emalderson/thephish
An automated phishing email analysis tool that extracts observables, integrates with TheHive/Cortex/MISP, and calculates verdicts.
What is emalderson/thephish?
ThePhish is an automated phishing email analysis tool that processes suspicious emails forwarded by users. It extracts observables like URLs and domains, analyzes them using integrated security platforms (TheHive, Cortex, MISP), and provides a verdict to help security teams respond quickly. It automates the tedious parts of phishing investigation, reducing manual effort.
Security analysts, SOC teams, and IT security professionals who need to process and analyze phishing emails at scale. It's ideal for organizations using or willing to deploy TheHive, Cortex, and MISP in their security operations.
Developers choose ThePhish because it provides a complete, open-source automation pipeline for phishing analysis, integrates seamlessly with popular security tools, and offers a user-friendly web interface. It reduces analysis time and ensures consistent processes compared to manual methods.
Overview
ThePhish: an automated phishing email analysis tool
Use Cases
Best For
- Automating the triage and analysis of phishing emails reported by employees
- Integrating phishing analysis into an existing TheHive/Cortex/MISP security stack
- Reducing manual effort for SOC teams handling high volumes of phishing reports
- Creating a self-hosted, automated phishing analysis workflow without commercial tools
- Sharing phishing indicators with threat intelligence platforms via MISP
- Building a customizable phishing analysis pipeline with configurable whitelists and analyzers
Not Ideal For
- Organizations without an existing TheHive, Cortex, or MISP deployment, due to the significant setup and integration overhead
- Teams needing quick, one-off analysis of phishing emails without a full automation pipeline or security stack
- Environments requiring fully automated verdicts with zero manual analyst intervention, as suspicious cases need review
- Security operations focused on non-email threats like SMS phishing or social media scams, since it's email-specific
Pros & Cons
Pros
Automatically extracts observables from emails, submits them to Cortex analyzers, and calculates a verdict, streamlining the entire phishing analysis workflow as shown in the detailed implementation diagram.
Seamlessly creates cases in TheHive, leverages Cortex for analysis, and exports findings to MISP, fitting directly into existing SOC pipelines without extra steps.
Supports exact matching and regex for various observable types, including domains in subdomains and URLs, allowing precise control over false positive reduction as demonstrated in the whitelist.json example.
Provides real-time progress updates via WebSocket and allows analysts to intervene for inconclusive cases, balancing automation with oversight through the GUI shown in the demo screenshots.
Cons
Requires operational instances of TheHive, Cortex, MISP, and an IMAP email service, making the system brittle if any component fails or isn't properly configured.
Many Cortex analyzers need API keys, subscriptions, or have bugs requiring manual level adjustments in ThePhish's configuration files, as admitted in the 'Configure the analyzers' section.
Users must manually add the run_responder function to TheHive4py, as stated in the installation guide, which is error-prone and may break with updates to dependencies.
Frequently Asked Questions
Related Projects
lobe-chat🤯 LobeHub is your Chief Agent Operator, organizing your agents into 7×24 operations by hiring, scheduling, and reporting on your entire AI team.
nerd-fontsIconic font aggregator, collection, & patcher. 3,600+ icons, 50+ patched fonts: Hack, Source Code Pro, more. Glyph collections: Font Awesome, Material Design Icons, Octicons, & more
sniffnetComfortably monitor your Internet traffic 🕵️♂️
httpie🥧 HTTPie CLI — modern, user-friendly command-line HTTP client for the API era. JSON support, colors, sessions, downloads, plugins & more.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.