commonfields: id: Flashpoint version: -1 name: Flashpoint display: Flashpoint (Deprecated) category: Data Enrichment & Threat Intelligence provider: Flashpoint deprecated: true description: Deprecated. Use Flashpoint Ignite instead. configuration: - display: Fetch incidents name: isFetch type: 8 required: false - display: Incident type name: incidentType type: 13 required: false - display: Server URL additionalinfo: Server URL to connect to Flashpoint. name: url defaultvalue: "https://fp.tools" type: 0 required: true - display: API Key name: api_key defaultvalue: "" type: 4 required: true - additionalinfo: The maximum limit is 100 for alerts and 1000 for compromised credentials. defaultvalue: '15' display: Maximum number of incidents per fetch name: max_fetch type: 0 required: false - additionalinfo: 'Date or relative timestamp to start fetching the incidents from. (Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc).' defaultvalue: 3 days display: First fetch time interval name: first_fetch type: 0 required: false - additionalinfo: Whether to fetch the Flashpoint alerts or the compromised credentials. Would choose "Compromised Credentials" if nothing selected. defaultvalue: Compromised Credentials display: Fetch Type name: fetch_type options: - 'Compromised Credentials' - 'Alerts' type: 15 required: false - additionalinfo: Adds the 'is_fresh' flag to compromised credential queries so it only ingests username/password combinations if they haven't been seen before. defaultvalue: 'true' display: Fetch fresh compromised credentials alerts name: is_fresh_compromised_credentials type: 8 required: false - display: Trust any certificate (not secure) name: insecure type: 8 required: false - display: Use system proxy settings name: proxy type: 8 required: false - defaultvalue: 'true' additionalinfo: Create relationships between indicators as part of Enrichment. display: Create relationships name: create_relationships type: 8 required: false - additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: B - Usually reliable display: Source Reliability name: integrationReliability options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged type: 15 required: false - defaultvalue: indicatorType name: feedExpirationPolicy display: '' options: - never - interval - indicatorType - suddenDeath type: 17 required: false - defaultvalue: '20160' name: feedExpirationInterval display: '' type: 1 required: false script: script: '' type: python commands: - name: ip arguments: - name: ip default: true description: The IP address to check. isArray: true outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: IP.Address description: The IP address. type: string - contextPath: IP.Malicious.Description description: The description of the malicious indicator. type: string - contextPath: IP.Malicious.Vendor description: The vendor used to calculate the severity of the IP address. type: string - contextPath: Flashpoint.IP.Event.Href description: A list of reference links of the indicator. type: string - contextPath: Flashpoint.IP.Event.Address description: The IP address of the indicator. type: string - contextPath: Flashpoint.IP.Event.EventDetails description: The event details in which the indicator was observed. type: string - contextPath: Flashpoint.IP.Event.Category description: The category of the indicator. type: string - contextPath: Flashpoint.IP.Event.Fpid description: The Flashpoint ID of the indicator. type: string - contextPath: Flashpoint.IP.Event.Timestamp description: The time and date that the indicator was observed. type: string - contextPath: Flashpoint.IP.Event.Type description: The indicator type. type: string - contextPath: Flashpoint.IP.Event.Uuid description: The UUID of the indicator. type: string - contextPath: Flashpoint.IP.Event.Comment description: The comment that was provided when the indicator was observed. type: string - contextPath: IP.Relationships.EntityA description: The source of the relationship. type: string - contextPath: IP.Relationships.EntityB description: The destination of the relationship. type: string - contextPath: IP.Relationships.Relationship description: The name of the relationship. type: string - contextPath: IP.Relationships.EntityAType description: The type of the source of the relationship. type: string - contextPath: IP.Relationships.EntityBType description: The type of the destination of the relationship. type: string description: Looks up details of an IP indicator. The reputation of the IP address is considered malicious if there's at least one IOC event in the Flashpoint database that matches the IP indicator. Alternatively, the IP address is considered suspicious if it matches any one of the Torrent's Peer IP Address or Forum Visit's Peer IP Address. - name: domain arguments: - name: domain default: true description: The domain name to check. isArray: true outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: Flashpoint.Domain.Event.Href description: A list of reference links of the indicator. type: string - contextPath: Flashpoint.Domain.Event.Domain description: