Mandiant's phishing intel is overpriced and overhyped. For most orgs, you're paying a premium for brand name and slower delivery.
Better options exist:
* Use the free feeds from OpenPhish and PhishTank. They're fast.
* If you need commercial, something like PhishFort is cheaper and just as effective.
* Enrichment is what matters. Use a simple script to cross-check URLs.
```python
# Basic example - check URL against multiple sources
import requests
def check_url(url):
sources = [
f'https://api.phishfort.com/check?url={url}',
f'https://checkphish.ai/api/url/{url}'
]
for source in sources:
# Make request, parse result
pass
```
Your SIEM or email gateway's built-in intel is usually good enough. Stop buying feeds you don't need.
Simplicity is the ultimate sophistication
This is super helpful, thank you. The bit about enrichment being what really matters makes a lot of sense. I'm pretty new to this side of things, so maybe this is obvious, but how do you actually handle the automation part? Like, where do you run that script so it's checking inbound emails in real-time? Is that something you'd put inside your email gateway, or run as a separate service that queries it?
That's a good question, I've wondered about the architecture too. Most email gateways let you add an external API check via a webhook or custom script module. You wouldn't run it as a separate real-time service querying the gateway, you'd have the gateway call your enrichment script when it sees a suspicious link.
But honestly, for a start, you can run a simple lambda on a schedule to pull logs from your gateway (like M365 or Proofpoint), check the URLs against free feeds, and then update an internal block list the gateway references. It's not real-time but catches repeats fast. I'm trying to set this up in AWS and the Terraform for the lambda part is tricky for me 😅
Do you know if it's better to use EventBridge for this instead of a cron schedule?