Webhood URL Scanner (Preview)

This is the Swagger 2.0 schema for the Webhood URL scanner API

This connector is available in the following products and regions:

Webhood is a private URL scanner used by threat hunters and security analysts for analyzing phishing and malicious sites. This connector allows you to control scans using Azure Logic Apps and Power Automate.

Prerequisites

• Webhood instance

The Webhood instance can be self-hosted by following the Webhood URL Scanner deployment instructions. The connector is tested with the latest version of Webhood.

You can also get a hosted version of Webhood by signing up at Webhood Cloud.

• API key

The API key is used to authenticate the connector to the Webhood instance. See Obtaining Credentials for instructions on how to create an API key.

• Valid https certificate for the Webhood instance if using HTTPS (required for Power Automate)

How to get credentials

1. Login to your Webhood instance with an admin account.
2. Go to Settings -> Accounts -> API Tokens to create a new API key.
3. Select Add Token and select scanner as the role.
4. Copy the generated API key (Token) and use it as the API Key in the connector.

The API key will be displayed only once as it is not stored in your Webhood instance.

Note that all API keys expire after 365 days. You can create a new API key at any time. If you want to revoke an API key, you can delete it from the Webhood instance by selecting Revoke. We recommend you note down ID of the token so that you can identify it later.

Get started with your connector

The key feature of this connector is the ability to scan URLs for phishing and malicious content. The connector provides actions to create a new scan, get past scans, get scan by ID, and get screenshot by scan ID.

This enables you to automate the scanning process and integrate it with other services. For example, you can create a new scan when a new URL is added to a SharePoint list, or get the scan results when a scan is completed.

You can also integrate this connector with Microsoft Sentinel to automatically scan URLs from security alerts.

Simple example flow:

1. Create a new scan - Trigger a new scan for a URL with an input e.g. https://example.com.
2. Get scan by ID - Get the scan details by providing the scan ID from the previous step.
3. Loop until the scan status is done or error.
4. Output a link to the scan results by combining slug from step 2. with the URL of your Webhood instance, for example https://yourwebhoodinstance.example/scan/{slug}.

The following example shows a Sentinel playbook with an Entity trigger:

Known issues and limitations

• The Get screenshot by scan ID returns a screenshot of the site. However, there is currently no way to display the image in Power Automate. Simple workaround is to use the Get scan by ID action to get the url and open it in a browser.

Common errors and remedies

• Error: 401 Unauthorized - The API key is invalid or expired.
• Scan stays in pending status for a long time - Make sure you have deployed a Scanner instance and it is running. Check the Scanner logs for any errors.

FAQ

Creating a connection

The connector supports the following authentication types:

Default

Applicable: All regions

Parameters for creating connection.

This is not shareable connection. If the power app is shared with another user, another user will be prompted to create new connection explicitly.

Throttling Limits

Actions

Create a new scan

Get past scans, optionally filter by status

Get scan by ID

Get screenshot by Scan ID

Definitions

Scan