The domain of the indicator. type: string - contextPath: Flashpoint.Domain.Event.EventDetails description: The event details in which the indicator was observed. type: string - contextPath: Flashpoint.Domain.Event.Category description: The category of the indicator. type: string - contextPath: Flashpoint.Domain.Event.Fpid description: The Flashpoint ID of the indicator. type: string - contextPath: Flashpoint.Domain.Event.Timestamp description: The time and date that the indicator was observed. type: string - contextPath: Flashpoint.Domain.Event.Type description: The indicator type. type: string - contextPath: Flashpoint.Domain.Event.Uuid description: The UUID of the indicator. type: string - contextPath: Flashpoint.Domain.Event.Comment description: The comment that was provided when the indicator was observed. type: string - contextPath: Domain.Malicious.Description description: The description of the malicious indicator. type: string - contextPath: Domain.Malicious.Vendor description: Vendor of malicious indicator. type: string - contextPath: Domain.Name description: Name of domain. type: string - contextPath: Domain.Relationships.EntityA description: The source of the relationship. type: string - contextPath: Domain.Relationships.EntityB description: The destination of the relationship. type: string - contextPath: Domain.Relationships.Relationship description: The name of the relationship. type: string - contextPath: Domain.Relationships.EntityAType description: The type of the source of the relationship. type: string - contextPath: Domain.Relationships.EntityBType description: The type of the destination of the relationship. type: string description: Lookup the "Domain" type indicator details. The reputation of Domain is considered Malicious if there's at least one IOC event in Flashpoint database matching the Domain indicator. - name: filename arguments: - name: filename default: true description: The file name to check. isArray: true outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: Flashpoint.Filename.Event.Href description: A list of reference links of the indicator. type: string - contextPath: Flashpoint.Filename.Event.Filename description: Filename of the indicator. type: string - contextPath: Flashpoint.Filename.Event.EventDetails description: The event details in which the indicator was observed. type: string - contextPath: Flashpoint.Filename.Event.Category description: The category of the indicator. type: string - contextPath: Flashpoint.Filename.Event.Fpid description: The Flashpoint ID of the indicator. type: string - contextPath: Flashpoint.Filename.Event.Timestamp description: The time and date that the indicator was observed. type: string - contextPath: Flashpoint.Filename.Event.Type description: The indicator type. type: string - contextPath: Flashpoint.Filename.Event.Uuid description: The UUID of the indicator. type: string - contextPath: Flashpoint.Filename.Event.Comment description: The comment that was provided when the indicator was observed. type: string description: Lookup the "Filename" type indicator details. The reputation of Filename is considered Malicious if there's at least one IOC event in Flashpoint database matching the Filename indicator. - name: url arguments: - name: url default: true description: The url to check. isArray: true outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: Flashpoint.Url.Event.Href description: A list of reference links of the indicator. type: string - contextPath: Flashpoint.Url.Event.Url description: Url of the indicator. type: string - contextPath: Flashpoint.Url.Event.EventDetails description: The event details in which the indicator was observed. type: string - contextPath: Flashpoint.Url.Event.Category description: The category of the indicator. type: string - contextPath: Flashpoint.Url.Event.Fpid description: The Flashpoint ID of the indicator. type: string - contextPath: Flashpoint.Url.Event.Timestamp description: The time and date that the indicator was observed. type: string - contextPath: Flashpoint.Url.Event.Type description: The indicator type. type: string - contextPath: Flashpoint.Url.Event.Uuid description: The UUID of the indicator. type: string - contextPath: Flashpoint.Url.Event.Comment description: The comment that was provided when the indicator was observed. type: string - contextPath: URL.Malicious.Description description: The description of the malicious indicator. type: string - contextPath: URL.Malicious.Vendor description: Vendor of malicious url. type: string - contextPath: URL.Data description: The URL. type: string - contextPath: URL.Relationships.EntityA description: The source of the relationship. type: string - contextPath: URL.Relationships.EntityB description: The destination of the relationship. type: string - contextPath: URL.Relationships.Relationship description: The name of the relationship. type: string - contextPath: URL.Relationships.EntityAType description: The type of the source of the relationship. type: string - contextPath: URL.Relationships.EntityBType description: The type of the