Recorded Future External Usecase Deprecated

Deprecated. Use Recorded Future - Identity Exposure instead. Implements an external usecase for Recorded Future Identity Data

Recorded Future Identity · 7 tasks · 0 inputs · 0 outputs

Details

IDRecorded Future External Usecase
From Version6.0.0
Tasks7

README

External use case for Identity search and lookup using Recorded Future Identity

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • Recorded Future Identity

Scripts

This playbook does not use any scripts.

Commands

  • recordedfuture-identity-search
  • recordedfuture-identity-lookup

Playbook Inputs

Name Description Default Value Required
latest-downloaded Time frame for the leaked identities Last Year Optional
domain-type Type of the domain(Email, Authorization, All) Authorization Optional
identities String of identities separated by comma RecordedFuture.Credentials.SearchIdentities Required
first-downloaded Time frame for the leaked identities Last Year Oprional

Playbook Outputs

Path Type Description
RecordedFuture.Credentials.SearchIdentities List List of Identities that were found in search command
RecordedFuture.Credentials.Identities.identity.subjects string Identity value
RecordedFuture.Credentials.Identities.count number Leaked credentials count number
RecordedFuture.Credentials.Identities.credentials.subject string Identity value
RecordedFuture.Credentials.Identities.credentials.dumps.name string Dump name
RecordedFuture.Credentials.Identities.credentials.dumps.description string Dump description
RecordedFuture.Credentials.Identities.credentials.dumps.downloaded string Datetime string that show the day when dump was downloaded
RecordedFuture.Credentials.Identities.credentials.type string Dump type
RecordedFuture.Credentials.Identities.credentials.breaches.name string Breach name
RecordedFuture.Credentials.Identities.credentials.breaches.domain string Breach domain
RecordedFuture.Credentials.Identities.credentials.breaches.type string Breach type
RecordedFuture.Credentials.Identities.credentials.breaches.breached string Datetime string that show the day when breach happened
RecordedFuture.Credentials.Identities.credentials.breaches.description string Breach description
RecordedFuture.Credentials.Identities.credentials.breaches.site_description string Breach site description
RecordedFuture.Credentials.Identities.credentials.first_downloaded string Datetime string representing firs time downloaded
RecordedFuture.Credentials.Identities.credentials.latest_downloaded string Datetime string representing last time downloaded
RecordedFuture.Credentials.Identities.credentials.exposed_secret.type string Exposed secret type
RecordedFuture.Credentials.Identities.credentials.exposed_secret.hashes.algorithm string Exposed secret hash algorithm
RecordedFuture.Credentials.Identities.credentials.exposed_secret.hashes.hash string Exposed secret hash value
RecordedFuture.Credentials.Identities.credentials.exposed_secret.effectively_clear boolean Exposed secret clear or not
RecordedFuture.Credentials.Identities.credentials.exposed_secret.details.properties string Exposed secret properties
RecordedFuture.Credentials.Identities.credentials.exposed_secret.details.clear_text_hint string Exposed secret text hint
RecordedFuture.Credentials.Identities.credentials.exposed_secret.details.clear_text_hint string Exposed secret

Playbook Image

Recorded Future External Usecase Playbook

Commands used

recordedfuture-identity-lookup recordedfuture-identity-search

Flowchart

yes Start Start recordedfuture-identity-search - recordedfuture-identity-search recordedfuture-identity-s... recordedfuture-identity-search Done Done Check If any creds were found Check If any creds were f... recordedfuture-identity-lookup - recordedfuture-identity-lookup recordedfuture-identity-l... recordedfuture-identity-lookup Please check the credentials in WarRoom and make action. Please check the credenti... Delete Identity Context - DeleteContext Delete Identity Context DeleteContext

Source

playbook-Recorded_Future_Identity_External_Usecase.yml
Download History Raw 
id: Recorded Future External Usecase
version: -1
name: Recorded Future External Usecase
deprecated: true
description: Deprecated. Use Recorded Future - Identity Exposure instead. Implements an external usecase for Recorded Future Identity Data
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 3c177359-031c-487c-8913-6d28b4b3d7a2
    type: start
    task:
      id: 3c177359-031c-487c-8913-6d28b4b3d7a2
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": -70
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 9cdc1106-7c5e-4e70-833f-487feaee3d62
    type: regular
    task:
      id: 9cdc1106-7c5e-4e70-833f-487feaee3d62
      version: -1
      name: recordedfuture-identity-search
      description: Get email values that were leaked.
      script: Recorded Future Identity|||recordedfuture-identity-search
      type: regular
      iscommand: true
      brand: Recorded Future Identity
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      domain-type:
        simple: Authorization
      latest-downloaded:
        simple: All time
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 210
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: bbeb0540-862e-4d88-8ccc-b11d1169e11f
    type: title
    task:
      id: bbeb0540-862e-4d88-8ccc-b11d1169e11f
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "3":
    id: "3"
    taskid: 62fecd00-e591-44a9-8fb7-0f6444154138
    type: condition
    task:
      id: 62fecd00-e591-44a9-8fb7-0f6444154138
      version: -1
      name: Check If any creds were found
      description: Check if any creds were found
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "2"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: RecordedFuture.Credentials
                accessor: SearchIdentities
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 380
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: 1515d66b-8659-4e54-866b-909890a70c72
    type: regular
    task:
      id: 1515d66b-8659-4e54-866b-909890a70c72
      version: -1
      name: recordedfuture-identity-lookup
      description: Perform a lookup command using data from context
      script: Recorded Future Identity|||recordedfuture-identity-lookup
      type: regular
      iscommand: true
      brand: Recorded Future Identity
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      first-downloaded:
        simple: All time
      identities:
        simple: ${RecordedFuture.Credentials.SearchIdentities}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 640,
          "y": 570
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 4dee6e8a-fe47-4211-8f69-f8d81f9130aa
    type: regular
    task:
      id: 4dee6e8a-fe47-4211-8f69-f8d81f9130aa
      version: -1
      name: Please check the credentials in WarRoom and make action.
      description: Manual task for user to perform some action according to output
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 640,
          "y": 840
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: 39777a93-e6e9-4f1e-8af9-127e374d156e
    type: regular
    task:
      id: 39777a93-e6e9-4f1e-8af9-127e374d156e
      version: -1
      name: Delete Identity Context
      description: Delete field from context
      scriptName: DeleteContext
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    scriptarguments:
      key:
        simple: RecordedFuture.Credentials
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 60
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1285,
        "width": 970,
        "x": 50,
        "y": -70
      }
    }
  }
inputs: []
outputs: []
fromversion: 6.0.0
tests:
- TestIdentityRecordedFuture.yml