DeHashed

This integration allows you to check if your personal information such as your email, username, or password is being compromised.

Utilities · DeHashed

Details

IDDeHashed
ProviderDeHashed
CategoryUtilities
From Version5.5.0
Docker Imagedemisto/fastapi:0.125.0.10158186
Supported ModulesAgentix XSIAM

README

This integration allows you to check if your personal information such as your email, username, or password is being compromised.

Configure DeHashed in Cortex

Parameter Description Required
API Key For generating an API Key, see https://www.dehashed.com. True
Trust any certificate (not secure)   False
Use system proxy settings   False
Email Severity: The DBot reputation for compromised emails (SUSPICIOUS or MALICIOUS)   False
Source Reliability Reliability of the source providing the intelligence data. False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

dehashed-search

Performs a search to check if information is compromised.

Base Command

dehashed-search

Input

Argument Name Description Required
asset_type If you select the “all fields” option, the search is performed on all fields with the specified value entered in the “value” argument, and you don’t have to pass the “operation” argument. Possible values are: email, ip_address, username, hashed_password, name, vin, address, phone, all_fields. Required
value The searched value. Required
operation The search operator. Possible values are: is, regex. Required
page The number of page to return. Each page contains up to 5,000 results. Optional
results_from Starting result number to display. Default is 1. Optional
results_to Ending result number to display. Default is 50. Optional

Context Output

Path Type Description
DeHashed.Search.Id String ID of the object.
DeHashed.Search.Email String Email address of the object.
DeHashed.Search.Username String Username of the object.
DeHashed.Search.Password String Password of the object.
DeHashed.Search.HashedPassword String Hashed password of the object.
DeHashed.Search.Name String Name of the object.
DeHashed.Search.Address String Address of the object.
DeHashed.Search.IpAddress String IP address of the object.
DeHashed.Search.Phone Number Phone number of the object.
DeHashed.Search.Dob String Date of birth.
DeHashed.Search.LicensePlate String License plate.
DeHashed.Search.Company String Company name.
DeHashed.Search.Url String Associated URL.
DeHashed.Search.Social String Social media handle.
DeHashed.Search.CryptocurrencyAddress String Cryptocurrency address.
DeHashed.Search.DatabaseName String Source database/breach name (drives DBot score).
Dehashed.LastQuery.ResultsFrom Number The value of the “results_from” argument that was passed in the last query.
Dehashed.LastQuery.ResultsTo Unknown The value of the “results_to” argument that was passed in the last query.
Dehashed.LastQuery.TotalResults Number The total number of entries returned from the last query.
Dehashed.LastQuery.DisplayedResults Number The number of entries that were displayed in Cortex XSOAR from the last query.

Command Example

!dehashed-search asset_type=all_fields operation=contains value=or-gal@gmail.com results_to=4 results_from=1
!dehashed-search asset_type=email operation=is value=or-gal@gmail.com page=1
!dehashed-search asset_type=name operation=contains value=gal,gil,test1 results_from=2 results_to=30 page=3
!dehashed-search asset_type=name operation=regex value=joh?n(ath[oa]n)

Human Readable Output

email

Checks if an email address was compromised.

Base Command

email

Input

Argument Name Description Required
email The email address to check. Required

Context Output

Path Type Description
DeHashed.Search.Id String ID of the object.
DeHashed.Search.Email String Email address of the object.
DeHashed.Search.Username String Username of the object.
DeHashed.Search.Password String Password of the object.
DeHashed.Search.HashedPassword String Hashed password of the object.
DeHashed.Search.Name String Name of the object.
DeHashed.Search.Address String Address of the object.
DeHashed.Search.IpAddress String IP address of the object.
DeHashed.Search.Phone Number Phone number of the object.
DeHashed.Search.Dob String Date of birth.
DeHashed.Search.LicensePlate String License plate.
DeHashed.Search.Company String Company name.
DeHashed.Search.Url String Associated URL.
DeHashed.Search.Social String Social media handle.
DeHashed.Search.CryptocurrencyAddress String Cryptocurrency address.
DeHashed.Search.DatabaseName String Source database/breach name (drives DBot score).
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
DBotScore.Reliability String Reliability of the source providing the intelligence data.

Command Example

!email email=or-gal@gmail.com

Human Readable Output

Configuration parameters

  • credentials — (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • email_dbot_score — Email Severity: The DBot reputation for compromised emails (SUSPICIOUS or MALICIOUS)
  • integration_reliability — Source Reliability

Commands (2)

  • dehashed-search

    Performs a search to check if information is compromised.

  • email

    Checks if an email address was compromised.

