Incident Types

Name	Description
Phishing

Layouts

Name	Description
Phishing Incident
Phishing Incident v3

Playbooks

Name	Description
Get Original Email - Gmail	Deprecated. Use Get_Original_Email_-_Gmail_v2 instead. Use this playbook to retrieve the original email in the thread, including headers and attahcments, when the reporting user forwarded the original email not as an attachment. You must have the necessary permissions in your Gmail service to execute global search: Google Apps Domain-Wide Delegation of Authority
Calculate Severity By Email Authenticity	Calculates a severity according to the verdict coming from the CheckEmailAuthenticity script.
Process Email - Core v2	This playbook adds email details to the relevant context entities and handles the case where original emails are attached.
Phishing - Handle Microsoft 365 Defender Results	This playbook is used to handle the results from the "Microsoft 365 Defender - Threat Hunting Generic" playbook inside a phishing incident. It performs the following actions: 1) Set the relevant incident fields based on the results, such as "Clicked URLs", "Malicious URL Viewed", and "Malicious URL Clicked". 2) In case the relevant playbook inputs were configured, it will create new incidents for each email returned in the results of the "Microsoft 365 Defender - Threat Hunting Generic" playbook. First, it will try to retrieve the original emails' files and then it will create an incident for each retrieved email. 3) Link the newly created incidents to the main originating incident. Note that this playbook should only be used inside a phishing incident and not as a main playbook.
Get Original Email - EWS	This playbook retrieves the original email in a thread, including headers and attachments, when the reporting user forwarded the original email not as an attachment. Note:\ You must have the necessary eDiscovery permissions in the EWS integration to execute a global search.
Phishing - Get Original Email Loop	When the "Get Original Email - Generic v2" playbook is looped, there is no actual way to distinguish which retrieved file is related to which Message-ID. In order to solve this issue, this playbook will be looped instead and will output the "FileAssociation" key with the File-MessageID association.
Phishing - Generic v3	This playbook investigates and remediates a potential phishing incident. It engages with the user who triggered the incident while investigating the incident itself. Note: Final remediation tasks are manual by default. can be managed by "SearchAndDelete" and "BlockIndicators" inputs. Do not rerun this playbook inside a phishing incident since it can produce an unexpected result. Create a new incident instead if needed.
Phishing - Indicators Hunting	Hunt indicators related to phishing with available integrations and then handle the results. Handling the results will include setting relevant incident fields which will be displayed in the layout and optionally, opening new incidents according to the findings. Current integration in this playbook: Microsoft 365 Defender (using "Advanced Hunting") Note that this playbook should be used as a sub-playbook inside a phishing incident and not as a main playbook.
Phishing - Core	Deprecated. Use Phishing - Core v2 instead.
Process Email - Core	Deprecated. Use Process Email - Core v2 instead.
