emalderson/ThePhish

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1368 stars · 200 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

ThePhish is an automated phishing email analysis web application built on TheHive, Cortex, and MISP. It extracts observables from email headers and bodies, runs analyzer pipelines, and produces a final verdict while allowing analyst intervention when needed.

Use cases

• analyze suspicious phishing emails automatically
• extract indicators of compromise from email headers and bodies
• integrate phishing triage with TheHive and Cortex
• enrich email analysis with MISP threat intelligence
• automate SOC incident response for reported phishing
• generate verdicts on potentially malicious emails
• triage user-reported phishing emails in a security operations center

When to choose

• you already run TheHive and Cortex and want automated phishing triage
• your SOC needs to analyze user-reported phishing emails at scale
• you want IOC extraction and verdicts with analyst override capability
• you need a self-hosted phishing analysis workflow integrated with MISP

When to avoid

• you need a simple standalone email scanner without TheHive/Cortex/MISP dependencies
• you want a SaaS or cloud-hosted phishing analysis service
• you need consumer email filtering rather than analyst-driven investigation
• your team has no experience with TheHive platform tooling

Facets

application · maturity stable

email security nlp web-framework developer-tools security email python phishing-detection thehive cortex misp digital-forensics indicators-of-compromise malware-analysis flask soc-automation threat-intelligence incident-response linux docker web-server

Member repositories

For agents

markdown · JSON · MCP: product_card(name="emalderson/ThePhish")