destination of the relationship. type: string description: Lookup the "URL" type indicator details. The reputation of Url is considered Malicious if there's at least one IOC event in Flashpoint database matching the Url indicator. - name: file arguments: - name: file default: true description: A list of hashes of the file to query. Supports MD5, SHA1 and SHA256. isArray: true outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: Flashpoint.File.Event.Href description: A list of reference links of the indicator. type: string - contextPath: Flashpoint.File.Event.MD5 description: MD5 file hash of the indicator. type: string - contextPath: Flashpoint.File.Event.SHA1 description: SHA1 file hash of the indicator. type: string - contextPath: Flashpoint.File.Event.SHA256 description: SHA256 file hash of the indicator. type: string - contextPath: Flashpoint.File.Event.EventDetails description: The event details in which the indicator was observed. type: string - contextPath: Flashpoint.File.Event.Category description: The category of the indicator. type: string - contextPath: Flashpoint.File.Event.Fpid description: The Flashpoint ID of the indicator. type: string - contextPath: Flashpoint.File.Event.Timestamp description: The time and date that the indicator was observed. type: string - contextPath: Flashpoint.File.Event.Type description: The indicator type. type: string - contextPath: Flashpoint.File.Event.Uuid description: The UUID of the indicator. type: string - contextPath: Flashpoint.File.Event.Comment description: The comment that was provided when the indicator was observed. type: string - contextPath: File.Malicious.Description description: The description of the malicious indicator. type: string - contextPath: File.Malicious.Vendor description: Vendor of malicious file. type: string - contextPath: File.MD5 description: MD5 type file. type: string - contextPath: File.SHA1 description: SHA1 type file. type: string - contextPath: File.SHA256 description: SHA256 type file. type: string - contextPath: File.Relationships.EntityA description: The source of the relationship. type: string - contextPath: File.Relationships.EntityB description: The destination of the relationship. type: string - contextPath: File.Relationships.Relationship description: The name of the relationship. type: string - contextPath: File.Relationships.EntityAType description: The type of the source of the relationship. type: string - contextPath: File.Relationships.EntityBType description: The type of the destination of the relationship. type: string description: Lookup the "File" type indicator details. The reputation of File-hash is considered Malicious if there's at least one IOC event in Flashpoint database matching the File-hash indicator. - name: email arguments: - name: email default: true description: The email to check. isArray: true outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string - contextPath: Flashpoint.Email.Event.Href description: A list of reference links of the indicator. type: string - contextPath: Flashpoint.Email.Event.EventDetails description: The event details in which the indicator was observed. type: string - contextPath: Flashpoint.Email.Event.Category description: The category of the indicator. type: string - contextPath: Flashpoint.Email.Event.Fpid description: The Flashpoint ID of the indicator. type: string - contextPath: Flashpoint.Email.Event.Timestamp description: The time and date that the indicator was observed. type: string - contextPath: Flashpoint.Email.Event.Type description: The indicator type. type: string - contextPath: Flashpoint.Email.Event.Uuid description: The UUID of the indicator. type: string - contextPath: Flashpoint.Email.Event.Comment description: The comment that was provided when the indicator was observed. type: string - contextPath: Account.Email.Malicious.Description description: The description of the malicious indicator. type: string - contextPath: Account.Email.Malicious.Vendor description: Vendor of Malicious email. type: string - contextPath: Account.Email.Name description: Name of indicator. type: string description: Lookup the "Email" type indicator details. The reputation of Email is considered Malicious if there's at least one IOC event in Flashpoint database matching the Email indicator. - name: flashpoint-search-intelligence-reports arguments: - name: report_search required: true description: Search report using keyword or text. outputs: - contextPath: Flashpoint.Report description: List of reports based on specified search query or keyword. description: Search for the Intelligence Reports using a keyword. - name: flashpoint-get-single-intelligence-report arguments: - name: report_id required: true description: The report id of the report for which the details are to be fetched. The report id can be known from output context path (Flashpoint.Report.ReportId) of report-search command or some other investigation. outputs: - contextPath: Flashpoint.Report.NotifiedAt description: Notify date of report. type: string - contextPath: Flashpoint.Report.PlatformUrl