Process Microsoft's Anti-Spam Headers	This playbook stores the SCL, BCL, and PCL scores if they exist to the associated incident fields (Phishing SCL Score, Phishing PCL Score, and Phishing BCL Score). It also does the following: 1) Sets the email classification to "spam" if the SCL score is equal to or greater than 5. 2) Sets the incident severity according to the playbook inputs (default is: PCL/BCL - Medium, SCL - Low). The severity of the incident is set only when one (or more) of the following occurs: PCL (Phishing Confidence Level) For a score between and including 4-8: The message content is likely to be phishing. BCL (Bulk Complaint Level) For a score between and including 4-7: The message is from a bulk sender that generates a mixed number of complaints. For a score between and including 8-9: The message is from a bulk sender that generates a high number of complaints. SCL (Spam Confidence Level) For a score between and including 5-6: Spam filtering marks the message as spam. For a score of 9: Spam filtering marks the message as high confidence spam. See anti-spam stamps.
Phishing - Machine Learning Analysis	Runs various machine-learning based checks on phishing emails and URLs, in an attempt to predict whether they are phishing or benign. This playbook is available only on Cortex XSOAR.
Phishing - Core v2	This playbook provides a basic response to phishing incidents, including: Calculating reputation for all indicators Extracting indicators from email attachments Calculating severity for the incident based on indicator reputation Updating the reporting user about investigation status Enabling manual incident remediation This updated playbook uses: 1) Incident fields instead of labels 2) The "Process Email - Core v2" playbook
Phishing - Search Related Incidents (Defender 365)	This playbook should only be used as a sub-playbook inside the "Phishing - Handle Microsoft 365 Defender Results" playbook. It searches through existing Cortex XSOAR incidents based on retrieved email message IDs and returns data only for emails that are not found in existing incidents.
Phishing - Create New Incident	This playbook take arguments which will be used to create a new phishing incident. It is needed for scenarios such as creating several incidents based on values stored in the context. In such scenarios, the playbook can be looped.
Process Email - Generic	Deprecated. Use Process Email - Generic v2 instead.
Phishing Investigation - Generic v2	Deprecated. Use Phishing - Generic v3 instead.
Process Email - Generic v2	This playbook adds email details to the relevant context entities and handles original email attachments. The v2 playbook enables parsing email artifacts more efficiently, including: Using incident fields and not incident labels. Providing separate paths to "Phishing Alerts". Using the new "Get Original Email - Generic v2" playbook to retrieve original emails as EML files from the following integrations: EWS v2 Microsoft Graph Mail integration Gmail FireEye EX and FireEye CM Proofpoint Protection Server Agari Phishing Defense (EWS v2, MSGraph Mail, Gmail) Mimecast.
Spear Phishing Investigation	The "Spear Phishing Investigation" playbook is designed to detect patterns that indicates a spear phishing attempt by the attacker.
Phishing Playbook - Manual	Master playbook for phishing incidents. This playbook is a manual playbook.
Entity Enrichment - Phishing v2	Enrich entities using one or more integrations
Get Original Email - Generic v2	This v2 playbook is used inside the phishing flow. The inputs in this version do not use labels and also allow the user to supply an email brand. Note: You must have the necessary permissions in your email service to execute a global search. To retrieve the email files directly from the email service providers, use one of the provided inputs (Agari Phishing Defense customers should also use the following): EWS: eDiscovery Gmail: Google Apps Domain-Wide Delegation of Authority MSGraph: As described in the message-get API and the user-list-messages API EmailSecurityGateway retrieves EML files from: FireEye EX FireEye CM Proofpoint Protection Server Mimecast

