SpyCloud

With the SpyCloud integration data from breaches can be pulled and further processed in Playbooks. Filtering parameters can be used to filter the data set.

Analytics & SIEM · SpyCloud

Details

IDSpyCloud
ProviderSpyCloud
CategoryAnalytics & SIEM
From Version6.2.0
Docker Imagedemisto/python3:3.12.8.3296088
Supported ModulesAgentix XSIAM

README

With the SpyCloud integration, data from breaches can be pulled and further processed in Playbooks. Filtering parameters can be used to filter the data set
This integration was integrated and tested with version 2 of SpyCloud

Configure SpyCloud in Cortex

Parameter Required
Base URL of SpyCloud True
API Key of SpyCloud True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

spycloud-list-breaches

Lists the breaches identified. By default this lists all breaches known in Spycloud. With the arguments it’s possible to scope the results on date and keywords.

Base Command

spycloud-list-breaches

Input

Argument Name Description Required
query Give a keyword to search for in the dataset. Default is empty. Optional
since Search the dataset since this date. Format is yyyy-mm-dd and default value is 2010-01-01. Default is 2010-01-01. Optional
until Search the dataset until this date. Format is yyyy-mm-dd and default value is 2100-01-01 (aka get everything). Default is 2100-01-01. Optional

Context Output

Path Type Description
SpyCloud.Breaches.uuid String unique ID
SpyCloud.Breaches.title String Breach title
SpyCloud.Breaches.type String Type of breach
SpyCloud.Breaches.description String Summary of the breach/threat
SpyCloud.Breaches.acquisition_date Date When the breach data was acquired
SpyCloud.Breaches.site String The website that was breached
SpyCloud.Breaches.spycloud_publish_date Date Publication date
SpyCloud.Breaches.num_records Number Number of records in the breach
SpyCloud.Breaches.id Number Unique breach ID

