Phishing Detection and Response: Speed and Automation with Cofense Triage and ServiceNow SIR

By Mike Saurbaugh

How quickly can your security team produce information about the success of phishing incident response capabilities?

What if company leadership asks the CISO for data about the number of malicious phish that bypassed the secure email gateway and that employees caught and reported? Is this information available? More importantly, how rapidly does the team remedy employee-reported phishing threats?

With an integration between Cofense Triage™ and ServiceNow Security Incident Response (SIR), security teams reap great benefits. These include:

  • Bi-directional APIs to integrate and enrich platforms
  • Accelerated phishing email identification and mitigation
  • Improved analyst efficiency to investigate and respond without switching screens
  • Centralized visibility into enterprise incident management and response

Cofense and ServiceNow have long been technology partners and created an integration with Cofense Intelligence for phishing threat lookups and an earlier interoperability with Cofense Triage, both of which are in the suite of products that make up the Cofense phishing detection and response platform. As products evolved, Cofense and ServiceNow boosted security teams’ ability to manage phishing threats.

Think of Cofense Triage as a source of truth to highlight and inform analysts, who in the company reported emails as malicious, while removing the noise from benign reported emails. Now, take these highly credible reported phish and populate ServiceNow SIR with phishing incidents for analysts to remediate through next-steps automation actions across the enterprise. The result is a streamlined process to investigate, prioritize and resolve phishing attacks.

The APIs That More Than GET It

With the advent of a new set of Cofense Triage APIs (version 2), customers benefit from capabilities they had been asking for. Among them:

  • Bidirectional support between platforms – GET, POST, PUT, DELETE
  • Cofense Triage data ingestion and updating outside of the user interface
  • Filtering, and sorting improvements using sparse fieldsets, for better performance
  • To-One (many reports to one category), and To-Many (one category to many reports) relationships
  • Expanding pagination parameters

Optimizing Your Phishing Incident Response

  • Ingest employee-reported phishing emails from Cofense Triage based on severity, category, threat indicators and reporter reputation.
  • Create security incidents in ServiceNow Security Incident Response (SIR) from events in Cofense Triage’s inbox, reconnaissance and processed queues.
  • Ingest phishing threat indicators from Cofense Triage into ServiceNow SIR to enrich and operationalize incident response.
  • Update and process/categorize phishing emails in Cofense Triage from ServiceNow SIR.
  • Bidirectionally manage phishing threat indicators and observables between Cofense Triage and ServiceNow SIR.

Go Configure…

1. First, configure ServiceNow SIR to create an incident based on the desired criteria.

Ingest email artifacts from Cofense Triage – Inbox, Recon or Processed locations. The example below will create a security incident in SIR based on conditions met searching Cofense Triage.

  • Location = Processed
  • Report Category = Crimeware
  • VIP Reporter = True

Figure 1. ServiceNow SIR Security Incident Creation Criteria Querying Cofense Triage

2. Review security incident in ServiceNow SIR after polling interval collects data matching criteria.


Figure 2. ServiceNow SIR Incident Locations Obtained from Cofense Triage

Figure 3. Security Incident Matching Creation Criteria (Processed location, Report Category, VIP)

3. Incident details shown below in figures 4-6 are from reported phish received by Cofense Triage and ingested into SIR. Fields populated were retrieved from polling APIs.

Figure 4. Cofense Triage Data Populating Fields in SIR

Figure 5. Direct Link from Within SIR to Cofense Triage to Preview Reported Email

Figure 6. URL and Domain Populating Observables Table

4. Additional attributes from Cofense Triage populating ServiceNow SIR – Cofense Reporters, and Threat Indicator types and their finding.

Graphical user interface, application Description automatically generated

Figure 7. Cofense Reporters

Figure 8. Threat Indicators and Finding Ingested into SIR as Noted by Cofense Triage

5. What if an analyst in ServiceNow SIR wants to update a threat indicator finding in SIR and change state in Cofense Triage? You can do it, all within the SIR interface and sync the observable reputation with Cofense Triage. The update writes to Cofense Triage and updates the threat level, as shown in figure 10.