Wizards

Name	Description
Phishing	Welcome to the Deployment Wizard! These steps will guide you through configuring your content pack so you'll have a working use case when the wizard finishes. Make sure to follow the steps in order, you can always continue the wizard where you left off. Learn more about this pack’s deployment in the "Cortex XSOAR Administrator Guide" -> "Set up Your Use Case with the Deployment Wizard".

Automations

Name	Description
GetBrandDeleteReportedEmail	Gets all the enabled instances of integrations that can be used by the DeleteReportedEmail script, in the output format of a single select field.
CheckEmailAuthenticity	Checks the authenticity of an email based on the email's SPF, DMARC, and DKIM.
FindDuplicateEmailIncidents	Can be used to find duplicate emails for incidents of type phishing, including malicious, spam, and legitimate emails.
FindDuplicateEmailAlerts	Can be used to find duplicate emails for alerts of type phishing, including malicious, spam, and legitimate emails.
PhishingDedupPreprocessingRule	Deprecated. Use the FindDuplicateEmailIncidents script instead.
LinkToPhishingCampaign	Links a Phishing incident to its related Phishing Campaign incident.
DeleteReportedEmail	Use this script to delete a reported phishing email from the mailbox it was reported to

Incident Fields

Name	Description
Email In Reply To	The mail to whom you reply
Email Headers	A list of all of the email headers.
Email Message ID
Email Delete From Brand
Reported Email Message ID	The message ID of the reported email in a reported (forwarded or attached) phishing email. For example, if Email A is a phishing email, and Email A is attached to Email B in the phishing report, the value of this field is the message ID of Email A.
Reported Email Origin	The origin of the reported (phishing) email. "Attached" - The email was attached originally, "Retrieved" - The email was retrieved during the playbook run", "None" - The email wasn't attached or retrieved.
Total Malicious URLs Clicks	The total number of malicious URLs clicks. In a phishing incident, it will represent the total clicks in all of the emails which were found containing the malicious URLs.
Reported Email To	The email address of the recipient in a reported (forwarded or attached) phishing email.
Email Authenticity Check	Indicates the authenticity of the email. This check is done using the CheckEmailAuthenticity script.
Email Client Name
Email Recipients Count	The number of the recipients in the "To" field of an email.
Attachment Count
DBotPredictionProbability	The confidence level, presented as a value between 0 and 1, of the predicted phishing sub-type verdict by the machine-learning model.
Email URL Clicked
Email Classification	Classification of the email. Can be "Legitimate", "Spam", or "Malicious".
Email To Count
Phishing Sub-type	Phishing incident sub-type. Can be "Spear Phishing", "Whaling", "Credential Harvesting", "Malware", "Scam", or "Automatic".
Email Delete Type
Email Source
Malicious URL Clicked	Whether a URL with a verdict of "Malicious" was clicked.
Email Delete Result
DBotTextSuggestionHighlighted	Indicates the words in the text that contributed to the decision made by the machine-learning model.
Phishing PCL Score	Phishing Confidence Level score (Microsoft headers)
Email Body HTML
Email Received
Email BCC
Attachment Name
Attachment ID
Email Keywords
Attachment Hash
Email HTML
Email Reply To
Email Labels
Attachment Extension
Email HTML Image
Email Internal Message ID
Malicious URL Viewed	Whether a malicious url was viewed by the user, for example in a scenario where a user clicked on a malicious url inside an email and was able to view a malicious site. The value will be True also in a scenario where the URL was blocked initially, but the user decided to proceed and view the URL anyway.
Clicked URLs	List of URLs which were clicked inside an email.
Email Body
Reported Email From	The email address of the sender in a reported (forwarded or attached) phishing email.
Email Body Format
Email Size
Phishing SCL Score	Spam confidence level score (Microsoft headers)
Phishing BCL Score	Bulk Complaint Level score (Microsoft headers)
Email Return Path
Email CC
Email Delete Reason
Phishing Reporter Email Headers
Attachment type
Attachment size
Email Latest Message
DBotPrediction	The phishing sub-type verdict that was predicted by the machine-learning model.
Reported Email CC
Email Keywords Found
Reported Email Subject	The subject of a reported (forwarded or attached) phishing email.
Email Sender IP

Incident Types

Name	Description
Phishing

Layoutrule

Name	Description
Phishing Layout Rule	Default display for phishing alerts.

Layouts

Name	Description
Phishing Layout	The default layout for phishing incidents.

