QintelQWatch

Qintel's QWatch system contains credentials obtained from dump sites, hacker collaboratives, and command and control infrastructures of eCrime- and APT-related malware. With this integration, users can fetch exposure alerts as incidents and discover exposed credentials associated with their organization.

Data Enrichment & Threat Intelligence · Qintel

Details

IDQintelQWatch
ProviderQintel
CategoryData Enrichment & Threat Intelligence
From Version6.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Qintel’s QWatch system contains credentials obtained from dump sites, hacker collaboratives, and command and control infrastructures of eCrime- and APT-related malware. With this integration, users can fetch exposure alerts as incidents and discover exposed credentials associated with their organization.
This integration was integrated and tested with version 1.1.6 of QWatch

Configure QintelQWatch in Cortex

Parameter Required
QWatch API URL (optional) False
Qintel Credentials True
Password True
Trust any certificate (not secure) False
Use system proxy settings False
Fetch incidents False
Fetch plaintext passwords False
Limit number of records per fetch False
First fetch time False
Incidents Fetch Interval False
Default Incident Severity True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

qintel-qwatch-exposures

Search QWatch for exposed credentials

Base Command

qintel-qwatch-exposures

Input

Argument Name Description Required
email Email to search. Optional
domain Domain to search. Optional

Context Output

Path Type Description
Qintel.QWatch.Exposures String QWatch Exposure Records

Command Example

!qintel-qwatch-exposures email=test@example.local

Context Example

{
    "Qintel": {
        "QWatch": {
            "Exposures": [
                {
                    "email": "test@example.local",
                    "firstseen": "2020-03-25 09:38:40",
                    "lastseen": "2021-02-05 04:35:33",
                    "loaded": "2021-02-05 04:35:33",
                    "password": "SuperSecretPassword",
                    "source": "combo-BigComboList"
                },
                {
                    "email": "test@example.local",
                    "firstseen": "2020-03-25 09:38:40",
                    "lastseen": "2021-02-05 04:35:33",
                    "loaded": "2020-08-10 02:10:11",
                    "password": "SuperSecretPassword",
                    "source": "dump-example.local"
                },
                {
                    "email": "test@example.local",
                    "firstseen": "2020-03-25 09:38:40",
                    "lastseen": "2021-02-05 04:35:33",
                    "loaded": "2020-03-25 09:38:40",
                    "password": "SuperSecretPassword",
                    "source": "malware-evilbot_March_22_2020"
                }
            ]
        }
    }
}

Human Readable Output

Qintel QWatch exposures for: test@example.local

Email Password Source Loaded First Seen Last Seen
test@example.local SuperSecretPassword combo-BigComboList 2021-02-05 04:35:33 2020-03-25 09:38:40 2021-02-05 04:35:33
test@example.local SuperSecretPassword dump-example.local 2020-08-10 02:10:11 2020-03-25 09:38:40 2021-02-05 04:35:33
test@example.local SuperSecretPassword malware-evilbot_March_22_2020 2020-03-25 09:38:40 2020-03-25 09:38:40 2021-02-05 04:35:33

Configuration parameters

  • remote — QWatch API URL (optional)
  • credentials — Qintel Credentials (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • fetch_passwords — Fetch plaintext passwords
  • max_fetch — Limit number of records per fetch
  • first_fetch — First fetch time
  • incidentFetchInterval — Incidents Fetch Interval
  • fetch_severity — Default Incident Severity (required)
  • incidentType — Incident type

Commands (1)

  • qintel-qwatch-exposures

    Search QWatch for exposed credentials.

Source

QintelQWatch.py QintelQWatch_test.py QintelQWatch.yml QintelQWatch_description.md
Download History Raw 
## QintelQWatch Help

To configure an instance of this integration in Cortex XSOAR, you will need to supply your Crosslink Client ID and Client Secret. Refer to the [Integrations Getting Started Page](https://docs.qintel.com/integrations/overview) for details on how to retrieve these tokens.

### Base Setup

Specify the following to configure this instance:

1. Enter your **Client ID** for **Qintel Credentials**
2. Enter your **Client Secret** for **Password**
3. (Optional) Enter a custom QWatch API URL

### Fetch Incidents Setup

To enable fetching of QWatch alerts, configure the following:

1. Select the **Fetch Incidents** radio button
2. (Optional) Set the **Limit number of records per fetch** field which controls how many exposure records will be retrieve for each alert (max: 10000)
3. (Optional) Set the **First fetch time** field which controls how far back the integration looks for alerts the first time it runs. This must be expressed as a date string such as "10 days", "1 year". (default: 3 days, max: 90 days)
4. (Optional) Set the **Incident Fetch Interval** which controls how often XSOAR fetches alerts. It is recommended that the default setting of **6 hours** be used.
5. (Optional) Set the **Default Incident Severity** which controls the base severity for incidents created from QWatch alerts.