Email Address Enrichment - Generic v2.1

Enrich email addresses. - Get information from Active Directory for internal addresses - Get the domain-squatting reputation for external addresses - Email address reputation using !email command.

Pack

CommonPlaybooks

Tasks

17

Inputs

• InternalDomains — A CSV list of internal domains. The list will be used to determine whether an email address is internal or external.
• Email — The email addresses to enrich.
• Domain — The domains associated with the incident. These domains will be checked for domain-squatting.
• UseReputationCommand — Define if you would like to use the !email command. Note: This input should be used whenever there is no auto-extract enabled in the investigation flow. Possible values: True / False. The default value is false.

Outputs

• Account — The Account object.
• Account.Email.NetworkType — The email account NetworkType (Internal/External).
• Account.Email.Distance.Domain — The compared domain.
• Account.Email.Distance.Value — The distance between the email domain and the compared domain.
• DBotScore — The DBotScore object.
• Account.Email.Username — The Email account username.
• Account.Email.Domain — The Email account domain.
• ActiveDirectory.Users.dn — The user distinguished name.
• ActiveDirectory.Users.displayName — The user display name.
• ActiveDirectory.Users.name — The user common name.
• ActiveDirectory.Users.sAMAccountName — The user sAMAccountName.
• ActiveDirectory.Users.userAccountControl — The user account control flag.
• ActiveDirectory.Users.manager — The manager of the user.
• ActiveDirectory.Users.memberOf — Groups in which the user is a member.
• ActiveDirectory.Users.userAccountControlFields.SCRIPT — Whether the login script is run. Works for *Windows Server 2012 R2*.
• ActiveDirectory.Users.userAccountControlFields.ACCOUNTDISABLE — Whether the user account is disabled. Works for *Windows Server 2012 R2*.
• ActiveDirectory.Users.userAccountControlFields.HOMEDIR_REQUIRED — Whether the home folder is required. Works for *Windows Server 2012 R2*.
• ActiveDirectory.Users.userAccountControlFields.LOCKOUT — Whether the user is locked out. Works for *Windows Server 2012 R2*.
• ActiveDirectory.Users.userAccountControlFields.PASSWD_NOTREQD — Whether the password is required. Works for *Windows Server 2012 R2*.
• ActiveDirectory.Users.userAccountControlFields.PASSWD_CANT_CHANGE — Whether the user can change the password. Works for *Windows Server 2012 R2*.
• ActiveDirectory.Users.userAccountControlFields.ENCRYPTED_TEXT_PWD_ALLOWED — Whether the user can send an encrypted password. Works for *Windows Server 2012 R2*.
• ActiveDirectory.Users.userAccountControlFields.TEMP_DUPLICATE_ACCOUNT — Whether this is an account for users whose primary account is in another domain. Works for *Windows Server 2012 R2*.
• ActiveDirectory.Users.userAccountControlFields.NORMAL_ACCOUNT — Whether this is a default account type that represents a typical user. Works for *Windows Server 2012 R2*.
• ActiveDirectory.Users.userAccountControlFields.INTERDOMAIN_TRUST_ACCOUNT — Whether the account is permitted to trust a system domain that trusts other domains. Works for *Windows Server 2012 R2*.
• ActiveDirectory.Users.userAccountControlFields.WORKSTATION_TRUST_ACCOUNT — Whether this is a computer account for a computer running Microsoft Windows NT 4.0 Workstation, Microsoft Windows NT 4.0 Server, Microsoft Windows 2000 Professional, or Windows 2000 Server and is a member of this domain.
• ActiveDirectory.Users.userAccountControlFields.SERVER_TRUST_ACCOUNT — Whether this is a computer account for a domain controller that is a member of this domain. Works for *Windows Server 2012 R2*.
• ActiveDirectory.Users.userAccountControlFields.DONT_EXPIRE_PASSWORD — Whether to never expire the password on the account.
• ActiveDirectory.Users.userAccountControlFields.MNS_LOGON_ACCOUNT — Whether this is an MNS login account.
• ActiveDirectory.Users.userAccountControlFields.SMARTCARD_REQUIRED — Whether to force the user to log in by using a smart card.
• ActiveDirectory.Users.userAccountControlFields.TRUSTED_FOR_DELEGATION — Whether the service account (the user or computer account) under which a service runs is trusted for Kerberos delegation.
• ActiveDirectory.Users.userAccountControlFields.NOT_DELEGATED — Whether the security context of the user isn't delegated to a service even if the service account is set as trusted for Kerberos delegation.
• ActiveDirectory.Users.userAccountControlFields.USE_DES_KEY_ONLY — Whether to restrict this principal to use only Data Encryption Standard (DES) encryption types for keys.
• ActiveDirectory.Users.userAccountControlFields.DONT_REQ_PREAUTH — Whether this account require Kerberos pre-authentication for logging on.
• ActiveDirectory.Users.userAccountControlFields.PASSWORD_EXPIRED — Whether the user password expired.
• ActiveDirectory.Users.userAccountControlFields.TRUSTED_TO_AUTH_FOR_DELEGATION — Whether the account is enabled for delegation.
• ActiveDirectory.Users.userAccountControlFields.PARTIAL_SECRETS_ACCOUNT — Whether the account is a read-only domain controller (RODC).
• ActiveDirectory.UsersPageCookie — An opaque string received in a paged search, used for requesting subsequent entries.
• Account.DisplayName — The user display name.
• Account.Groups — Groups for which the user is a member.
• Account.Manager — The user manager.
• Account.ID — The user distinguished name.
• Account.Username — The user samAccountName.
• Account.Email — The user email address.
• ActiveDirectory.Users.mail — The user email address.
• Account.Email.Address — The Email account full address.
• Account.Email.Distance — The email address distance compare to the domains in query.
• DBotScore.Indicator — The Indicator.
• DBotScore.Type — The Indicator Type.
• DBotScore.Vendor — The DBot score vendor.
• DBotScore.Score — The DBot score.
• DBotScore.Reliability — The actual score.
• Email.Relationships.EntityA — The source of the relationship.
• Email.Relationships.EntityB — The destination of the relationship.
• Email.Relationships.Relationship — The name of the relationship.
• Email.Relationships.EntityAType — The type of the source of the relationship.
• Email.Relationships.EntityBType — The type of the destination of the relationship.
• EWS.ResolvedNames — EWS resolved name primary key output.
• EWS.ResolvedNames.email_address — The primary SMTP address of a mailbox user.
• EWS.ResolvedNames.mailbox_type — The type of mailbox that is represented by the email address.
• EWS.ResolvedNames.name — The name of a mailbox user.
• EWS.ResolvedNames.routing_type — The address type for the mailbox.

Commands used

• ad-get-user
• email
• ews-resolve-name