Playbooks

Name	Description
Process Email - Core	Deprecated. Use Process Email - Core v2 instead.
Phishing - Create New Alert	This playbook take arguments which will be used to create a new phishing alert. It is needed for scenarios such as creating several alerts based on values stored in the context. In such scenarios, the playbook can be looped.
Calculate Severity By Email Authenticity	Calculates a severity according to the verdict coming from the CheckEmailAuthenticity script.
Phishing - Core	Deprecated. Use Phishing - Core v2 instead.
Process Email - Generic v2	This playbook adds email details to the relevant context entities and handles original email attachments. The v2 playbook enables parsing email artifacts more efficiently, including: Using alert fields and not alert labels. Providing separate paths to "Phishing Alerts". Using the new "Get Original Email - Generic v2" playbook to retrieve original emails as EML files from the following integrations: EWS v2 Microsoft Graph Mail integration Gmail FireEye EX and FireEye CM Proofpoint Protection Server Agari Phishing Defense (EWS v2, MSGraph Mail, Gmail) Mimecast.
Phishing - Get Original Email Loop	When the "Get Original Email - Generic v2" playbook is looped, there is no actual way to distinguish which retrieved file is related to which Message-ID. In order to solve this issue, this playbook will be looped instead and will output the "FileAssociation" key with the File-MessageID association.
Entity Enrichment - Phishing v2	Enrich entities using one or more integrations
Get Original Email - Generic v2	This v2 playbook is used inside the phishing flow. The inputs in this version do not use labels and also allow the user to supply an email brand. Note: You must have the necessary permissions in your email service to execute a global search. To retrieve the email files directly from the email service providers, use one of the provided inputs (Agari Phishing Defense customers should also use the following): EWS: eDiscovery Gmail: Google Apps Domain-Wide Delegation of Authority MSGraph: As described in the message-get API and the user-list-messages API EmailSecurityGateway retrieves EML files from: FireEye EX FireEye CM Proofpoint Protection Server Mimecast
Phishing - Generic v3	This playbook investigates and remediates a potential phishing alert. It engages with the user who triggered the alert while investigating the alert itself. Note: Final remediation tasks are manual by default. can be managed by "SearchAndDelete" and "BlockIndicators" inputs. Do not rerun this playbook inside a phishing alert since it can produce an unexpected result. Create a new alert instead if needed.
Phishing - Handle Microsoft 365 Defender Results	This playbook is used to handle the results from the "Microsoft 365 Defender - Threat Hunting Generic" playbook inside a phishing alert. It performs the following actions: 1) Set the relevant alert fields based on the results, such as "Clicked URLs", "Malicious URL Viewed", and "Malicious URL Clicked". 2) In case the relevant playbook inputs were configured, it will create new alerts for each email returned in the results of the "Microsoft 365 Defender - Threat Hunting Generic" playbook. First, it will try to retrieve the original emails' files and then it will create an alert for each retrieved email. 3) Link the newly created alerts to the main originating alert. Note that this playbook should only be used inside a phishing alert and not as a main playbook.
Phishing Investigation - Generic v2	Deprecated. Use Phishing - Generic v3 instead.
Phishing - Core v2	This playbook provides a basic response to phishing alerts, including: Calculating reputation for all indicators Extracting indicators from email attachments Calculating severity for the alert based on indicator reputation Updating the reporting user about investigation status Enabling manual alert remediation This updated playbook uses: 1) Alert fields instead of labels 2) The "Process Email - Core v2" playbook
Phishing Playbook - Manual	Master playbook for phishing alerts. This playbook is a manual playbook.
Process Microsoft's Anti-Spam Headers	This playbook stores the SCL, BCL, and PCL scores if they exist to the associated alert fields (Phishing SCL Score, Phishing PCL Score, and Phishing BCL Score). It also does the following: 1) Sets the email classification to "spam" if the SCL score is equal to or greater than 5. 2) Sets the alert severity according to the playbook inputs (default is: PCL/BCL - Medium, SCL - Low). The severity of the alert is set only when one (or more) of the following occurs: PCL (Phishing Confidence Level) For a score between and including 4-8: The message content is likely to be phishing. BCL (Bulk Complaint Level) For a score between and including 4-7: The message is from a bulk sender that generates a mixed number of complaints. For a score between and including 8-9: The message is from a bulk sender that generates a high number of complaints. SCL (Spam Confidence Level) For a score between and including 5-6: Spam filtering marks the message as spam. For a score of 9: Spam filtering marks the message as high confidence spam. See anti-spam stamps.
Get Original Email - Gmail	Deprecated. Use Get_Original_Email_-_Gmail_v2 instead. Use this playbook to retrieve the original email in the thread, including headers and attahcments, when the reporting user forwarded the original email not as an attachment. You must have the necessary permissions in your Gmail service to execute global search: Google Apps Domain-Wide Delegation of Authority
Phishing - Indicators Hunting	Hunt indicators related to phishing with available integrations and then handle the results. Handling the results will include setting relevant alert fields which will be displayed in the layout and optionally, opening new alerts according to the findings. Current integration in this playbook: Microsoft 365 Defender (using "Advanced Hunting") Note that this playbook should be used as a sub-playbook inside a phishing alert and not as a main playbook.
Process Email - Core v2	This playbook adds email details to the relevant context entities and handles the case where original emails are attached.
Get Original Email - EWS	This playbook retrieves the original email in a thread, including headers and attachments, when the reporting user forwarded the original email not as an attachment. Note:\ You must have the necessary eDiscovery permissions in the EWS integration to execute a global search.
Phishing - Search Related Alerts (Defender 365)	This playbook should only be used as a sub-playbook inside the "Phishing - Handle Microsoft 365 Defender Results" playbook. It searches through existing Cortex XSIAM alerts based on retrieved email message IDs and returns data only for emails that are not found in existing alerts.
Process Email - Generic	Deprecated. Use Process Email - Generic v2 instead.
Spear Phishing Investigation	The "Spear Phishing Investigation" playbook is designed to detect patterns that indicates a spear phishing attempt by the attacker.

