Pipl
Get contact, social, and professional information about people.
Data Enrichment & Threat Intelligence · Pipl
Details
| ID | Pipl |
|---|---|
| Provider | Pipl |
| Category | Data Enrichment & Threat Intelligence |
| From Version | 5.0.0 |
| Supported Modules | Agentix XSIAM |
README
Pipl provides a reputation for email addresses and identity solutions.
Configure Pipl in Cortex
| Parameter | Description | Required |
|---|---|---|
| url | Server URL (e.g., https://api.pipl.com/search/) | True |
| key | API Key | False |
| credentials_api_key | API Key | False |
| insecure | Trust any certificate (not secure) | False |
| proxy | Use system proxy settings | False |
| Source Reliability | Reliability of the source providing the intelligence data. | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
pipl-search
Search for required query
Base Command
pipl-search
Input
| Argument Name | Description | Required |
|---|---|---|
| Email address to search. | Optional | |
| phone | Home/work/mobile phone number to search. | Optional |
| username | Username/screen-name to search. Minimum 4 characters. | Optional |
| first-name | First name to search. Minimum 2 characters. | Optional |
| last-name | Last name to search. Minimum 2 characters. | Optional |
| middle-name | Middle name or middle initial to search. | Optional |
| raw-name | Full name to search. Use this parameter if the accurate name parts (first/middle/last) are not available, this parameter will only be used in absence of first-name and last-name. | Optional |
| country | A two-letter country code to searchs. | Optional |
| state | A United States, Canada, Great Britain or Australia state code. If a US state is provided and no country specified, we’ll assume the country to be US. | Optional |
| city | City to search. | Optional |
| zipcode | ZIP code to search. | Optional |
| raw-address | Full address to search. | Optional |
| age | Age to search in String, an exact (YY) or approximate (YY-YY) age. | Optional |
| columns | Order of columns to be displayed in results (comma seperated list of values). | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Account.Email.Address | unknown | Email addresses |
| Account.IDs | unknown | User IDs |
| Account.Addresses | unknown | Addresses (geographic) |
| Account.Names | unknown | Full names |
| Account.Phones | unknown | Phone numbers |
| Account.Usernames | unknown | Online platforms usernames |
Searches for information regarding given email address
Base Command
email
Input
| Argument Name | Description | Required |
|---|---|---|
| Email address to search for. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Account.Email.Address | unknown | Email addresses |
| Account.IDs | unknown | User IDs |
| Account.Addresses | unknown | Addresses (geographic) |
| Account.Names | unknown | Full names |
| Account.Phones | unknown | Phone numbers |
| Account.Usernames | unknown | Online platforms usernames |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Score | Number | The actual DBot score. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
| DBotScore.Reliability | String | Reliability of the source providing the intelligence data. |
Configuration parameters
url— Server URL (e.g. https://192.168.0.1)key— API Keycredentials_api_key—insecure— Trust any certificate (not secure)proxy— Use system proxy settingsintegration_reliability— Source Reliability
Commands (2)
-
emailSearches for information regarding given email address.
-
pipl-searchSearch for required query.
var url = params.url; var columns; if (params.columns) { columns = params.columns.split(','); } var sendRequest = function(args) { var requestUrl = url.replace(/[\/]+$/, ''); var queryArgs = {}; var argKeys = Object.keys(args); var key = params.credentials_api_key ? params.credentials_api_key.password : params.key; if (!key) { return('API key must be provided.'); } for (var i = 0; i < argKeys.length; i++) { queryArgs[argKeys[i].replace('-','_')] = args[argKeys[i]]; } requestUrl += encodeToURLQuery(queryArgs); var res = http( requestUrl, { Method: 'POST', Headers: { 'Content-Type': ['application/x-www-form-urlencoded'] }, Body: 'key=' + key }, params.insecure, params.proxy ); if (res.StatusCode < 200 || res.StatusCode >= 300) { throw 'Request Failed.\nStatus code: ' + res.StatusCode + '.