URLScan.io

Version: 1.7
Updated: June 26, 2024

Scan and analyze websites. When a URL is submitted to urlscan.io, an automated process will browse to the URL like a regular user and record the activity that this page navigation creates. This includes the domains and IPs contacted, the resources (JavaScript, CSS, etc) requested from those domains, as well as additional information about the page itself. urlscan.io will take a screenshot of the page, record the DOM content, JavaScript global variables, cookies created by the page, and a myriad of other observations. If the site is targeting the users one of the more than 400 brands tracked by urlscan.io, it will be highlighted as potentially malicious in the scan results.

Actions

• Check Scan Status (Scheduled) - Check the status of Scan URL.
• Get HTTP Transactions (Enrichment) - Get HTTP transactions.
• Get HTTP Transactions V2 (Enrichment) - Get HTTP transactions without saving attachments.
• Get Source Code (Enrichment) - Get a web-page's source code.
• Get URL Report (Enrichment) - Get a URL report.
• Scan Result (Enrichment) - Get results of a previously executed scan.
• Scan Search (Enrichment) - Search for a specific scan.
• Scan URL (Enrichment) - Scan and analyze suspicious websites.

Configure URLScan.io in Automation Service and Cloud SOAR

Before you can use this automation integration, you must configure its authentication settings so that the product you're integrating with can communicate with Sumo Logic. For general guidance, see Configure Authentication for Automation Integrations.

How to open the integration's configuration dialog

1. Access App Central and install the integration. (You can configure at installation, or after installation with the following steps.)
2. Go to the Integrations page.
   Classic UI. In the main Sumo Logic menu, select Automation and then select Integrations in the left nav bar.
   New UI. In the main Sumo Logic menu, select Automation > Integrations. You can also click the Go To... menu at the top of the screen and select Integrations.
3. Select the installed integration.
4. Hover over the resource name and click the Edit button that appears.
   

In the configuration dialog, enter information from the product you're integrating with. When done, click TEST to test the configuration, and click SAVE to save the configuration.

For information about URLScan.io, see URLScan.io documentation.

Change Log

• June 12, 2019 - First upload
• May 18, 2020 - Verdicts output added to "Scan URL" action
• September 3, 2020 - New actions added
• March 8, 2022 - Description
• January 24, 2023
  • solved issue for which the integration test will throw an error if no value for timeout is provided
  • add env var class
  • remove version attribute in the actions
• June 26, 2023 (v1.3) - Removed unnecessary empty lines
• August 2, 2023 (v1.4 & v1.5) - Integration refactored
• June 26, 2024 (v1.6) - New actions added
  • Check Scan Status
    • Get URL Report
• June 26, 2024 (v1.7) - Updated the name of the action "Get URl Report" to "Get URL Report"