TheHive is Security Incident Response Platform with the ability to integrate with Cortex to automate the actions SOC analysts need to carry out during incident response.
Phish Report hosts a Cortex-compatible server which you can quickly add to any instance of TheHive, without needing to install any custom responders! Simply add our Cortex server to your TheHive configuration file and you'll be taking phishing sites down in no time.
Installation
To install the Phish Report responder, you need to tell TheHive how to connect and authenticate with the Phish Report Cortex server.
If you're already running your own Cortex server, your TheHive application.conf
file will contain a section like
this giving TheHive connection details for your local Cortex server:
play.modules.enabled += org.thp.thehive.connector.cortex.CortexModule
cortex {
servers = [
{
name = "local"
url = "http://localhost:9001"
auth {
type = "bearer"
key = "someapikeyhere"
}
}
]
}
To install the Phish Report integration you need to add another entry to the servers
array:
play.modules.enabled += org.thp.thehive.connector.cortex.CortexModule
cortex {
servers = [
{
name = "local"
url = "http://localhost:9001"
auth {
type = "bearer"
key = "someapikeyhere"
}
},
{
name = "phish_report"
url = "https://phish.report/api/cortex"
auth {
type = "bearer"
key = "Get your API key from https://phish.report/user"
}
}
]
}
You can find your Phish Report API key at the bottom of your user page.
You'll know the integration is working when your TheHive "About" modal (found by clicking your username in the top right
of your TheHive instance and then choosing ℹ️ About
) shows a successful connection.
Usage
Start a takedown of a phishing site from TheHive
The Phish Report integration includes a responder which lets you start a Phish Report takedown directly from a TheHive case.
To start a Phish Report takedown from TheHive:
- Open the Observables tab for your case:
- Click the ⚙️ icon under the Actions heading for a supported observable (
url
,domain
): - Choose "Start a Phish Report takedown" from the list:
The Phish Report integration will then start a takedown for the specified URL or domain and add a new task to your TheHive case with a link where you can complete additional manual takedown actions.