\nBody: ' + JSON.stringify(res) + '.'; } return JSON.parse(res.Body); }; var createEntry = function(response) { var data = []; ec = {}; ec.Account =[]; //Only one person if (response.person) { data[0] = addPerson(response.person); ec.Account[0] = buildEC(data, 0); data[0]['Emails'] = ''; for (var j = 0; j < data[0].Email.length; j++) { data[0]['Emails'] += data[0].Email[j].Address + '\n'; } delete data[0].Email; } else { //More than one person for (var i = 0; i < response.possible_persons.length; i++) { data[i] = addPerson(response.possible_persons[i]); ec.Account[i] = buildEC(data, i); data[i]['Emails'] = ''; for (var j = 0; j < data[i].Email.length; j++) { data[i]['Emails'] += data[i].Email[j].Address + '\n'; } delete data[i].Email; } } return { Type: entryTypes.note, ContentsFormat: formats.table, Contents: data, ReadableContentsFormat: formats.table, HumanReadable: data, EntryContext: ec }; }; var createReputationEntry = function(response) { var data = []; ec = {}; ec.Account =[]; var reliability = params.integration_reliability persons = if (response.person) ? [response.person] : response.possible_persons for (var i = 0; i < persons.length; i++) { data[i] = addPerson(persons[i]); ec.Account[i] = buildECReliability(data, i, reliability); data[i]['Emails'] = ''; for (var j = 0; j < data[i].Email.length; j++) { data[i]['Emails'] += data[i].Email[j].Address + '\n'; } delete data[i].Email; } return { Type: entryTypes.note, ContentsFormat: formats.table, Contents: data, ReadableContentsFormat: formats.table, HumanReadable: data, EntryContext: ec }; }; var email_command = function(args) { var emails = args.email.split(',') var results = new Array(emails.length) for (var i = 0; i < emails.length; i++) { args.email = emails[i] var response = sendRequest(args); results[i] = createReputationEntry(response) } return results; } var buildEC = function(data, i) { return { Addresses: data[i].Addresses, Email: data[i].Email, IDs: data[i].UserIDs, Names: data[i].Names, Phones: data[i].Phones, Usernames: data[i].Usernames }; }; var buildECReliability = function(data, i, reliability) { return { Addresses: data[i].Addresses, Email: data[i].Email, IDs: data[i].UserIDs, Names: data[i].Names, Phones: data[i].Phones, Usernames: data[i].Usernames, DbotScore: { Indicator: data[i].Email, Score: 0, // No score Vendor: 'pipl', Reliability: reliability } }; }; var addPerson = function(person) { var response = { Names: '', Phones: '', Gender: '', DoB: '', Image: '', Usernames: '', Email: '', Educations: '', UserIDs: '', URLs: '', Jobs: '', Addresses: '' }; if (person.names) { for (var i = 0; i < person.names.length; i++) { response.Names += person.names[i].middle ? person.names[i].first + ' ' + person.names[i].middle + ' ' + person.names[i].last + '\n' : person.names[i].first + ' ' + person.names[i].last + '\n'; } } if (person.phones) { for (var i = 0; i < person.phones.length; i++) { response.Phones += person.phones[i].display + ' ' + person.phones[i].display_international + '\n'; } } if (person.gender){ response.Gender = person.gender.content; } if (person.dob) { response.DoB = person.dob.display; } if (person.images) { var url='https://thumb.pipl.com/image?height=100&width=100&favicon=false&zoom_face=false&token='+person.images[0].thumbnail_token; response.Image ='__img__:src,'+ url +';alt,'+''+';height,100;width,100'; } if (person.usernames) { for (var i = 0; i < person.usernames.length; i++) { response.Usernames += person.usernames[i].content + '\n'; } } if (person.emails) { response.Email = []; for (var i = 0; i < person.emails.length; i++) { response.Email[i] = {Address:person.emails[i].address}; } } if (person.educations) { for (var i = 0; i < person.educations.length; i++) { response.Educations += person.educations[i].display + '\n'; } } if (person.user_ids) { for (var i = 0; i < person.user_ids.length; i++) { response.UserIDs += person.user_ids[i].content + '\n'; } } if (person.urls) { for (var i = 0; i < person.urls.length; i++) { response.URLs += person.urls[i].url + '\n'; } } if (person.jobs) { for (var i = 0; i < person.jobs.length; i++) { response.Jobs += person.jobs[i].display + '\n'; } } if (person.addresses) { for (var i = 0; i < person.addresses.length; i++) { response.Addresses += person.addresses[i].display + '\n'; } } response.provider = 'pipl'; return response; }; switch (command) { case 'test-module': var response = sendRequest({'first-name': 'clark', 'last-name': 'kent'}); return 'ok'; case 'pipl-search': if (Object.keys(args).length === 0) { return 'No arguments given.' } var response = sendRequest(args); return createEntry(response); case 'email': return email_command(args); default: }