Trigger

Name	Description
Phishing Playbook Trigger	This trigger is responsible for running the Phishing - Generic v3 playbook on Phishing alerts.

Required Content Packs (5)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Common Types	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

Optional Content Packs (51)

Pack Name	Pack By
Active Directory Query	By: Cortex XSOAR
Agari Phishing Defense	By: Agari
AutoFocus by Palo Alto Networks	By: Cortex XSOAR
Phishing Campaign	By: Cortex XSOAR
Carbon Black Enterprise Response	By: Cortex XSOAR
Cortex XDR by Palo Alto Networks	By: Cortex XSOAR
CrowdStrike Falcon Sandbox	By: Cortex XSOAR
CrowdStrike Falcon Intelligence Sandbox	By: Cortex XSOAR
Cuckoo Sandbox	By: Cortex XSOAR
Cybereason	By: Cybereason
Cylance Protect	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
Email Communication	By: Cortex XSOAR
FireEye Email Security (EX)	By: Cortex XSOAR
FireEye Network Security (NX)	By: Cortex XSOAR
FortiGate	By: Cortex XSOAR
FortiSandbox	By: Lior Sabri
Gmail	By: Cortex XSOAR
Gmail Single User	By: Cortex XSOAR
IsItPhishing	By: Cortex XSOAR
Joe Security	By: Cortex XSOAR
Lastline	By: Cortex XSOAR
Machine Learning	By: Cortex XSOAR
Mail Sender (New)	By: Cortex XSOAR
McAfee Advanced Threat Defense	By: Cortex XSOAR
Microsoft 365 Defender	By: Cortex XSOAR
Microsoft Exchange On-Premise	By: Cortex XSOAR
Microsoft Exchange Online	By: Cortex XSOAR
Microsoft Graph Mail	By: Cortex XSOAR
Mimecast	By: Cortex XSOAR
Oletools	By: Cortex XSOAR
PAN-OS by Palo Alto Networks	By: Cortex XSOAR
WildFire by Palo Alto Networks	By: Cortex XSOAR
PhishTank	By: Cortex XSOAR
PhishingAlerts	By: Cortex XSOAR
Phishing URL	By: Cortex XSOAR
Polygon	By: Group-IB
Proofpoint Protection Server	By: Cortex XSOAR
Proofpoint Threat Response	By: Cortex XSOAR
Pwned	By: Cortex XSOAR
Symantec Data Loss Prevention	By: Cortex XSOAR
Symantec Messaging Gateway	By: Cortex XSOAR
TIM - Indicator Auto-Processing	By: Cortex XSOAR
Cisco Secure Malware Analytics	By: Cortex XSOAR
Trend Micro Apex One	By: Cortex XSOAR
Trend Micro Cloud App Security	By: Cortex XSOAR
VMRay Analyzer	By: VMRay
VirusTotal	By: VirusTotal
Zscaler Internet Access	By: Cortex XSOAR
FireEye (AX Series)	By: Cortex XSOAR
Rasterize	By: Cortex XSOAR

All level dependencies (5)

Pack Name	Pack By
Filters And Transformers	By: Cortex XSOAR
Common Types	By: Cortex XSOAR
Base	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR

3.6.27 - 1647729 (November 14, 2024)

Scripts

GetBrandDeleteReportedEmail

Updated the Docker image to: demisto/python3:3.11.10.115186.