Command example


#### Context Example

```json
{
    "SpyCloud": {
        "Breaches": [
            {
                "acquisition_date": "2021-01-22T00:00:00Z",
                "description": "In x time, site Y was breached",
                "id": 11111,
                "num_records": 45810,
                "site": "examplers.com",
                "spycloud_publish_date": "2021-05-19T00:00:00Z",
                "title": "Cool title",
                "type": "PRIVATE",
                "uuid": "1111111-2222-34567-aaaa-9282829dddde"
            },
        ]
    }
}

Human Readable Output

Results

acquisition_date description id num_records site spycloud_publish_date title type uuid
2021-05-19T00:00:00Z In x time, site Y was breached 35911 45810 examplers.com 2022-05-19T00:00:00Z Cool title PRIVATE 1111111-2222-34567-aaaa-9282829dddde

spycloud-get-breach-data

Retrieves the breach details. While very similar to list-breaches, this command obtains one specific breach, which is easier for automation tasks

Base Command

spycloud-get-breach-data

Input

Argument Name Description Required
id The breach ID to filter on. Required

Context Output

Path Type Description
SpyCloud.Breaches.uuid String Unique ID
SpyCloud.Breaches.title String Breach title
SpyCloud.Breaches.type String Type of breach
SpyCloud.Breaches.description String Summary of the breach
SpyCloud.Breaches.acquisition_date Date Acquired date
SpyCloud.Breaches.site String Title of the breach
SpyCloud.Breaches.spycloud_publish_date Date Publication date
SpyCloud.Breaches.num_records Number Number of records in breach
SpyCloud.Breaches.id Number Unique breach ID

Command example

!spycloud-get-breach-data id=37666

Context Example

{
    "SpyCloud": {
        "Breaches": {
            "acquisition_date": "2020-05-13T00:00:00Z",
            "description": "Cool description of the threat",
            "id": 37666,
            "num_records": 802751,
            "site": "n/a",
            "spycloud_publish_date": "2021-05-18T00:00:00Z",
            "title": "Cool title",
            "type": "PRIVATE",
            "uuid": "11111111-2222-3333-4444-555555555555"
        }
    }
}

Human Readable Output

Results

acquisition_date description id num_records site spycloud_publish_date title type uuid
2021-05-13T00:00:00Z Cool description of the threat 37666 802751 n/a 2021-05-18T00:00:00Z Cool title PRIVATE 11111111-2222-3333-44444444444444444

spycloud-domain-data

Get all the data from a monitored domain and the breaches occurred that relates with it. Can be scoped by domain, type and severity

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

spycloud-domain-data

Input

Argument Name Description Required
domain The domain to search for in the data. Required
type Allowed values: corporate, infected. Default is corporate. Infected returns the infected employees and customers. Default is corporate. Optional
severity Allowed values: 2, 5, 10, 15, 20, 25. Default is 2. Default is 2. Optional
since The starting point for a date range query on the spycloud_publish_date. The value provided must follow the standard ISO 8601 date format (yyyy-mm-dd). Required

Context Output

Path Type Description
SpyCloud.Domain.document_id String The unique ID of the identified record
SpyCloud.Domain.spycloud_publish_date Date The date SpyCloud has found the data record
SpyCloud.Domain.username String The username that was found in the breach dataset
SpyCloud.Domain.email String The email that was found in the breach dataset
SpyCloud.Domain.infected_time String The date the user got infected
SpyCloud.Domain.target_url String Which URL the credentials are for
SpyCloud.Domain.source_id String breach source ID
SpyCloud.Domain.password_plaintext String Plaintext password identified

Command example

!spycloud-domain-data domain=example.com since=2022-05-01

Context Example

{
    "SpyCloud": {
        "Results": [
            {
                "document_id": "11111111-2222-3333-4444-555555555555",
                "email": "sales@example.com",
                "infected_time": "empty",
                "password_plaintext": "empty",
                "source_id": 37666,
                "spycloud_publish_date": "2021-01-12T00:00:00Z",
                "target_domain": "empty",
                "username": "empty"
            },
            {
                "document_id": "11111111-2222-3333-4444-555555555555",
                "email": "support@example.com",
                "infected_time": "empty",
                "password_plaintext": "empty",
                "source_id": 37666,
                "spycloud_publish_date": "2022-01-12T00:00:00Z",
                "target_domain": "empty",
                "username": "empty"
            }
        ]
    }
}

Human Readable Output

Results

document_id email infected_time password_plaintext source_id spycloud_publish_date target_domain username
11111111-2222-3333-4444-555555555555 sales@example.com empty empty 37518 2022-01-12T00:00:00Z empty empty
