display: BechtleDarkWebScan
name: BechtleDarkWebScan
description: 'Notifies you if login credentials to your company are being sold on the dark web.'
category: Identity and Access Management
provider: Bechtle
commonfields:
  id: BechtleDarkWebScan
  version: -1
sectionorder:
- Connect
- Collect
- Optimize
configuration:
- display: API Key
  additionalinfo: The darkwebscan.app API Key.
  name: apikey
  required: true
  type: 9
  hiddenusername: true
  displaypassword: "API Key"
  section: Connect
- display: Additional request headers
  name: addreqheaders
  required: false
  type: 12
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  defaultvalue: "60"
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: First fetch time
  name: first_fetch
  defaultvalue: "6 months"
  type: 0
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Maximum incidents per fetch
  name: max_fetch
  defaultvalue: "50"
  type: 0
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
defaultclassifier: BechtleDarkWebScan - Classifier
defaultmapperin: "BechtleDarkWebScan-mapper"
script:
  commands:
  - name: darkwebscan-getcompanies
    deprecated: false
    description: 'Returns a list of all companies associated with your API key.'
    execution: false
    outputs:
    - contextPath: BechtleDarkWebScan.Companies
      description: 'The companies that you have access to.'
      type: String
  - name: darkwebscan-getleaks
    arguments:
    - name: company_id
      default: false
      description: 'The ID of the company to retrieve leaked credentials for.'
      isArray: false
      required: true
      type: number
      secret: false
    - name: only_new
      default: false
      defaultValue: "false"
      description: 'Whether to only return leaks not previously seen by this integration instance.'
      isArray: false
      required: false
      secret: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    deprecated: false
    description: 'Returns leaked credentials for a given company_id.'
    execution: false
    outputs:
    - contextPath: BechtleDarkWebScan.LeakedCredentials
      description: 'The leaked credentials for a given company_id.'
      type: String

  - name: darkwebscan-getosint
    arguments:
    - name: company_id
      default: false
      description: 'The ID of the company to retrieve OSINT information for.'
      isArray: false
      required: true
      type: number
      secret: false
    deprecated: false
    description: 'Returns OSINT information about the associated domain of a given company_id.'
    execution: false
    outputs:
    - contextPath: BechtleDarkWebScan.OSINT
      description: 'The OSINT information (email addresses, subdomains, ...) for the associated domain of a given company_id.'
      type: String

  - name: darkwebscan-getemailsecurity
    arguments:
    - name: company_id
      default: false
      description: 'The ID of the company to retrieve email security information for.'
      isArray: false
      required: true
      type: number
      secret: false
    deprecated: false
    description: 'Returns information about the email security for the associated domain of a given company_id.'
    execution: false
    outputs:
    - contextPath: BechtleDarkWebScan.EmailSecurity
      description: 'The email security (SPF, DMARC, DANE, ...) information for the associated domain of a given company_id.'
      type: String

  - name: darkwebscan-getwaf
    arguments:
    - name: company_id
      default: false
      description: 'The ID of the company to retrieve Web Application Firewall Status information for.'
      isArray: false
      required: true
      type: number
      secret: false
    deprecated: false
    description: 'Returns Web Application Firewall Status information about the associated domain of a given company_id.'
    execution: false
    outputs:
    - contextPath: BechtleDarkWebScan.WAF
      description: 'The Web Application Firewall status and product name (if applicable).'
      type: String

  - name: darkwebscan-resetcontext
    deprecated: false
    description: 'Resets integration context for the DarkWebScan. May result in many alerts reappearing.'
    execution: false
    outputs:
    - contextPath: BechtleDarkWebScan.ResetContext
      description: 'Indicates that the integration context has been reset.'
      type: String


  isfetch: true
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.12042988
fromversion: 6.10.0
marketplaces:
- xsoar
- marketplacev2
- platform
tests:
- No tests (auto formatted)