GENE-WebAmon: Threat Intelligence for Web Security
GENE-WebAmon integrates your AI assistant with the Webamon Threat Intelligence platform, a powerful tool for investigating and responding to web-based threats.
This gene is designed for security teams and threat analysts who need to quickly assess the risk of a domain, gather evidence, and take action.
Key Capabilities
- Scan Domains: Perform active scans of websites to identify potential threats.
- Capture Evidence: Take screenshots of web pages for documentation and analysis.
- Search for Threats: Query the Webamon database for existing intelligence on a domain.
- Issue Takedowns: Programmatically send takedown requests for malicious sites (requires a Pro account).
- Check Credits: Monitor your API usage and remaining credits.
How It Works
The gene provides a single tool, webamonThreatIntel, which can be controlled with an operation parameter to access the different capabilities. Some operations are available on a free tier, while others require a professional-grade API key from Webamon.
| Operation | Description | API Key Required |
|---|---|---|
scan |
Scans a domain for threats. | No |
screenshot |
Takes a screenshot of a domain's homepage. | No |
search |
Searches the Webamon database for a query. | Optional |
takedown |
Issues a takedown request for a malicious domain. | Yes |
credits |
Checks remaining API credits. | Yes |
Use in Feluda Flows
GENE-WebAmon is a valuable addition to any security automation workflow in Feluda Flows.
- Automatically scan domains from phishing alerts.
- Enrich SIEM events with screenshots and threat intelligence data.
- Create automated workflows to handle takedown requests for confirmed threats.
Who Should Use GENE-WebAmon
- SOC Teams: For enriching alerts and responding to web-based threats.
- Threat Intelligence Analysts: For gathering data and evidence on malicious infrastructure.
- Security Engineers: For building automated security workflows.
Resources
Media
configuration
Frequently Asked Questions
- What is Webamon?
- Webamon is a threat intelligence platform that provides data and services to help identify and respond to malicious web activity.
- Do I need a Webamon account to use this gene?
- You can use the 'scan' and 'screenshot' operations without an account via the free tier. However, the 'search', 'takedown', and 'credits' operations require a Pro tier API key.
- How do I configure my API key?
- You need to store your Webamon Pro API key as a Feluda secret with the name 'webamon-api-key'.
- What can the 'takedown' operation be used for?
- The 'takedown' operation allows you to programmatically send a takedown request to Webamon for a domain you have identified as malicious.
- What is the difference between the 'scan' and 'search' operations?
- 'Scan' actively probes a domain for threats, while 'search' queries the existing Webamon database for known information about a domain.