CheckEmailAuthenticity

Updated the Docker image to: demisto/python3:3.11.10.115186.

DeleteReportedEmail

Updated the Docker image to: demisto/python3:3.11.10.115186.

Related pull requests:
- 37147
- 37137
- 37136
- 37140
- 37138
- 37139

Download

3.6.26 - 1644440 (November 13, 2024)

Scripts

FindDuplicateEmailIncidents

Fixed an issue were the script's performance was decreased due to a bug in a python library.
Updated the Docker image to: demisto/sklearn:1.0.0.115728.

Related pull requests:
- 37180

Download

3.6.25 - 1621428 (November 11, 2024)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 37155

Download

3.6.24 - 1602991 (November 6, 2024)

Scripts

LinkToPhishingCampaign

Updated the Docker image to: demisto/python3:3.11.10.113941.

DeleteReportedEmail

Updated the Docker image to: demisto/python3:3.11.10.113941.

CheckEmailAuthenticity

Updated the Docker image to: demisto/python3:3.11.10.113941.

GetBrandDeleteReportedEmail

Updated the Docker image to: demisto/python3:3.11.10.113941.

Related pull requests:
- 37006
- 36995
- 36994
- 36998
- 36993
- 36992
- 36997

Download

3.6.23 - 1370357 (September 11, 2024)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 36021

Download

3.6.22 - 1298005 (August 22, 2024)

Playbooks

Process Email - Generic v2

Fixed an issue where playbook failed due to multiple .eml attachments.

Related pull requests:
- 35976

Download

3.6.21 - 1241052 (August 4, 2024)

Scripts

FindDuplicateEmailIncidents

Improved implementation to prevent the script from running in a new docker container for each call.
Updated the Docker image to: demisto/sklearn:1.0.0.105679.

Related pull requests:
- 35480

Download

3.6.20 - 1200812 (July 22, 2024)

Scripts

FindDuplicateEmailIncidents

Updated the Docker image to: demisto/sklearn:1.0.0.104162.

Related pull requests:
- 34642

Download

3.6.19 - R1063016 (June 2, 2024)

Scripts

FindDuplicateEmailIncidents

Fixed an issue where the script timed out due to too many calls to the FormatURL script.
Updated the Docker image to: demisto/sklearn:1.0.0.92988.

Related pull requests:
- 34111

Download

3.6.18 - 951066 (April 11, 2024)

Layouts

Phishing Incident v3
Added a warning about the possible presence of malicious links in the Email Body section in the layout.

Related pull requests:
- 33808

Download

3.6.17 - 921333 (March 28, 2024)

Playbooks

Phishing - Generic v3

Added the NonMaliciousEmailReview input to the input section "Incident Management".

Related pull requests:
- 33596

Download

3.6.16 - 913451 (March 25, 2024)

Playbooks

Phishing - Generic v3

Updated the documentation to state what platforms support the machine-learning content used in the playbook.
The playbook will now skip the Phishing - Machine Learning Analysis playbook when it is unavailable.

Phishing - Machine Learning Analysis

Updated the documentation to state what platforms support the machine-learning content used in the playbook.
The playbook is now unavailable in XSIAM due to the automations used in it.

Related pull requests:
- 33414

Download

3.6.15 - 907391 (March 21, 2024)

Playbooks

Phishing - Generic v3

Fixed an issue with the tasks' appearances.

Related pull requests:
- 33461

Download

3.6.14 - 904622 (March 20, 2024)

Playbooks

Phishing - Generic v3

Added a new input to set automatic closure if the email was defined as non-malicious. The default setting will require the analyst to review the incident.

Scripts

LinkToPhishingCampaign

Updated the Docker image to: demisto/python3:3.10.13.89009.

Related pull requests:
- 33414
- 33293

Download

3.6.12 - 897231 (March 18, 2024)

Playbooks

Phishing - Generic v3

Updated the input 'InternalRange' to use the 'PrivateIPs' list.

Entity Enrichment - Phishing v2

Updated the input 'InternalRange' to use the 'PrivateIPs' list.

