Check Point - Credential Leak Validation and Response
Validates and responds to leaked employee or customer credentials reported by Cyberint Argos. The playbook looks up leaked credentials for the configured company domain (or, when no domain is configured, uses the exposed credentials embedded in the triggering Cyberint alert), escalates the incident when exposed credentials are found, and drives an automated or semi-automated remediation flow (reset sessions, force password reset, or disable the account in the identity provider), followed by user and SOC notification. Identity-provider validation and remediation steps are modeled as manual tasks so the playbook works out of the box; connect them to your Active Directory, Microsoft Entra ID or Okta integration to fully automate the response.
- Pack
- Cyberint
- Tasks
- 19
Inputs
- CompanyDomain — The company domain to look up leaked credentials for. Expected format: registered domain (no scheme, no path), e.g. ``example.com`` or ``acme.co``. When left empty, the playbook falls back to the exposed credentials embedded in the triggering Cyberint alert.
- LastSeenFrom — Only validate credentials last seen on or after this ISO-8601 date. Expected format: ``YYYY-MM-DDTHH:MM:SSZ``, e.g. ``2026-05-01T00:00:00Z``. Use this when running the playbook on a recurring schedule to process only newly leaked credentials.
- Limit — Maximum number of leaked credential records to retrieve per credential type (employee/customer). Accepts a positive integer, e.g. ``100``.
- AutoRemediate — Whether to remediate exposed accounts automatically (``yes``) or to require analyst review and approval first (``no``). Default is ``no``.
Outputs
- Cyberint.LeakedCredential — The leaked credentials returned by the Cyberint lookup, split into employee and customer records, each with username, exposure entries and first/last-seen dates.
Commands used
- cyberint-credential-leak-lookup
- setIncident