Pipl

Get contact, social, and professional information about people.

Data Enrichment & Threat Intelligence · Pipl

Details

IDPipl
ProviderPipl
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Supported ModulesAgentix XSIAM

README

Pipl provides a reputation for email addresses and identity solutions.

Configure Pipl in Cortex

Parameter Description Required
url Server URL (e.g., https://api.pipl.com/search/) True
key API Key False
credentials_api_key API Key False
insecure Trust any certificate (not secure) False
proxy Use system proxy settings False
Source Reliability Reliability of the source providing the intelligence data. False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

pipl-search


Search for required query

Base Command

pipl-search

Input

Argument Name Description Required
email Email address to search. Optional
phone Home/work/mobile phone number to search. Optional
username Username/screen-name to search. Minimum 4 characters. Optional
first-name First name to search. Minimum 2 characters. Optional
last-name Last name to search. Minimum 2 characters. Optional
middle-name Middle name or middle initial to search. Optional
raw-name Full name to search. Use this parameter if the accurate name parts (first/middle/last) are not available, this parameter will only be used in absence of first-name and last-name. Optional
country A two-letter country code to searchs. Optional
state A United States, Canada, Great Britain or Australia state code. If a US state is provided and no country specified, we’ll assume the country to be US. Optional
city City to search. Optional
zipcode ZIP code to search. Optional
raw-address Full address to search. Optional
age Age to search in String, an exact (YY) or approximate (YY-YY) age. Optional
columns Order of columns to be displayed in results (comma seperated list of values). Optional

Context Output

Path Type Description
Account.Email.Address unknown Email addresses
Account.IDs unknown User IDs
Account.Addresses unknown Addresses (geographic)
Account.Names unknown Full names
Account.Phones unknown Phone numbers
Account.Usernames unknown Online platforms usernames

email


Searches for information regarding given email address

Base Command

email

Input

Argument Name Description Required
email Email address to search for. Required

Context Output

Path Type Description
Account.Email.Address unknown Email addresses
Account.IDs unknown User IDs
Account.Addresses unknown Addresses (geographic)
Account.Names unknown Full names
Account.Phones unknown Phone numbers
Account.Usernames unknown Online platforms usernames
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The actual DBot score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Reliability String Reliability of the source providing the intelligence data.

Configuration parameters

  • url — Server URL (e.g. https://192.168.0.1)
  • key — API Key
  • credentials_api_key
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • integration_reliability — Source Reliability

Commands (2)

  • email

    Searches for information regarding given email address.

  • pipl-search

    Search for required query.

var url = params.url;
var columns;
if (params.columns) {
    columns = params.columns.split(',');
}

var sendRequest = function(args) {

    var requestUrl = url.replace(/[\/]+$/, '');

    var queryArgs = {};
    var argKeys = Object.keys(args);
    var key =  params.credentials_api_key ? params.credentials_api_key.password : params.key;
    if (!key) {
      return('API key must be provided.');
    }
    for (var i = 0; i < argKeys.length; i++) {
        queryArgs[argKeys[i].replace('-','_')] = args[argKeys[i]];
    }
    requestUrl += encodeToURLQuery(queryArgs);
    var res = http(
        requestUrl,
        {
            Method: 'POST',
            Headers: {
                'Content-Type': ['application/x-www-form-urlencoded']
            },
            Body: 'key=' + key
        },
        params.insecure,
        params.proxy
    );

    if (res.StatusCode < 200 || res.StatusCode >= 300) {
        throw 'Request Failed.\nStatus code: ' + res.StatusCode + '.\nBody: ' + JSON.stringify(res) + '.';
    }
    return JSON.parse(res.Body);
};

var createEntry = function(response) {
    var data = [];
    ec = {};
    ec.Account =[];
    //Only one person
    if (response.person) {
        data[0] = addPerson(response.person);
        ec.Account[0] = buildEC(data, 0);
        data[0]['Emails'] = '';
        for (var j = 0; j < data[0].Email.length; j++) {
            data[0]['Emails'] += data[0].Email[j].Address + '\n';
        }
        delete data[0].Email;
    } else {
    //More than one person
        for (var i = 0; i < response.possible_persons.length; i++) {
            data[i] = addPerson(response.possible_persons[i]);
            ec.Account[i] = buildEC(data, i);
            data[i]['Emails'] = '';
            for (var j = 0; j < data[i].Email.length; j++) {
                data[i]['Emails'] += data[i].Email[j].Address + '\n';
            }
            delete data[i].Email;
        }
    }
    return {
        Type: entryTypes.note,
        ContentsFormat: formats.table,
        Contents: data,
        ReadableContentsFormat: formats.table,
        HumanReadable: data,
        EntryContext: ec
    };
};


