Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The Fortra Phishlabs integration enables ThreatQ users to ingest Email Incident Response (EIR) and Digital Risk Protection (DRP) incidents, along with associated indicators and impacted identities, directly into the ThreatQ platform. By incorporating PhishLabs intelligence into ThreatQ, security teams gain enhanced visibility into phishing, business email compromise (BEC), brand impersonation, and other external threats, improving threat analysis, investigation, and response capabilities.

The integration provides the following feeds:

• Phishlabs - ingests incidents (EIR & Other Services) and associated indicators from PhishLabs into ThreatQ.
• Phishlabs DRP Incidents - ingests Digital Risk Protection (DRP) incidents and impacted employee identities from PhishLabs into ThreatQ.

The integration ingests the following system objects:

• Events
• Files
• Identities
• Incidents
• Indicators

Prerequisites

The following is required to run the integration:

• A PhishLabs license with appropriate permissions to access EIR and DRP APIs.
• Your PhishLabs Email Address and API Key (PhishLabs feed)
• Your PhishLabs Client ID and Secret (DRP Incidents feed).

Installation

Perform the following steps to install the integration:

The same steps can be used to upgrade the integration to a new version.

1. Log into https://marketplace.threatq.com/.
2. Locate and download the integration file.
3. Navigate to the integrations management page on your ThreatQ instance.
4. Click on the Add New Integration button.
5. Upload the integration file using one of the following methods:
   • Drag and drop the file into the dialog box
   • Select Click to Browse to locate the integration file on your local machine
6. Select the individual feeds to install, when prompted, and click Install.

   ThreatQ will inform you if the feed already exists on the platform and will require user confirmation before proceeding. ThreatQ will also inform you if the new version of the feed contains changes to the user configuration. The new user configurations will overwrite the existing ones for the feed and will require user confirmation before proceeding.

The feed(s) will be added to the integrations page. You will still need to configure and then enable the feed(s).

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Commercial option from the Category dropdown (optional).

   If you are installing the integration for the first time, it will be located under the Disabled tab.

3. Click on the integration entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   Phishlabs Parameters

   Parameter	Description
   Email Address	Enter your Phishlabs account email address.
   API Key	Enter your Phishlabs account API key.
   Service	Enter the service name to use to filter incidents.  The default setting is EIR.

   Phishlabs DRP Incidents Parameters

   Parameter	Description
   Client ID	Enter your Phishlabs Client ID.
   Client Secret	Enter your Phishlabs Client Secret
   Brand Names	Optional - enter a line-separated list of brand names to filter the incidents.
   Severity Levels	Select the severity levels to ingest. Options include: Low (Default) Medium (Default) High (Default)
   Statuses	Select the incident statuses to ingest. Options include: New (Default) Closed (Default) Requires Input (Default) Mitigation (Default) Monitoring (Default) Closed, No Action (Default) Pending (Default) Requires Approval (Default) Input Provided (Default) Persistent Threat (Default) Duplicate (Default)
   Incident Types	Select the incident types to ingest. Options include: Dark Web (Default) Social Media (Default)
   Dark Web Threat Type	Select the threat types to ingest for Dark Web incidents. Options include: Account Credentials For Sale (Default) Consumer Goods For Sale (Default) Credit/Debit Card Data (Default) Cyber Risk (Default) Deposit Fraud (Default) Executive Mention In Post (Default) Fraud Tools (Default) Personal Identifiable Information (Default) Physical Threat To Executive (Default) Source Code (Default) Third Party Corporate Email Leaks (Default) Stealer Malware Credentials (Default) Botnet Credentials (Default) Remote Access Trojan Credentials (Default)
   Social Media Threat Types	Select the threat types to ingest for Social Media incidents. Options include: BIN/IIN Details (Default) Brand Mention On Page (Default) Cyber Risk (Default) Deposit Fraud (Default) Executive Mention On Page (Default) Generic Physical Threat (Default) Impersonation Of Employee (Default) Impersonation Of Executive (Default) Impersonation Of Brand (Default) Leaked Credentials (Default) Leaked Documents (Default) Legal Threat (Default) Negative Comment Toward Employee (Default) Negative Comment Toward Organization (Default) News PR Stock Commentary (Default) Personal Identifiable Information (Default) Phishing (Default) Physical Threat To Employee (Default) Physical Threat To Event (Default) Physical Threat To Executive (Default) Physical Threat To Location (Default) Protest Petition Boycotts (Default) Source Code (Default) Event (Default) Cryptocurrency Scam (Default) Counterfeit (Default)
   Ingest Images as Related Files	Enable this option to ingest image files collected by PhishLabs as related File objects within ThreatQ. The ingested files will be associated with the corresponding Event object, providing additional context and supporting evidence for analysis and investigation.
   Ingest Files as	Select how files containing compromised/leaked credentials should be ingested. Options include: Related File Objects (Default) Part of the Event Description (CSV & TXT Only)