11111111-2222-3333-4444-555555555555 support@example.com empty empty 37518 2022-01-12T00:00:00Z empty empty

spycloud-email-data

Get all the data from a monitored email address and the breaches occurred that relates with it. Can be scoped by date, severity and breach

Base Command

spycloud-email-data

Input

Argument Name Description Required
emailaddr Email address to search for. Required
severity Allowed values: 2, 5, 10, 15, 20, 25. Default is 2. Default is 2. Optional
breach_id The breach ID to search in. Default is empty. Optional
since The starting point for a date range query on the spycloud_publish_date. The value provided must follow the standard ISO 8601 date format (yyyy-mm-dd). Required
until The until date for a date range query on the spycloud_publish_date. The value provided must follow the standard ISO 8601 date format (yyyy-mm-dd). Default is 2100-01-01. Optional

Context Output

Path Type Description
SpyCloud.Emails.document_id String The unique ID of the identified record
SpyCloud.Emails.spycloud_publish_date Date The date SpyCloud has found the data record
SpyCloud.Emails.username String The username that was found in the breach dataset
SpyCloud.Emails.email String The email that was found in the breach dataset
SpyCloud.Emails.source_id String breach source ID
SpyCloud.Emails.domain String The domain that the user/pass is used on
SpyCloud.Emails.password String Password found. Can be plaintext or hashed, good to check
SpyCloud.Emails.user_browser String The browser of the user
SpyCloud.Emails.target_url String The target url of the credentials

Command example

!spycloud-email-data emailaddr=john.doe@example.com since=2020-08-01 until=2021-02-01

Context Example

{
    "SpyCloud": {
        "Emails": [
            {
                "document_id": "11111111-2222-3333-4444-555555555555",
                "domain": "example.com",
                "email": "john.doe@example.com",
                "password": "empty",
                "source_id": 38666,
                "spycloud_publish_date": "2021-10-21T00:00:00Z",
                "target_url": "empty",
                "user_browser": "empty",
                "username": "empty"
            }
        ]
    }
}

Human Readable Output

Results

document_id domain email password source_id spycloud_publish_date target_url user_browser username
11111111-2222-3333-4444-555555555555 example.com john.doe@example.com empty 38666 2021-10-21T00:00:00Z empty empty empty

spycloud-watchlist-data

Get all the data from a watchlist.

Base Command

spycloud-watchlist-data

Input

Argument Name Description Required
watchlist_type Allowed values are ip, domain, email. Required
type Allowed values: corporate or infected. Default is corporate. Default is corporate. Optional
breach_id The breach ID to search in. Default is empty. Optional
since The starting point for a date range query on the spycloud_publish_date. The value provided must follow the standard ISO 8601 date format (yyyy-mm-dd). Required
until The until date for a date range query on the spycloud_publish_date. The value provided must follow the standard ISO 8601 date format (yyyy-mm-dd). Default is 2100-01-01. Optional

Context Output

Path Type Description
SpyCloud.Watchlist.document_id String The unique ID of the identified record
SpyCloud.Watchlist.username String The username of the identified record
SpyCloud.Watchlist.target_url String The targeted url
SpyCloud.Watchlist.breach_id String The breach ID
SpyCloud.Watchlist.password String The password of the user being exposed
SpyCloud.Watchlist.spycloud_publish_date’ String Date when Spycloud published the breach
SpyCloud.Watchlist.email String The email address involved (if email watchlist type selected)
SpyCloud.Watchlist.domain String The domain involved of the watchlist (if that type is selected)

Command example

!spycloud-watchlist-data watchlist_type=email since=2022-02-11

Context Example

{
    "SpyCloud": {
        "Watchlist": {
            "breach_id": 38666,
            "document_id": "11111111-2222-3333-4444-555555555555",
            "domain": "hotmail.com",
            "email": "john.doe@hotmail.com",
            "password": "empty",
            "spycloud_publish_date": "2020-03-03T00:00:00Z",
            "target_url": "empty",
            "username": "empty"
        }
    }
}

Human Readable Output

Results

breach_id document_id domain email password spycloud_publish_date target_url username
38666 11111111-2222-3333-4444-555555555555 hotmail.com john.doe@hotmail.com empty 2020-03-03T00:00:00Z empty empty

Configuration parameters

  • url — Base URL of SpyCloud (required)
  • apikey — API Key of SpyCloud (required)

Commands (5)

  • spycloud-domain-data

    Get all the data from a monitored domain and the breaches occurred that relates with it. Can be scoped by domain, type and severity

  • spycloud-email-data

