Example Requests:
| Endpoint | Description |
|---|---|
| /incidents/EIR?created_after=2019-09-24T16:40:35Z | Return Incidents closed after 2019-09-24T16:40:35Z |
| /incidents/EIR?created_after=2019-09-24T16:00:00Z&created_before=2019-09-24T17:00:00Z | Return closed Incidents created during the hour of 2019-09-24T16:00:00Z |
| /incidents/EIR?sort=closed_at | Return closed Incidents sorted by their closed date in order of newest to oldest |
| /incidents/EIR?sort=created_at&direction=asc | Return closed Incidents sorted by their created date in order of oldest to newest |
| /incidents/EIR?status=open | Return Incidents that are currently open |
External DocumentationTo learn more, visit the PhishLabs Incident Data documentation.
Basic Parameters
| Parameter | Description |
|---|---|
| Message ID | Return all incidents related with given email Message-ID. |
| Status | Filter incidents that are opened or closed. Note: Open cases are not updated in real time. |
Advanced Parameters
| Parameter | Description |
|---|---|
| Closed After | Return Incidents closed on or after the given timestamp Timestamp is in RFC3339 format(2019-04-12T23:20:50Z). |
| Closed Before | Return Incidents closed on or before the given timestamp Timestamp is in RFC3339 format(2019-04-12T23:20:50Z). |
| Created After | Return Incidents created on or after the given timestamp Timestamp is in RFC3339 format(2019-04-12T23:20:50Z). |
| Created Before | Return Incidents created on or before the given timestamp Timestamp is in RFC3339 format(2019-04-12T23:20:50Z). |
| Direction | Return Incidents sorted by the given order. This will be applied to the given sort parameter. |
| Extend Attachments | If true, the attachment list will contain the following additional attachment types (if available): screenshot & submission. By default, only payload will be included. |
| Limit | Number of records to return. |
| Offset | Number of Incidents to skip. This parameter is only useful with pagination. |
Example Output
{
"incidents": [
{
"closed": "2019-09-24T16:40:35Z",
"created": "2019-09-24T16:17:49Z",
"description": "This is a malicious phishing email.",
"details": {
"attachments": [
{
"fileName": "payroll.doc",
"malicious": true,
"md5": "f869ce1c8414a264bb11e14a2c8850ed",
"mimeType": "application/msword",
"sha256": "07c05679b1cfed895de0d838...",
"type": "payload",
"url": "http://incident-bucket.phishlabs.com/donwload/payload_file=payroll.doc"
}
],
"campaignLabel": "ecrim-202003-191",
"caseType": "Link",
"classification": "Malicious",
"emailAddresses": [
{
"address": "sender@example.com",
"bodyReplyTo": false,
"headerReplyTo": false,
"malicious": true,
"returnPath": true,
"sender": true
}
],
"emailBody": "Lorem ipsum dolor sit amet...",
"emailReceivedDate": "Sat, 17 Nov 2018 16:10:08 +0530",
"emailReportedBy": "user@phishlabs.com",
"furtherReviewReason": "Email headers required",
"messageID": "124369.69372.1552996@wb.phishlabs.com",
"offlineUponReview": false,
"payloadFamily": "WannaCry",
"sender": "marclowe@gmail.com",
"severity": "High",
"subClassification": "No Threat Detected",
"submissionMethod": "Attachment",
"urls": [
{
"malicious": false,
"maliciousDomain": false,
"url": "https://phishlabs.com"
}
]
},
"duration": 1366,
"id": "INC123456",
"modified": "2019-09-24T16:40:35Z",
"service": "SEA",
"status": "closed",
"title": "Fwd: Phishing Email"
}
],
"metadata": {
"count": 1
}
}
Workflow Library Example
Get Incidents with Phishlabs Incident Data and Send Results Via Email