BechtleDarkWebScan

Notifies you if login credentials to your company are being sold on the dark web.

Identity and Access Management · Bechtle Dark Web Scan

Details

IDBechtleDarkWebScan
ProviderBechtle
CategoryIdentity and Access Management
From Version6.10.0
Docker Imagedemisto/python3:3.12.13.12042988

README

The dark web scan integration notifies you if login credentials to your company are being sold on the dark web.

Configure BechtleDarkWebScan in Cortex

Parameter Description Required
API Key Your darkwebscan.app API Key True
Additional request headers Additional request headers False
Fetch incidents Whether to fetch incidents False
Incidents Fetch Interval The interval incidents should be fetched False
First fetch time The first fetch time False
Incident type The incident type False
Maximum incidents per fetch Maxmimum amount of incidents per fetch False
Trust any certificate (not secure) Whether to trust any certificate False
Use system proxy settings Whether to use system proxy settings False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

darkwebscan-getcompanies

Returns a list of all companies associated with your API key.

Base Command

darkwebscan-getcompanies

Input

There are no input arguments for this command.

Context Output

Path Type Description
BechtleDarkWebScan.Companies String All companies that you have access to.

darkwebscan-getleaks

Returns leaked credentials for a given company_id.

Base Command

darkwebscan-getleaks

Input

Argument Name Description Required
company_id ID of the company to retrieve leaked credentials for. Required
only_new Only return leaks not previously seen by this integration instance. Possible values are: true, false. Default is false. Optional

Context Output

Path Type Description
BechtleDarkWebScan.LeakedCredentials String Leaked credentials for a given company_id.

darkwebscan-getosint

Returns OSINT information about the associated domain of a given company_id.

Base Command

darkwebscan-getosint

Input

Argument Name Description Required
company_id ID of the company to retrieve OSINT information for. Required

Context Output

Path Type Description
BechtleDarkWebScan.OSINT String OSINT information (email addresses, subdomains, …) for the associated domain of a given company_id.

darkwebscan-getemailsecurity

Returns information about the email security for the associated domain of a given company_id.

Base Command

darkwebscan-getemailsecurity

Input

Argument Name Description Required
company_id ID of the company to retrieve email security information for. Required

Context Output

Path Type Description
BechtleDarkWebScan.EmailSecurity String Email security (SPF, DMARC, DANE, …) for the associated domain of a given company_id.

darkwebscan-getwaf

Returns Web Application Firewall Status information about the associated domain of a given company_id.

Base Command

darkwebscan-getwaf

Input

Argument Name Description Required
company_id ID of the company to retrieve Web Application Firewall Status information for. Required

Context Output

Path Type Description
BechtleDarkWebScan.WAF String Web Application Firewall status and product name (if applicable)

darkwebscan-resetcontext

Resets integration context for the DarkWebScan. May result in many alerts reappearing.

Base Command

darkwebscan-resetcontext

Input

There are no input arguments for this command.

Context Output

Path Type Description
BechtleDarkWebScan.ResetContext String Returns text whether the reset was successful or not.

Configuration parameters

  • apikey — API Key (required)
  • addreqheaders — Additional request headers
  • isFetch — Fetch incidents
  • incidentFetchInterval — Incidents Fetch Interval
  • first_fetch — First fetch time
  • incidentType — Incident type
  • max_fetch — Maximum incidents per fetch
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (6)

  • darkwebscan-getcompanies

    Returns a list of all companies associated with your API key.

  • darkwebscan-getemailsecurity

    Returns information about the email security for the associated domain of a given company_id.

  • darkwebscan-getleaks

    Returns leaked credentials for a given company_id.

  • darkwebscan-getosint

    Returns OSINT information about the associated domain of a given company_id.

  • darkwebscan-getwaf

    Returns Web Application Firewall Status information about the associated domain of a given company_id.

  • darkwebscan-resetcontext

    Resets integration context for the DarkWebScan. May result in many alerts reappearing.

