Email Address Enrichment - Generic v2

Deprecated. Use "Email Address Enrichment - Generic v2.1" playbook instead. Enrich email addresses. Email address enrichment involves: - Getting information from Active Directory for internal addresses - Getting the domain-squatting reputation for external addresses

Pack

DeprecatedContent

Tasks

13

Inputs

• InternalDomains — A CSV list of internal domains. The list will be used to determine whether an email address is internal or external.
• Email — The email addresses to enrich.
• Domain — The domains associated with the incident.

Outputs

• Account — The Account object.
• Account.Email.Address — The email account full address.
• Account.Groups — The groups the account belongs to.
• Account.Email.Domain — The email account domain.
• Account.Email.NetworkType — The email account NetworkType (Internal/External).
• Account.Type — Account entity type.
• Account.Email.Username — The email account username.
• Account.ID — The unique account DN (Distinguished Name).
• Account.DisplayName — The account display name.
• Account.Manager — The account's manager.
• Account.Email.Distance.Domain — The compared domain.
• Account.Email.Distance.Value — The distance between the email domain and the compared domain.
• DBotScore.Indicator — The indicator.
• DBotScore — The DBotScore object.
• DBotScore.Type — The indicator type.
• DBotScore.Vendor — The DBot score vendor.
• DBotScore.Score — The DBot score.