5. Review any additional settings, make any changes if needed, and click on Save.
6. Click on the toggle switch, located above the Additional Information section, to enable it.

ThreatQ Mapping

{
    "metadata": {
        "count": 1
    },
    "incidents": [
        {
            "id": "INC0763488",
            "service": "EIR",
            "title": "Fwd: CONFIRMATION OF YOUR OVERDUE PAYMENT BY ATTACHE FILE",
            "description": "Incident description",
            "status": "Closed",
            "details": {
                "caseType": "Payload",
                "classification": "Do Not Engage",
                "subClassification": "Do Not Engage",
                "severity": null,
                "emailReportedBy": "Billy Smith <bsmith@phishlabs.com>",
                "submissionMethod": "Forwarded",
                "sender": "Billy Smith <bsmith@phishlabs.com>",
                "emailBody": "\"\\r\\n\\r\\nBilly Smith\\r\\n843-283-7421\\r\\n\\r\\nBegin forwarded message:\\r\\n\\r\\nFrom: UN ECOSOC / 2019 <china@medicalcables.eu>\\r\\nDate: November 17, 2019 at 5:22:31 PM EST\\r\\nSubject: CONFIRMATION OF YOUR OVERDUE PAYMENT BY ATTACHE FILE\\r\\nReply-To: <services@etscc.com>\\r\\n\\r\\n [External]\\r\\nDear Sir/Madam, Please confirm the attache message file for more information regard of your payment. Best Regards, World Bank Group Finance Ministry\\r\\n\\r\\nExternal email\\r\\n\\r\\nForward suspicious emails to bad@phishlabs.com\\r\\n\"",
                "urls": [
                    {
                        "url": "http://purl.org/dc/elements/1.1/",
                        "malicious": false,
                        "maliciousDomain": false
                    },
                    {
                        "url": "https://www.un.org/press/en/2005/ik486.doc.htm",
                        "malicious": false,
                        "maliciousDomain": false
                    },
                    {
                        "url": "http://www.un.org/",
                        "malicious": false,
                        "maliciousDomain": false
                    },
                    {
                        "url": "http://ns.adobe.com/xap/1.0/mm/",
                        "malicious": false,
                        "maliciousDomain": false
                    },
                    {
                        "url": "http://ns.adobe.com/pdf/1.3/",
                        "malicious": false,
                        "maliciousDomain": false
                    },
                    {
                        "url": "http://www.w3.org/1999/02/22-rdf-syntax-ns#",
                        "malicious": false,
                        "maliciousDomain": false
                    },
                    {
                        "url": "http://ns.adobe.com/xap/1.0/",
                        "malicious": false,
                        "maliciousDomain": false
                    }
                ],
                "attachments": [
                    {
                        "fileName": "ATT00001.htm",
                        "mimeType": "text/html",
                        "md5": "07cbbf25d210d17c6df7ce17695a8f5f",
                        "sha256": "e19f4d5b6a2341e3ba9437f152f4f6739fd8a0842fbc36d531ffa7ec938a289f",
                        "malicious": false
                    }
                ],
                "furtherReviewReason": null,
                "offlineUponReview": false
            },
            "created": "2019-11-17T22:23:16Z",
            "modified": "2019-11-17T22:37:27Z",
            "closed": "2019-11-17T22:37:27Z",
            "duration": 852
        }
    ]
}