Source

BechtleDarkWebScan.py BechtleDarkWebScan_test.py BechtleDarkWebScan.yml BechtleDarkWebScan_description.md command_examples.txt
Download History Raw 
display: BechtleDarkWebScan
name: BechtleDarkWebScan
description: 'Notifies you if login credentials to your company are being sold on the dark web.'
category: Identity and Access Management
provider: Bechtle
commonfields:
  id: BechtleDarkWebScan
  version: -1
sectionorder:
- Connect
- Collect
- Optimize
configuration:
- display: API Key
  additionalinfo: The darkwebscan.app API Key.
  name: apikey
  required: true
  type: 9
  hiddenusername: true
  displaypassword: "API Key"
  section: Connect
- display: Additional request headers
  name: addreqheaders
  required: false
  type: 12
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  defaultvalue: "60"
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: First fetch time
  name: first_fetch
  defaultvalue: "6 months"
  type: 0
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Maximum incidents per fetch
  name: max_fetch
  defaultvalue: "50"
  type: 0
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
defaultclassifier: BechtleDarkWebScan - Classifier
defaultmapperin: "BechtleDarkWebScan-mapper"
script:
  commands:
  - name: darkwebscan-getcompanies
    deprecated: false
    description: 'Returns a list of all companies associated with your API key.'
    execution: false
    outputs:
    - contextPath: BechtleDarkWebScan.Companies
      description: 'The companies that you have access to.'
      type: String
  - name: darkwebscan-getleaks
    arguments:
    - name: company_id
      default: false
      description: 'The ID of the company to retrieve leaked credentials for.'
      isArray: false
      required: true
      type: number
      secret: false
    - name: only_new
      default: false
      defaultValue: "false"
      description: 'Whether to only return leaks not previously seen by this integration instance.'
      isArray: false
      required: false
      secret: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    deprecated: false
    description: 'Returns leaked credentials for a given company_id.'
    execution: false
    outputs:
    - contextPath: BechtleDarkWebScan.LeakedCredentials
      description: 'The leaked credentials for a given company_id.'
      type: String

  - name: darkwebscan-getosint
    arguments:
    - name: company_id
      default: false
      description: 'The ID of the company to retrieve OSINT information for.'
      isArray: false
      required: true
      type: number
      secret: false
    deprecated: false
    description: 'Returns OSINT information about the associated domain of a given company_id.'
    execution: false
    outputs:
    - contextPath: BechtleDarkWebScan.OSINT
      description: 'The OSINT information (email addresses, subdomains, ...) for the associated domain of a given company_id.'
      type: String

  - name: darkwebscan-getemailsecurity
    arguments:
    - name: company_id
      default: false
      description: 'The ID of the company to retrieve email security information for.'
      isArray: false
      required: true
      type: number
      secret: false
    deprecated: false
    description: 'Returns information about the email security for the associated domain of a given company_id.'
    execution: false
    outputs:
    - contextPath: BechtleDarkWebScan.EmailSecurity
      description: 'The email security (SPF, DMARC, DANE, ...) information for the associated domain of a given company_id.'
      type: String

  - name: darkwebscan-getwaf
    arguments:
    - name: company_id
      default: false
      description: 'The ID of the company to retrieve Web Application Firewall Status information for.'
      isArray: false
      required: true
      type: number
      secret: false
    deprecated: false
    description: 'Returns Web Application Firewall Status information about the associated domain of a given company_id.'
    execution: false
    outputs:
    - contextPath: BechtleDarkWebScan.WAF
      description: 'The Web Application Firewall status and product name (if applicable).'
      type: String

  - name: darkwebscan-resetcontext
    deprecated: false
    description: 'Resets integration context for the DarkWebScan. May result in many alerts reappearing.'
    execution: false
    outputs:
    - contextPath: BechtleDarkWebScan.ResetContext
      description: 'Indicates that the integration context has been reset.'
      type: String


  isfetch: true
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.12042988
fromversion: 6.10.0
marketplaces:
- xsoar
- marketplacev2
- platform
tests:
- No tests (auto formatted)