Skip to main content

​
Get case data

Action ID: tools.phishlabs.get_case_data Get PhishLabs case API data. Reference: https://caseapi.phishlabs.com/v1/data/docs/

​
Secrets

Required secrets:
  • phishlabs: required values PL_USERNAME, PL_PASSWORD.

​
Input fields

​
case_status
array[string]
Filter cases based on the case status. Default is “Pending Input”.Default: [ "Pending Input" ].
​
case_type
array[string]
Filter cases by case type.Default: [].
​
max_records
integer
Maximum number of cases to return. Default is 100, minimum is 20, maximum is 200.Default: 100.
​
verify_ssl
boolean
If False, disables SSL verification for internal networks.Default: true.

​
Get feed data

Action ID: tools.phishlabs.get_feed_data Get PhishLabs feed API data. Reference: https://feed.phishlabs.com/redoc#operation/Feed_GetBAFeed

​
Secrets

Required secrets:
  • phishlabs: required values PL_CUSTOMER_ID, PL_USERNAME, PL_PASSWORD.

​
Input fields

​
from_date
string
The start date of date range (date and time). eg. 2023-01-01 10:00.Default: null.
​
grpcatid
integer
Include the integer that maps to the type of incident you want returned. Default is 0.Default: 0.
​
incident_status
string
The status of the incident as it appears in the Web App. Default is “Requires Input”.Default: "Requires Input".
​
to_date
string
The end date of date range (date and time). eg. 2023-01-07 10:00.Default: null.
​
verify_ssl
boolean
If False, disables SSL verification for internal networks.Default: true.

​
Get threat intel data

Action ID: tools.phishlabs.get_threat_data Get PhishLabs Threat Intel API data. Reference: https://threatintel.phishlabs.com/redoc/incidentexternalapi

​
Secrets

Required secrets:
  • phishlabs: required values PL_CLIENT_ID, PL_CLIENT_SECRET.

​
Input fields

​
incident_severity_codes
array[string]
The severity of incidents to be returned. ‘Low’, ‘Medium’, ‘High’Default: [].
​
incident_status_codes
array[string]
The status code(s) of the incident.Default: [ "RequiresInput", "RequiresApproval" ].
​
incident_type_code
string
The type of Incident to be returned. ‘SocialMedia’ or ‘DarkWeb’Default: null.
​
page_size
integer
The number of records to return per page.Default: 200.
​
threat_type_codes
array[string]
The type of Threats to be returned. Threat Types ending with “SM” are Social Media, “DW” are Dark Web.Default: [].