[
  {
    "url": "http://purl.org/dc/elements/1.1/",
    "malicious": false,
    "maliciousDomain": false
},
{
    "url": "https://www.un.org/press/en/2005/ik486.doc.htm",
    "malicious": false,
    "maliciousDomain": false
},
{
    "url": "http://www.un.org/",
    "malicious": false,
    "maliciousDomain": false
}
]

[
  {
    "fileName": "ATT00001.htm",
    "mimeType": "text/html",
    "md5": "07cbbf25d210d17c6df7ce17695a8f5f",
    "sha256": "e19f4d5b6a2341e3ba9437f152f4f6739fd8a0842fbc36d531ffa7ec938a289f",
    "malicious": false
}
]

{
    "totalCount": 1921,
    "pagesCount": 20,
    "pageSize": 100,
    "pageNumber": 1,
    "items": [
        {
            "id": 1072798,
            "title": "Credentials Compromised by Stealer Malware",
            "created": "2025-03-13T00:05:29.1812475Z",
            "createdBy": "PhishLabs Operations",
            "incidentType": "Dark Web Monitoring",
            "brandName": "Acme Corp",
            "threatType": "Stealer Malware Credentials",
            "lastModified": "2025-03-13T00:05:29.2644753Z",
            "status": "Closed, No Action",
            "statusReason": "Informational Only",
            "severity": "High",
            "executiveName": null,
            "summary": "Credentials have been identified that were compromised through the deployment of stealer malware. Compromised credentials can include both potential employee or customer logins and other associated personal identifiable information tied to those accounts. The details of the compromised credentials have been captured in this incident for review.",
            "mitigationStarted": null,
            "closed": "2025-03-13T00:05:29.1735405Z",
            "observables": [
                {
                    "type": "Post",
                    "id": 6324794,
                    "url": "https://www.acme.org",
                    "data": null
                }
            ],
            "changeLogs": [
                {
                    "timeStamp": "2025-03-13T00:05:29.2644753Z",
                    "createdBy": "PhishLabs Operations",
                    "content": "Documents - 144374 - added to incident"
                },
                {
                    "timeStamp": "2025-03-13T00:05:29.1812475Z",
                    "createdBy": "PhishLabs Operations",
                    "content": "Incident created"
                },
                {
                    "timeStamp": "2025-03-13T00:05:29.1812475Z",
                    "createdBy": "PhishLabs Operations",
                    "content": "Posts - 6324794 - added to incident"
                }
            ]
        }
    ]
}

Average Feed Run

Object counts and Feed runtime are supplied as generalities only - objects returned by a provider can differ based on credential configurations and Feed runtime may vary based on system resources and load.

Phishlabs

Phishlabs DRP Incidents

Change Log

• Version 1.1.0
  • Added a new feed, PhishLabs DRP Incidents, feed to ingest Digital Risk Protection (DRP) incidents and impacted employee identities from PhishLabs into ThreatQ.
  • Enhanced incident parsing to automatically extract and ingest Email Address indicators from the Sender attribute when a valid email address is present.
  • Updated event title generation to append the incident ID using the format {Title} - {ID}, ensuring unique object names within ThreatQ.
  • Updated the integration's name from Phishlabs CDF to Fortra Phishlabs CDF. 
  • Updated the minimum ThreatQ version to 5.29.0.
• Version 1.0.0
  • Initial release