Source

DeHashed.py DeHashed_test.py DeHashed.yml DeHashed_description.md command_examples.txt
Download History Raw 
category: Utilities
provider: DeHashed
commonfields:
  id: DeHashed
  version: -1
configuration:
- additionalinfo: To generate an API key, see https://www.dehashed.com.
  displaypassword: API Key
  hiddenusername: true
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- defaultvalue: SUSPICIOUS
  display: 'Email Severity: The DBot reputation for compromised emails (SUSPICIOUS or MALICIOUS)'
  name: email_dbot_score
  type: 0
  required: false
  section: Collect
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: integration_reliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  required: false
  section: Collect
description: This integration allows you to check if your personal information such as your email, username, or password is being compromised.
display: DeHashed
name: DeHashed
script:
  commands:

  - arguments:
    - auto: PREDEFINED
      description: If you select the "all fields" option, the search is performed on all fields with the specified value entered in the "value" argument, and you don't have to pass the "operation" argument.
      name: asset_type
      predefined:
      - email
      - ip_address
      - username
      - hashed_password
      - name
      - vin
      - address
      - phone
      - all_fields
      required: true
    - description: The searched value.
      name: value
      required: true
    - auto: PREDEFINED
      description: The search operator.
      name: operation
      predefined:
      - is
      - regex
      required: true
    - description: The page number to return. Each page contains up to 5,000 results.
      name: page
    - description: The index of the first result to display. Default is 1.
      name: results_from
    - description: The index of the last result to display. Default is 50.
      name: results_to
    description: Performs a search to check if information is compromised.
    name: dehashed-search
    outputs:
    - contextPath: DeHashed.Search.Id
      description: ID of the object.
      type: String
    - contextPath: DeHashed.Search.Email
      description: Email address of the object.
      type: String
    - contextPath: DeHashed.Search.Username
      description: Username of the object.
      type: String
    - contextPath: DeHashed.Search.Password
      description: Password of the object.
      type: String
    - contextPath: DeHashed.Search.HashedPassword
      description: Hashed password of the object.
      type: String
    - contextPath: DeHashed.Search.Name
      description: Name of the object.
      type: String
    - contextPath: DeHashed.Search.Address
      description: Address of the object.
      type: String
    - contextPath: DeHashed.Search.IpAddress
      description: IP address of the object.
      type: String
    - contextPath: DeHashed.Search.Phone
      description: Phone number of the object.
      type: Number
    - contextPath: DeHashed.Search.Dob
      description: The date of birth.
      type: String
    - contextPath: DeHashed.Search.LicensePlate
      description: The license plate.
      type: String
    - contextPath: DeHashed.Search.Company
      description: The company name.
      type: String
    - contextPath: DeHashed.Search.Url
      description: The URL associated with the search result.
      type: String
    - contextPath: DeHashed.Search.Social
      description: The social media handle.
      type: String
    - contextPath: DeHashed.Search.CryptocurrencyAddress
      description: The cryptocurrency address.
      type: String
    - contextPath: DeHashed.Search.DatabaseName
      description: The name of the source database or breach. This value is used to calculate the DBot score.
      type: String
    - contextPath: Dehashed.LastQuery.ResultsFrom
      description: The value of the "results_from" argument that was passed in the last query.
      type: Number
    - contextPath: Dehashed.LastQuery.ResultsTo
      description: The value of the "results_to" argument that was passed in the last query.
      type: Unknown
    - contextPath: Dehashed.LastQuery.TotalResults
      description: The total number of entries returned from the last query.
      type: Number
    - contextPath: Dehashed.LastQuery.DisplayedResults
      description: The number of entries that were displayed from the last query.
      type: Number

  - arguments:
    - default: true
      description: The email address to check.
      isArray: true
      name: email
      required: true
    description: Checks if an email address was compromised.
    name: email
    outputs:
    - contextPath: DeHashed.Search.Id
      description: ID of the object.
      type: String
    - contextPath: DeHashed.Search.Email
      description: Email address of the object.
      type: String
    - contextPath: DeHashed.Search.Username
      description: Username of the object.
      type: String
    - contextPath: DeHashed.Search.Password
      description: Password of the object.
      type: String
    - contextPath: DeHashed.Search.HashedPassword
      description: Hashed password of the object.
      type: String
    - contextPath: DeHashed.Search.Name
      description: Name of the object.
      type: String
    - contextPath: DeHashed.Search.Address
      description: Address of the object.
      type: String
    - contextPath: DeHashed.Search.IpAddress
      description: IP address of the object.
      type: String
    - contextPath: DeHashed.Search.Phone
      description: Phone number of the object.
      type: Number
    - contextPath: DeHashed.Search.Dob
      description: The date of birth.
      type: String
    - contextPath: DeHashed.Search.LicensePlate
      description: The license plate.
      type: String
    - contextPath: DeHashed.Search.Company
      description: The company name.
      type: String
    - contextPath: DeHashed.Search.Url
      description: The URL associated with the search result.
      type: String
    - contextPath: DeHashed.Search.Social
      description: The social media handle.
      type: String
    - contextPath: DeHashed.Search.CryptocurrencyAddress
      description: The cryptocurrency address.
      type: String
    - contextPath: DeHashed.Search.DatabaseName
      description: The name of the source database or breach. This value is used to calculate the DBot score.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: Reliability of the source providing the intelligence data.
      type: String

  dockerimage: demisto/fastapi:0.125.0.10158186
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests
fromversion: 5.5.0
sectionorder:
- Connect
- Collect