    Get all the data from a monitored email address and the breaches occurred that relates with it. Can be scoped by date, severity and breach

  • spycloud-get-breach-data

    Retrieves the breach details. While very similar to list-breaches, this command obtains one specific breach, which is easier for automation tasks

  • spycloud-list-breaches

    Lists the breaches identified. By default this lists all breaches known in Spycloud. With the arguments it's possible to scope the results on date and keywords.

  • spycloud-watchlist-data

    Get all the data from a watchlist.

Source

SpyCloud.py SpyCloud.yml SpyCloud_description.md
Download History Raw 
category: Analytics & SIEM
provider: SpyCloud
commonfields:
  id: SpyCloud
  version: -1
configuration:
- display: Base URL of SpyCloud
  name: url
  required: true
  type: 0
- display: API Key of SpyCloud
  name: apikey
  required: true
  type: 4
description: With the SpyCloud integration data from breaches can be pulled and further processed in Playbooks. Filtering parameters can be used to filter the data set.
display: SpyCloud
name: SpyCloud
script:
  commands:
  - arguments:
    - name: query
      defaultValue: empty
      description: Give a keyword to search for in the dataset.
    - name: since
      defaultValue: '2010-01-01'
      description: Search the dataset since this date. Format is yyyy-mm-dd and default value is 2010-01-01.
    - name: until
      defaultValue: '2100-01-01'
      description: Search the dataset until this date. Format is yyyy-mm-dd and default value is 2100-01-01 (aka get everything).
    description: Lists the breaches identified. By default this lists all breaches known in Spycloud. With the arguments it's possible to scope the results on date and keywords.
    name: spycloud-list-breaches
    outputs:
    - contextPath: SpyCloud.Breaches.uuid
      description: unique ID.
      type: String
    - contextPath: SpyCloud.Breaches.title
      description: Breach title.
      type: String
    - contextPath: SpyCloud.Breaches.type
      description: Type of breach.
      type: String
    - contextPath: SpyCloud.Breaches.description
      description: Summary of the breach/threat.
      type: String
    - contextPath: SpyCloud.Breaches.acquisition_date
      description: When the breach data was acquired.
      type: Date
    - contextPath: SpyCloud.Breaches.site
      description: The website that was breached.
      type: String
    - contextPath: SpyCloud.Breaches.spycloud_publish_date
      description: Publication date.
      type: Date
    - contextPath: SpyCloud.Breaches.num_records
      description: Number of records in the breach.
      type: Number
    - contextPath: SpyCloud.Breaches.id
      description: Unique breach ID.
      type: Number
  - arguments:
    - name: id
      required: true
      description: The breach ID to filter on.
    description: Retrieves the breach details. While very similar to list-breaches, this command obtains one specific breach, which is easier for automation tasks
    name: spycloud-get-breach-data
    outputs:
    - contextPath: SpyCloud.Breaches.uuid
      description: Unique ID.
      type: String
    - contextPath: SpyCloud.Breaches.title
      description: Breach title.
      type: String
    - contextPath: SpyCloud.Breaches.type
      description: Type of breach.
      type: String
    - contextPath: SpyCloud.Breaches.description
      description: Summary of the breach.
      type: String
    - contextPath: SpyCloud.Breaches.acquisition_date
      description: Acquired date.
      type: Date
    - contextPath: SpyCloud.Breaches.site
      description: Title of the breach.
      type: String
    - contextPath: SpyCloud.Breaches.spycloud_publish_date
      description: Publication date.
      type: Date
    - contextPath: SpyCloud.Breaches.num_records
      description: Number of records in breach.
      type: Number
    - contextPath: SpyCloud.Breaches.id
      description: Unique breach ID.
      type: Number
  - arguments:
    - name: domain
      required: true
      description: The domain to search for in the data.
    - defaultValue: corporate
      description: 'Allowed values: corporate, infected. Default is corporate. Infected returns the infected employees and customers.'
      name: type
    - defaultValue: '2'
      description: 'Allowed values: 2, 5, 10, 15, 20, 25. Default is 2.'
      name: severity
    - description: The starting point for a date range query on the spycloud_publish_date. The value provided must follow the standard ISO 8601 date format (yyyy-mm-dd).
      name: since
      required: true
    description: Get all the data from a monitored domain and the breaches occurred that relates with it. Can be scoped by domain, type and severity
    name: spycloud-domain-data
    outputs:
    - contextPath: SpyCloud.Domain.document_id
      description: The unique ID of the identified record.
      type: String
