Intel471 Credentials

Fetches leaked credentials from the Intel471 Credentials API (/credentials/stream).

The primary command is fetch-indicators: each credential is converted into one Cortex indicator (Email if the login contains @, otherwise Account). While iterating the indicator-creation loop, the integration also creates an associated Cortex incident for the same credential and links it back via the indicator’s relatedIncidents field.

Notes

• On the first run, the integration fetches credentials with last_updated_ts newer than the configured “First fetch timestamp” (default: 7 days).
• Subsequent runs continue from the stream cursor returned by the API.

Prerequisites

The integration authenticates to the Intel471 Credentials API with HTTP Basic auth (Username = API username, Password = API key). To obtain these credentials:

1. Sign in to the Intel471 Developer Portal using your organization SSO account (or sign up if this is your first visit).
2. Confirm that your organization has an active subscription that grants access to the Credentials Intelligence product. If it does not, contact your Intel471 account manager to enable it.
3. In the portal, open API Keys (under your account menu) and click Create new API key.
4. Copy the generated username and API key — the API key is shown only once.
5. Use these values in the Username and Password fields of the configuration below.

Configure Intel471 Credentials in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

intel471-credentials-get-indicators

Gets a preview of indicators that the feed would pull on the next run (no state is persisted).

Base Command

intel471-credentials-get-indicators

Input

Context Output

Command example

!intel471-credentials-get-indicators limit=5

Context Example

{
    "Intel471Credentials": {
        "Indicators": [
            {
                "value": "victim@example.com",
                "type": "Email",
                "fields": {
                    "firstseenbysource": "2026-06-01T00:00:00Z",
                    "lastseenbysource": "2026-06-20T00:00:00Z",
                    "tags": ["lumma", "my_employees"],
                    "intel471infostealerantivirussoftware": "Defender",
                    "intel471infostealercomputerusername": "jdoe",
                    "intel471infostealerinfectiontimestamp": "2026-06-19T12:00:00Z",
                    "intel471infostealerip": "1.2.3.4, 5.6.7.8",
                    "intel471infostealerisp": "ExampleISP",
                    "intel471infostealermachineid": "m-1",
                    "intel471infostealermalwarefamily": "lumma",
                    "intel471infostealermalwareinstallpath": "C:/Users/jdoe/AppData/Roaming",
                    "intel471infostealeros": "Windows 11",
                    "intel471infostealerpcname": "DESKTOP-XYZ",
                    "intel471infostealerscreenshotpath": "screens/abc.png",
                    "intel471infostealerversion": "1.2.3"
                }
            }
        ]
    }
}

Human Readable Output

Indicators from Intel471 Credentials

Value	Type	fields
victim@example.com	Email	firstseenbysource: 2026-06-01T00:00:00Z lastseenbysource: 2026-06-20T00:00:00Z tags: lumma, my_employees intel471infostealermalwarefamily: lumma intel471infostealerip: 1.2.3.4, 5.6.7.8 intel471infostealeros: Windows 11 intel471infostealerpcname: DESKTOP-XYZ intel471infostealerversion: 1.2.3