display: Intel471 Credentials
name: Intel471Credentials
category: Data Enrichment & Threat Intelligence
provider: Intel471
sectionorder:
- Connect
- Collect
commonfields:
  id: Intel471Credentials
  version: -1
configuration:
- additionalinfo: HTTP Basic auth credentials for the Intel471 Credentials API — enter your API username and API key.
  display: Username
  displaypassword: Password
  name: credentials
  type: 9
  required: true
  section: Connect
- additionalinfo: When enabled, requests are routed through the system proxy configured on the Cortex engine.
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
  advanced: true
- additionalinfo: When enabled, SSL certificate verification is skipped. Not recommended for production use.
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
- defaultvalue: 'true'
  display: Fetch indicators
  name: feed
  type: 8
  required: false
  section: Collect
- additionalinfo: The time to go back when performing the first fetch.
  defaultvalue: '7 days'
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: fetch_time
  type: 0
  required: false
  section: Collect
- additionalinfo: The maximum number of credentials to pull per fetch (each one becomes one indicator and one incident).
  defaultvalue: '200'
  display: Maximum items per fetch
  name: max_fetch
  type: 0
  required: false
  section: Collect
- additionalinfo: How often (in minutes) the integration polls the Intel471 API for new credentials.
  defaultvalue: '240'
  display: Feed Fetch Interval
  name: feedFetchInterval
  type: 19
  required: false
  section: Collect
- additionalinfo: Indicators from this integration instance will be marked with this reputation.
  defaultvalue: Suspicious
  display: Indicator Reputation
  name: feedReputation
  options:
  - None
  - Good
  - Suspicious
  - Bad
  type: 18
  required: false
  section: Collect
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: feedReliability
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
  section: Collect
- additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed
  display: Traffic Light Protocol Color
  name: tlp_color
  defaultvalue: AMBER
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  type: 15
  required: false
  section: Collect
- defaultvalue: indicatorType
  display: ''
  name: feedExpirationPolicy
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
  section: Collect
- defaultvalue: '20160'
  display: ''
  name: feedExpirationInterval
  type: 1
  required: false
  section: Collect
- additionalinfo: Supports CSV values.
  display: Tags
  name: feedTags
  type: 0
  required: false
  section: Collect
- additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  required: false
  section: Collect
- additionalinfo: The credential set name to filter results by.
  display: Credential set name
  name: credential_set_name
  type: 0
  required: false
  section: Collect
- additionalinfo: The credential set ID to filter results by.
  display: Credential set id
  name: credential_set_id
  type: 0
  required: false
  section: Collect
- additionalinfo: The credential detection domain to filter results by.
  display: Domain
  name: domain
  type: 0
  required: false
  section: Collect
- additionalinfo: "The affiliation group to filter results by. Possible values: my_employees, my_customers, third_parties, vip_emails."
  display: Affiliation group
  name: affiliation_group
  type: 15
  required: false
  options:
  - my_employees
  - my_customers
  - third_parties
  - vip_emails
  section: Collect
- additionalinfo: The password strength to filter results by.
  display: Password strength
  name: password_strength
  type: 15
  required: false
  options:
  - excellent
  - strong
  - medium
  - weak
  - poor
  - not_provided
  section: Collect
- additionalinfo: 'The detected info stealer malware family to filter results by (e.g., agent_tesla, Lumma, VIDAR).'
  display: Detected malware
  name: detected_malware
  type: 0
  required: false
  section: Collect
- additionalinfo: A comma-separated list of custom GIRs (General Intelligence Requirements), my_girs or company_pirs, to filter results by.
  display: GIRs
  name: girs
  type: 0
  required: false
  section: Collect
description: Fetches leaked credentials from the Intel471 Credentials API and produces an indicator per credential. While building each indicator the integration also creates an associated incident.
script:
  commands:
  - arguments:
    - defaultValue: '50'
      description: The maximum number of indicators to return.
      name: limit
      type: number
    description: Gets a preview of indicators that the feed would pull on the next run (no state is persisted).
    name: intel471-credentials-get-indicators
    outputs:
    - contextPath: Intel471Credentials.Indicators.value
      description: The credential login value (email address or account username).
      type: String
    - contextPath: Intel471Credentials.Indicators.type
      description: The indicator type — Email or Account.
      type: String
    - contextPath: Intel471Credentials.Indicators.fields.firstseenbysource
      description: Timestamp when the credential was first observed by Intel471.
      type: Date
    - contextPath: Intel471Credentials.Indicators.fields.lastseenbysource
      description: Timestamp when the credential was last observed by Intel471.
      type: Date
    - contextPath: Intel471Credentials.Indicators.fields.tags
      description: Aggregated tags — malware families, affiliations, and configured feed tags.
      type: Unknown
    - contextPath: Intel471Credentials.Indicators.fields.intel471infostealerantivirussoftware
      description: Antivirus software detected on the machine infected by the info stealer.
      type: String
    - contextPath: Intel471Credentials.Indicators.fields.intel471infostealercomputerusername
      description: Operating-system username logged in on the infected machine.
      type: String
    - contextPath: Intel471Credentials.Indicators.fields.intel471infostealerinfectiontimestamp
      description: Timestamp when the info stealer infection was recorded.
      type: Date
    - contextPath: Intel471Credentials.Indicators.fields.intel471infostealerip
      description: IP address of the machine infected by the info stealer.
      type: String
    - contextPath: Intel471Credentials.Indicators.fields.intel471infostealerisp
      description: Internet service provider associated with the infected machine.
      type: String
    - contextPath: Intel471Credentials.Indicators.fields.intel471infostealermachineid
      description: Unique identifier fingerprinted by the info stealer for the infected host.
      type: String
    - contextPath: Intel471Credentials.Indicators.fields.intel471infostealermalwarefamily
      description: Family of info stealer malware that captured the credential.
      type: String
    - contextPath: Intel471Credentials.Indicators.fields.intel471infostealermalwareinstallpath
      description: Filesystem path where the info stealer malware was installed.
      type: String
    - contextPath: Intel471Credentials.Indicators.fields.intel471infostealeros
      description: Operating system reported for the machine infected by the info stealer.
      type: String
    - contextPath: Intel471Credentials.Indicators.fields.intel471infostealerpcname
      description: Hostname (PC name) of the machine infected by the info stealer.
      type: String
    - contextPath: Intel471Credentials.Indicators.fields.intel471infostealerscreenshotpath
      description: Path to the desktop screenshot captured by the info stealer.
      type: String
    - contextPath: Intel471Credentials.Indicators.fields.intel471infostealerversion
      description: Version identifier reported by the info stealer malware.
      type: String
  dockerimage: demisto/py3-tools:1.0.0.11597437
  feed: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests
fromversion: 6.8.0
marketplaces:
- xsoar
- marketplacev2
- platform