QintelQWatch
Qintel's QWatch system contains credentials obtained from dump sites, hacker collaboratives, and command and control infrastructures of eCrime- and APT-related malware. With this integration, users can fetch exposure alerts as incidents and discover exposed credentials associated with their organization.
Data Enrichment & Threat Intelligence · Qintel
Details
| ID | QintelQWatch |
|---|---|
| Provider | Qintel |
| Category | Data Enrichment & Threat Intelligence |
| From Version | 6.0.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
| Supported Modules | Agentix XSIAM |
README
Qintel’s QWatch system contains credentials obtained from dump sites, hacker collaboratives, and command and control infrastructures of eCrime- and APT-related malware. With this integration, users can fetch exposure alerts as incidents and discover exposed credentials associated with their organization.
This integration was integrated and tested with version 1.1.6 of QWatch
Configure QintelQWatch in Cortex
| Parameter | Required |
|---|---|
| QWatch API URL (optional) | False |
| Qintel Credentials | True |
| Password | True |
| Trust any certificate (not secure) | False |
| Use system proxy settings | False |
| Fetch incidents | False |
| Fetch plaintext passwords | False |
| Limit number of records per fetch | False |
| First fetch time | False |
| Incidents Fetch Interval | False |
| Default Incident Severity | True |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
qintel-qwatch-exposures
Search QWatch for exposed credentials
Base Command
qintel-qwatch-exposures
Input
| Argument Name | Description | Required |
|---|---|---|
| Email to search. | Optional | |
| domain | Domain to search. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Qintel.QWatch.Exposures | String | QWatch Exposure Records |
Command Example
!qintel-qwatch-exposures email=test@example.local
Context Example
{
"Qintel": {
"QWatch": {
"Exposures": [
{
"email": "test@example.local",
"firstseen": "2020-03-25 09:38:40",
"lastseen": "2021-02-05 04:35:33",
"loaded": "2021-02-05 04:35:33",
"password": "SuperSecretPassword",
"source": "combo-BigComboList"
},
{
"email": "test@example.local",
"firstseen": "2020-03-25 09:38:40",
"lastseen": "2021-02-05 04:35:33",
"loaded": "2020-08-10 02:10:11",
"password": "SuperSecretPassword",
"source": "dump-example.local"
},
{
"email": "test@example.local",
"firstseen": "2020-03-25 09:38:40",
"lastseen": "2021-02-05 04:35:33",
"loaded": "2020-03-25 09:38:40",
"password": "SuperSecretPassword",
"source": "malware-evilbot_March_22_2020"
}
]
}
}
}
Human Readable Output
Qintel QWatch exposures for: test@example.local
Password Source Loaded First Seen Last Seen test@example.local SuperSecretPassword combo-BigComboList 2021-02-05 04:35:33 2020-03-25 09:38:40 2021-02-05 04:35:33 test@example.local SuperSecretPassword dump-example.local 2020-08-10 02:10:11 2020-03-25 09:38:40 2021-02-05 04:35:33 test@example.local SuperSecretPassword malware-evilbot_March_22_2020 2020-03-25 09:38:40 2020-03-25 09:38:40 2021-02-05 04:35:33
Configuration parameters
remote— QWatch API URL (optional)credentials— Qintel Credentials (required)insecure— Trust any certificate (not secure)proxy— Use system proxy settingsisFetch— Fetch incidentsfetch_passwords— Fetch plaintext passwordsmax_fetch— Limit number of records per fetchfirst_fetch— First fetch timeincidentFetchInterval— Incidents Fetch Intervalfetch_severity— Default Incident Severity (required)incidentType— Incident type
Commands (1)
-
qintel-qwatch-exposuresSearch QWatch for exposed credentials.
category: Data Enrichment & Threat Intelligence provider: Qintel commonfields: id: QintelQWatch version: -1 configuration: - display: QWatch API URL (optional) name: remote type: 0 required: false - display: Qintel Credentials name: credentials required: true type: 9 - display: Trust any certificate (not secure) name: insecure type: 8 required: false - display: Use system proxy settings name: proxy type: 8 required: false - display: Fetch incidents name: isFetch type: 8 required: false - display: Fetch plaintext passwords name: fetch_passwords type: 8 defaultvalue: 'true' required: false - display: Limit number of records per fetch name: max_fetch type: 0 defaultvalue: 10000 required: false - display: First fetch time name: first_fetch defaultvalue: 3 days type: 0 required: false - display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: "360" type: 19 required: false - display: Default Incident Severity name: fetch_severity defaultvalue: Medium type: 15 required: true options: - Unknown - Info - Low - Medium - High - Critical - display: Incident type name: incidentType type: 13 required: false description: "Qintel's QWatch system contains credentials obtained from dump sites, hacker collaboratives, and command and control infrastructures of eCrime- and APT-related malware. With this integration, users can fetch exposure alerts as incidents and discover exposed credentials associated with their organization." display: Qintel QWatch name: QintelQWatch script: commands: - arguments: - description: Email to search. name: email - description: Domain to search. name: domain description: Search QWatch for exposed credentials. name: qintel-qwatch-exposures outputs: - contextPath: Qintel.QWatch.Exposures description: QWatch Exposure Records. type: String isfetch: true script: '-' type: python subtype: python3 dockerimage: demisto/python3:3.12.13.10116658 fromversion: 6.0.0 tests: - No tests (auto formatted)