Related pull requests:
- 33201

Download

3.6.11 - 882064 (March 11, 2024)

Layouts

Phishing Incident v3
Added the "Additional Email Addresses" field to the incident layout.

Related pull requests:
- 33129

Download

3.6.10 - 876540 (March 7, 2024)

Playbooks

Process Email - Generic v2

Added the ability to extract text from QR code images.

Related pull requests:
- 33235

Download

3.6.9 - 865088 (March 3, 2024)

Scripts

DeleteReportedEmail

Updated the Docker image to: demisto/python3:3.10.13.87159.

Related pull requests:
- 33020

Download

3.6.8 - R828628 (February 14, 2024)

Playbooks

Process Email - Generic v2

Fixed an issue where the playbook would return an error when trying to upload multiple entries to an incident.

Related pull requests:
- 32412

Download

3.6.7 - 783533 (January 24, 2024)

Playbooks

Phishing - Generic v3

Changed playbook inputs categories.

Related pull requests:
- 31928

Download

3.6.6 - 776649 (January 22, 2024)

Playbooks

Phishing - Machine Learning Analysis

Added the Unique transformer for URLs in Phishing URL prediction to ensure only unique URLs are analyzed in the machine-learning sub-playbook.

Phishing - Generic v3

Added the Unique transformer to the URLs sent for detonation.
Added the Unique transformer to ensure that only unique relationships are retrieved for the IP, URL and Domain indicators.

Phishing - Indicators Hunting

Added the Unique transformer to the DBotScore indicators, which should improve performance when multiple enrichers are enabled.

Related pull requests:
- 32282

Download

3.6.5 - R764361 (January 15, 2024)

Scripts

FindDuplicateEmailIncidents

Updated the Docker image to: demisto/sklearn:1.0.0.84778.

Related pull requests:
- 32181

Download

3.6.4 - 729445 (January 1, 2024)

Playbooks

Phishing - Generic v3

Updated the playbook input sections field name according to the schema.

Related pull requests:
- 31871
- 31834
- 31778

Download

3.6.3 - 7164950 (December 14, 2023)

Scripts

FindDuplicateEmailIncidents

Updated the Docker image to: demisto/sklearn:1.0.0.83494.

Related pull requests:
- 31458

Download

3.6.2 - 7022868 (November 29, 2023)

Scripts

FindDuplicateEmailIncidents

Fixed an issue where a permissions denied error was returned when the script tried to write to a temporary cache.
Added support for the debug-mode flag.
Updated the Docker image to: demisto/sklearn:1.0.0.80783.

Related pull requests:
- 30577

Download

3.6.1 - 6944614 (November 20, 2023)

Playbooks

Phishing - Generic v3

Added playbook input sections to organize the inputs into related categories, which simplifies the playbook input visibility. Supported in Cortex XSOAR 8.5 and Cortex XSIAM 2.0 and above.

Related pull requests:
- 30887

Download

3.6.0 - 6868594 (November 12, 2023)

Playbooks

Process Email - Generic v2

Fixed an issue where email attachments were not uploaded to the layout in Cortex XSIAM. The playbook now uses the newer Core REST API integration to do that.

Related pull requests:
- 30590

Download

3.5.30 - 6738192 (October 29, 2023)

Wizards

Updated the deprecated SecurityAndCompliance integration to it's newer version (SecurityAndComplianceV2).

Related pull requests:
- 30494

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Cortex
Created	July 26, 2020
Last Release	November 14, 2024

Phishing

WORKS WITH THE FOLLOWING INTEGRATIONS:

Palo Alto Networks Cortex XDR - Investigation and Response

EWS Extension Online Powershell v2 (Deprecated)

O365 - Security And Compliance - Content Search

O365 - Security And Compliance - Content Search (Deprecated)

O365 - Security And Compliance - Content Search v2

O365 Defender SafeLinks - Single User (Deprecated)

Cisco Secure Malware Analytics (Threat Grid) v2

CrowdStrike Falcon Sandbox v2 (Hybrid-Analysis)

Proofpoint Protection Server (Deprecated)

Symantec Data Loss Prevention (Deprecated)

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.