    - contextPath: SpyCloud.Domain.spycloud_publish_date
      description: The date SpyCloud has found the data record.
      type: Date
    - contextPath: SpyCloud.Domain.username
      description: The username that was found in the breach dataset.
      type: String
    - contextPath: SpyCloud.Domain.email
      description: The email that was found in the breach dataset.
      type: String
    - contextPath: SpyCloud.Domain.infected_time
      description: The date the user got infected.
      type: String
    - contextPath: SpyCloud.Domain.target_url
      description: Which URL the credentials are for.
      type: String
    - contextPath: SpyCloud.Domain.source_id
      description: breach source ID.
      type: String
    - contextPath: SpyCloud.Domain.password_plaintext
      description: Plaintext password identified.
      type: String
  - arguments:
    - name: emailaddr
      description: Email address to search for.
      required: true
    - defaultValue: '2'
      description: 'Allowed values: 2, 5, 10, 15, 20, 25. Default is 2.'
      name: severity
    - defaultValue: empty
      description: The breach ID to search in.
      name: breach_id
    - description: The starting point for a date range query on the spycloud_publish_date. The value provided must follow the standard ISO 8601 date format (yyyy-mm-dd).
      name: since
      required: true
    - description: The until date for a date range query on the spycloud_publish_date. The value provided must follow the standard ISO 8601 date format (yyyy-mm-dd).
      name: until
      defaultValue: '2100-01-01'
    description: Get all the data from a monitored email address and the breaches occurred that relates with it. Can be scoped by date, severity and breach
    name: spycloud-email-data
    outputs:
    - contextPath: SpyCloud.Emails.document_id
      description: The unique ID of the identified record.
      type: String
    - contextPath: SpyCloud.Emails.spycloud_publish_date
      description: The date SpyCloud has found the data record.
      type: Date
    - contextPath: SpyCloud.Emails.username
      description: The username that was found in the breach dataset.
      type: String
    - contextPath: SpyCloud.Emails.email
      description: The email that was found in the breach dataset.
      type: String
    - contextPath: SpyCloud.Emails.source_id
      description: breach source ID.
      type: String
    - contextPath: SpyCloud.Emails.domain
      description: The domain that the user/pass is used on.
      type: String
    - contextPath: SpyCloud.Emails.password
      description: Password found. Can be plaintext or hashed, good to check.
      type: String
    - contextPath: SpyCloud.Emails.user_browser
      description: The browser of the user.
      type: String
    - contextPath: SpyCloud.Emails.target_url
      description: The target url of the credentials.
      type: String
  - arguments:
    - name: watchlist_type
      required: true
      description: Allowed values are ip, domain, email.
    - defaultValue: corporate
      description: 'Allowed values: corporate or infected. Default is corporate.'
      name: type
    - defaultValue: empty
      description: The breach ID to search in.
      name: breach_id
    - description: The starting point for a date range query on the spycloud_publish_date. The value provided must follow the standard ISO 8601 date format (yyyy-mm-dd).
      name: since
      required: true
    - description: The until date for a date range query on the spycloud_publish_date. The value provided must follow the standard ISO 8601 date format (yyyy-mm-dd).
      name: until
      defaultValue: '2100-01-01'
    description: Get all the data from a watchlist.
    name: spycloud-watchlist-data
    outputs:
    - contextPath: SpyCloud.Watchlist.document_id
      description: The unique ID of the identified record.
      type: String
    - contextPath: SpyCloud.Watchlist.username
      description: The username of the identified record.
      type: String
    - contextPath: SpyCloud.Watchlist.target_url
      description: The targeted url.
      type: String
    - contextPath: SpyCloud.Watchlist.breach_id
      description: The breach ID.
      type: String
    - contextPath: SpyCloud.Watchlist.password
      description: The password of the user being exposed.
      type: String
    - contextPath: SpyCloud.Watchlist.spycloud_publish_date'
      description: Date when Spycloud published the breach.
      type: String
    - contextPath: SpyCloud.Watchlist.email
      description: The email address involved (if email watchlist type selected).
      type: String
    - contextPath: SpyCloud.Watchlist.domain
      description: The domain involved of the watchlist (if that type is selected).
      type: String
  dockerimage: demisto/python3:3.12.8.3296088
  runonce: false
  script: ''
  subtype: python3
  type: python
fromversion: 6.2.0
tests:
- No tests (auto formatted)