USTA Stolen Credit Cards

Details

ID	`USTA Stolen Credit Cards`
Provider	PRODAFT
Category	Data Enrichment & Threat Intelligence
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

This integration offers organizations the ability to track stolen credit card data across the web, providing comprehensive insight into compromised card information sourced from underground markets, dark web forums, and other malicious platforms.

Configure USTAv4 Stolen Credit Cards in Cortex

Navigate to Settings > Integrations > Servers & Services.
Search for USTAv4 Stolen Credit Cards.

Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
Your server URL		True
API Key	The API Key to use for connection	True
Fetch incidents by status		False
Trust any certificate (not secure)		False
Use system proxy settings		False
Fetch incidents		False
First Fetch Time	The time range to consider for the initial data fetch. Warning: Fetching a large time range may cause performance issues!	True

Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

usta-scc-search

Search for stolen credit card number

Base Command

usta-scc-search

Input

Argument Name	Description	Required
card_number	Credit card number to search.	Required
page_size	Number of vendors that should appear on each page. Each page of data will have at most this many vendors.	Optional
page	1-indexed page number to get a particular page of results.	Optional

Context Output

Path	Type	Description
USTA.StolenCreditCards.id	Number	The ticket ID of the alert
USTA.StolenCreditCards.card_number	String	The stolen credit card number
USTA.StolenCreditCards.expire	String	The expiration date of the stolen credit card
USTA.StolenCreditCards.created	String	The creation date of the stolen credit card

Command Example

!usta-scc-search card_number=133713371337 page=1 page_size=1

Context Example

{
    "USTA" : {
        "StolenCreditCards": {
            "id": 133737,
            "card_number": "133713371337",
            "expire": "06/31",
            "created": "2024-11-19T07:42:01.388163Z"
        }
    }
}

Configuration parameters

url — Your server URL (required)
api_key — API Key (required)
status — Fetch incidents by status
max_fetch — Maximum number of alerts per fetch
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
isFetch — Fetch incidents
incidentFetchInterval — Incidents Fetch Interval
incidentType — Incident type
first_fetch — First Fetch Time (required)

Commands (1)

usta-scc-search
Search for stolen credit card number.

Source

USTAStolenCreditCards.py USTAStolenCreditCards_test.py USTAStolenCreditCards.yml USTAStolenCreditCards_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: PRODAFT
sectionorder:
- Connect
- Collect
commonfields:
  id: USTA Stolen Credit Cards
  version: -1
configuration:
- defaultvalue: https://usta.prodaft.com/
  display: Your server URL
  name: url
  required: true
  type: 0
  section: Connect
- display: API Key
  additionalinfo: The API Key to use for connection
  name: api_key
  required: true
  type: 4
  section: Connect
- display: Fetch incidents by status
  defaultvalue: All
  name: status
  options:
  - All
  - Open
  - Closed
  type: 15
  required: false
  section: Collect
- defaultvalue: '100'
  display: Maximum number of alerts per fetch
  name: max_fetch
  type: 0
  section: Collect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  required: false
  section: Collect
  advanced: true
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- display: First Fetch Time
  additionalinfo: 'The time range to consider for the initial data fetch. Warning: Fetching a large time range may cause performance issues!'
  defaultvalue: 3 days
  name: first_fetch
  type: 0
  required: true
  section: Collect
description: 'This integration offers organizations the ability to track stolen credit card data across the web, providing comprehensive insight into compromised card information sourced from underground markets, dark web forums, and other malicious platforms.'
display: USTAv4 Stolen Credit Cards
name: USTA Stolen Credit Cards
defaultclassifier: USTA Incident Classifier
defaultmapperin: USTA Incident Mapper
defaultmapperout: 'null'
script:
  commands:
  - arguments:
    - description: 'Credit card number to search.'
      name: card_number
      required: true
    - description: Number of vendors that should appear on each page. Each page of data will have at most this many vendors.
      name: page_size
    - description: 1-indexed page number to get a particular page of results.
      name: page
    description: 'Search for stolen credit card number.'
    name: usta-scc-search
    outputs:
    - contextPath: USTA.StolenCreditCards.id
      description: The alert ID of the alert.
      type: Number
    - contextPath: USTA.StolenCreditCards.card_number
      description: The stolen credit card number.
      type: String
    - contextPath: USTA.StolenCreditCards.expire
      description: The expiration date of the stolen credit card.
      type: String
    - contextPath: USTA.StolenCreditCards.created
      description: The creation date of the stolen credit card.
      type: String
  isfetch: true
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.10.0
tests:
- No tests (auto formatted)