Email Address Enrichment - Generic v2 Deprecated Hidden

Deprecated. Use "Email Address Enrichment - Generic v2.1" playbook instead. Enrich email addresses. Email address enrichment involves: - Getting information from Active Directory for internal addresses - Getting the domain-squatting reputation for external addresses

Deprecated Content (Deprecated) · 13 tasks · 3 inputs · 17 outputs

Inputs

  • InternalDomains — A CSV list of internal domains. The list will be used to determine whether an email address is internal or external.
  • Email — The email addresses to enrich.
  • Domain — The domains associated with the incident.

Outputs

  • Account — The Account object.
  • Account.Email.Address — The email account full address.
  • Account.Groups — The groups the account belongs to.
  • Account.Email.Domain — The email account domain.
  • Account.Email.NetworkType — The email account NetworkType (Internal/External).
  • Account.Type — Account entity type.
  • Account.Email.Username — The email account username.
  • Account.ID — The unique account DN (Distinguished Name).
  • Account.DisplayName — The account display name.
  • Account.Manager — The account's manager.
  • Account.Email.Distance.Domain — The compared domain.
  • Account.Email.Distance.Value — The distance between the email domain and the compared domain.
  • DBotScore.Indicator — The indicator.
  • DBotScore — The DBotScore object.
  • DBotScore.Type — The indicator type.
  • DBotScore.Vendor — The DBot score vendor.
  • DBotScore.Score — The DBot score.

Flowchart

yes yes yes yes yes Start Start Done Done Are there email addresses to check? Are there email addresses... Classify email addresses as internal or external - IsEmailAddressInternal Classify email addresses ... IsEmailAddressInternal Internal Internal External External Get email address info from Active Directory - ADGetUser Get email address info fr... ADGetUser Are there any external email addresses? - Exists Are there any external em... Exists Are there any internal email addresses? - Exists Are there any internal em... Exists Check email addresses for domain-squatting - EmailDomainSquattingReputation Check email addresses for... EmailDomainSquattingReputation Is Active Directory enabled? - Exists Is Active Directory enabled? Exists Is there a domain list input? - Exists Is there a domain list in... Exists No Email Addresses No Email Addresses