Compromised Credentials Match - Flashpoint

The Compromised Credentials Match playbook uses the details of the compromised credentials ingested from Flashpoint Ignite and authenticates using the Active Directory integration by providing the compromised credentials of the user. It then expires the credentials if it matches, and sends an email alert about the breach. Supported integrations: - Flashpoint - OpenLDAP - Active Directory Query v2

Flashpoint · 11 tasks · 3 inputs · 0 outputs

Details

ID	`Compromised Credentials Match - Flashpoint`
From Version	5.0.0
Tasks	11

README

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

Active Directory Query v2
OpenLDAP

Commands

ad-authenticate
ad-expire-password
send-mail

Playbook Inputs

Name	Description	Default Value	Required
username	The username of the compromised credentials account.	incident.flashpointsourceemail	Required
password	The password of the compromised credentials account.	incident.flashpointpassword	Required
sendEmailAsWarning	Boolean input whether to send email or not.	True	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Compromised Credentials Match - Flashpoint

Inputs

username — The username of the compromised credentials account.
password — The password of the compromised credentials account.
sendEmailAsWarning — Boolean input whether to send email or not.

Commands used

ad-authenticate ad-expire-password send-mail

Flowchart

Source

playbook-Compromised_Credentials_Match_-_Flashpoint.yml

Download History Raw

id: Compromised Credentials Match - Flashpoint
version: -1
name: Compromised Credentials Match - Flashpoint
description: |-
  The Compromised Credentials Match playbook uses the details of the compromised credentials ingested from Flashpoint Ignite and authenticates using the Active Directory integration by providing the compromised credentials of the user. It then expires the credentials if it matches, and sends an email alert about the breach.
  Supported integrations:
  - Flashpoint
  - OpenLDAP
  - Active Directory Query v2
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: bb3d91fc-387a-4329-8dbe-cf4f8a7830c0
    type: start
    task:
      id: bb3d91fc-387a-4329-8dbe-cf4f8a7830c0
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "15"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 720,
          "y": -430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: 82f381e5-6edf-4274-87a1-34a8dc1c3c37
    type: regular
    task:
      id: 82f381e5-6edf-4274-87a1-34a8dc1c3c37
      version: -1
      name: Authenticate user
      description: Performs a simple bind operation on the LDAP server.
      tags:
      - authenticate
      script: '|||ad-authenticate'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "13"
    scriptarguments:
      extend-context:
        simple: ad_output=.
      password:
        simple: ${inputs.password}
      username:
        complex:
          root: inputs.username
    reputationcalc: 1
    continueonerror: true
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1130,
          "y": 390
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 1e17db1a-f173-4247-8f71-e8f88f3381ca
    type: regular
    task:
      id: 1e17db1a-f173-4247-8f71-e8f88f3381ca
      version: -1
      name: Expire current password
      description: Expires the password of an Active Directory user.
      script: '|||ad-expire-password'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      username:
        complex:
          root: inputs.username
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1270,
          "y": 1080
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: 02837f42-01ce-4432-8223-e150e7b43cbe
    type: regular
    task:
      id: 02837f42-01ce-4432-8223-e150e7b43cbe
      version: -1
      name: Send password reset mail
      description: Sends an email.
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      body:
        simple: |-
          Hi,

          Your password at ${incident.flashpointaffecteddomain} has been breached and should be changed.

          Thanks
      subject:
        simple: Compromised Credential
      to:
        complex:
          root: inputs.username
    reputationcalc: 1
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 980,
          "y": 1580
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: 5d808528-08fc-4beb-8fe7-f7f0b61d3cb1
    type: title
    task:
      id: 5d808528-08fc-4beb-8fe7-f7f0b61d3cb1
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 630,
          "y": 1840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: 19af1a48-500e-4467-840a-998ae2dd95dc
    type: condition
    task:
      id: 19af1a48-500e-4467-840a-998ae2dd95dc
      version: -1
      name: Is OpenLDAP integration enabled?
      description: Check whether the OpenLDAP Integration is enabled or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "12"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: OpenLDAP
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 890,
          "y": -60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: 6aede180-305b-4a03-8678-d862ce7bcfdf
    type: condition
    task:
      id: 6aede180-305b-4a03-8678-d862ce7bcfdf
      version: -1
      name: Is send email as warning enabled?
      description: Check whether send email warning is enabled or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "Yes":
      - "6"
    separatecontext: false
    defaultassigneecomplex:
      simple: Analyst
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.sendEmailAsWarning
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: inputs.sendEmailAsWarning
                      iscontext: true
                    right:
                      value:
                        simple: "True"
            iscontext: true
    view: |-
      {
        "position": {
          "x": 870,
          "y": 1320
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: 567756bf-92ae-4333-8570-c8456db6d757
    type: condition
    task:
      id: 567756bf-92ae-4333-8570-c8456db6d757
      version: -1
      name: Is Active Directory Query V2 integration enabled?
      description: Check whether the Active Directory Query v2 Integration is enabled
        or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Active Directory Query v2
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1130,
          "y": 830
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: 274777c7-0d46-4d04-8939-c7e0f07d5681
    type: condition
    task:
      id: 274777c7-0d46-4d04-8939-c7e0f07d5681
      version: -1
      name: Is IncidentType Flashpoint Compromised Credentials?
      description: 'Check whether the IncidentType is Flashpoint Compromised Credentials
        or not. '
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: incident.type
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: incident.type
                      iscontext: true
                    right:
                      value:
                        simple: Flashpoint Compromised Credentials
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1130,
          "y": 160
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "13":
    id: "13"
    taskid: 93287df5-fe2f-4064-8baa-a9cecfb6f80f
    type: condition
    task:
      id: 93287df5-fe2f-4064-8baa-a9cecfb6f80f
      version: -1
      name: Is authentication successful?
      description: Check whether authentication is successful or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "9"
      "yes":
      - "10"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: ad_output
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: ad_output
                      iscontext: true
                    right:
                      value:
                        simple: Done
            iscontext: true
    view: |-
      {
        "position": {
          "x": 1130,
          "y": 590
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "15":
    id: "15"
    taskid: ec52760a-92d0-4460-8fdb-3effc462d3a7
    type: condition
    task:
      id: ec52760a-92d0-4460-8fdb-3effc462d3a7
      version: -1
      name: Is Flashpoint Ignite integration enabled?
      description: Check whether the Flashpoint Ignite integration is enabled or not.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "8"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Ignite
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 720,
          "y": -280
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "10_5_yes": 0.76,
      "10_9_#default#": 0.31,
      "15_7_#default#": 0.26,
      "8_9_#default#": 0.26
    },
    "paper": {
      "dimensions": {
        "height": 2335,
        "width": 1020,
        "x": 630,
        "y": -430
      }
    }
  }
inputs:
- key: username
  value:
    complex:
      root: incident
      accessor: flashpointcompromisedemail
  required: true
  description: The username of the compromised credentials account.
  playbookInputQuery:
- key: password
  value:
    complex:
      root: incident
      accessor: flashpointcompromisedpassword
  required: true
  description: The password of the compromised credentials account.
  playbookInputQuery:
- key: sendEmailAsWarning
  value:
    simple: "True"
  required: false
  description: Boolean input whether to send email or not.
  playbookInputQuery:
outputs: []
tests:
- Flashpoint_alert-Test
- Flashpoint_compromised-Test
- Flashpoint_event-Test
- Flashpoint_forum-Test
- Flashpoint_report-Test
- Flashpoint_reputation-Test
fromversion: 5.0.0