var createReputationEntry = function(response) {
    var data = [];
    ec = {};
    ec.Account =[];
    var reliability =  params.integration_reliability
    persons = if (response.person) ? [response.person] : response.possible_persons

    for (var i = 0; i < persons.length; i++) {
        data[i] = addPerson(persons[i]);
        ec.Account[i] = buildECReliability(data, i, reliability);
        data[i]['Emails'] = '';
        for (var j = 0; j < data[i].Email.length; j++) {
            data[i]['Emails'] += data[i].Email[j].Address + '\n';
        }
        delete data[i].Email;
    }

    return {
        Type: entryTypes.note,
        ContentsFormat: formats.table,
        Contents: data,
        ReadableContentsFormat: formats.table,
        HumanReadable: data,
        EntryContext: ec
    };
};

var email_command = function(args) {
    var emails = args.email.split(',')
    var results = new Array(emails.length)
    for (var i = 0; i < emails.length; i++) {
        args.email = emails[i]
        var response = sendRequest(args);
        results[i] = createReputationEntry(response)
    }
    return results;
}

var buildEC = function(data, i) {
    return {
        Addresses: data[i].Addresses,
        Email: data[i].Email,
        IDs: data[i].UserIDs,
        Names: data[i].Names,
        Phones: data[i].Phones,
        Usernames: data[i].Usernames
    };
};

var buildECReliability = function(data, i, reliability) {
    return {
        Addresses: data[i].Addresses,
        Email: data[i].Email,
        IDs: data[i].UserIDs,
        Names: data[i].Names,
        Phones: data[i].Phones,
        Usernames: data[i].Usernames,
        DbotScore: {
            Indicator: data[i].Email,
            Score: 0, // No score
            Vendor: 'pipl',
            Reliability: reliability
        }
    };
};

var addPerson = function(person) {
    var response = {
        Names: '',
        Phones: '',
        Gender: '',
        DoB: '',
        Image: '',
        Usernames: '',
        Email: '',
        Educations: '',
        UserIDs: '',
        URLs: '',
        Jobs: '',
        Addresses: ''
    };
    if (person.names) {
        for (var i = 0; i < person.names.length; i++) {
            response.Names += person.names[i].middle ? person.names[i].first + ' ' + person.names[i].middle + ' ' + person.names[i].last + '\n' : person.names[i].first + ' ' + person.names[i].last + '\n';
        }
    }
    if (person.phones) {
        for (var i = 0; i < person.phones.length; i++) {
            response.Phones += person.phones[i].display + ' ' + person.phones[i].display_international + '\n';
        }
    }
    if (person.gender){
        response.Gender = person.gender.content;
    }
    if (person.dob) {
        response.DoB = person.dob.display;
    }
    if (person.images) {
        var url='https://thumb.pipl.com/image?height=100&width=100&favicon=false&zoom_face=false&token='+person.images[0].thumbnail_token;
        response.Image ='__img__:src,'+ url +';alt,'+''+';height,100;width,100';

    }
    if (person.usernames) {
        for (var i = 0; i < person.usernames.length; i++) {
            response.Usernames += person.usernames[i].content + '\n';
        }
    }
    if (person.emails) {
        response.Email = [];
        for (var i = 0; i < person.emails.length; i++) {
            response.Email[i] = {Address:person.emails[i].address};
        }
    }
    if (person.educations) {
        for (var i = 0; i < person.educations.length; i++) {
            response.Educations += person.educations[i].display + '\n';
        }
    }
    if (person.user_ids) {
        for (var i = 0; i < person.user_ids.length; i++) {
            response.UserIDs += person.user_ids[i].content + '\n';
        }
    }
    if (person.urls) {
        for (var i = 0; i < person.urls.length; i++) {
            response.URLs += person.urls[i].url + '\n';
        }
    }
    if (person.jobs) {
        for (var i = 0; i < person.jobs.length; i++) {
            response.Jobs += person.jobs[i].display + '\n';
        }
    }
    if (person.addresses) {
        for (var i = 0; i < person.addresses.length; i++) {
            response.Addresses += person.addresses[i].display + '\n';
        }
    }
    response.provider = 'pipl';
    return response;
};

switch (command) {
    case 'test-module':
        var response = sendRequest({'first-name': 'clark', 'last-name': 'kent'});
        return 'ok';
    case 'pipl-search':
        if (Object.keys(args).length === 0) {
            return 'No arguments given.'
        }
        var response = sendRequest(args);
        return createEntry(response);
    case 'email':
        return email_command(args);
    default:

}