description: Platform url of report. It helps to redirect flashpoint platform. type: string - contextPath: Flashpoint.Report.PostedAt description: posted date of report. type: number - contextPath: Flashpoint.Report.Summary description: Summary of report. type: string - contextPath: Flashpoint.Report.Title description: Title of the report. type: string - contextPath: Flashpoint.Report.UpdatedAt description: Last updated date of report. type: string - contextPath: Flashpoint.Report.ReportId description: Unique id of the report. type: string description: Get single report details using the report id. The report id can be known from output context path (Flashpoint.Report.ReportId) of report-search command or some other investigation. - name: flashpoint-get-related-reports arguments: - name: report_id required: true description: The report-id of the report of which the related reports are to be fetched. The report id can be known from output context path (Flashpoint.Report.ReportId) of report-search command or some other investigation. outputs: - contextPath: Flashpoint.Report description: Display list of related report based on report fpid. description: Get related reports for a particular report using the report-id. The report id can be known from output context path (Flashpoint.Report.ReportId) of report-search command or some other investigation. - name: flashpoint-get-single-event arguments: - name: event_id required: true description: The UUID or FPID that identifies a particular event. The event id can be fetched from output context path (Flashpoint.Event.EventId) get-events command or indicator reputation command response or some other investigation. outputs: - contextPath: Flashpoint.Event.ObservedTime description: The date that the event was triggered. type: string - contextPath: Flashpoint.Event.EventCreatorEmail description: The email address of the event creator. type: string - contextPath: Flashpoint.Event.Href description: The display event reference. type: string - contextPath: Flashpoint.Event.MalwareDescription description: The description of the malware. type: string - contextPath: Flashpoint.Event.Tags description: The display event tags. - contextPath: Flashpoint.Event.EventId description: The display event ID (event fpid). type: string - contextPath: Flashpoint.Event.Name description: The name of the event. type: string description: Retrieves the details of a single event using event UUID or FPID. To retrieve the event id, run the get-events command and see the value under the Flashpoint.Event.EventId context path. or indicator reputation command response or some other investigation. - name: flashpoint-get-events arguments: - name: time_period description: The time period for the search. - name: report_fpid description: The report fpid. To retrieve the report fpid, run the related-reports command. - name: limit description: Specify the limit on the no. of record. defaultValue: "10" - name: attack_ids description: A comma-separated list of attack IDs for which to search. Attack IDs can be found in event information or on the Flashpoint platform by filtering events by attack IDs. outputs: - contextPath: Flashpoint.Event description: A list of multiple events. description: Searches for events within the specified time-period, the report fpid, or attack IDs. - name: flashpoint-common-lookup arguments: - name: indicator default: true description: The indicator type, for example, domain, ip, email, url, and so on. isArray: true outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: string - contextPath: DBotScore.Score description: The actual score. type: number - contextPath: DBotScore.Type description: The indicator type. type: string - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: string description: Lookup any type of indicator. - name: flashpoint-get-forum-details arguments: - name: forum_id required: true description: Specify forum id of the forum for which the details are to be fetched. The forum id can be known from context path (Flashpoint.Forum.ForumId or Flashpoint.Forum.Post.Forum.id) of flashpoint-search-forum-posts command or some other investigation. outputs: - contextPath: Flashpoint.Forum.Description description: Detailed information of the supplied forum ID. type: string - contextPath: Flashpoint.Forum.Hostname description: Host details of the supplied forum ID. type: string - contextPath: Flashpoint.Forum.Name description: The name of forum. type: string - contextPath: Flashpoint.Forum.Stats description: Statistical information such as the number of posts, rooms, threads, and users details. - contextPath: Flashpoint.Forum.Tags description: A list of forum tags, including id, name, parent_tag, and UUID. - contextPath: Flashpoint.Forum.ForumId description: The Forum ID. type: string description: Retrieves forum details using the forum ID. To retrieve the forum ID run the flashpoint-search-forum-posts command and see the value under the following context paths, Flashpoint.Forum.ForumId or Flashpoint.Forum.Post.Forum.id. - name: flashpoint-get-forum-room-details arguments: - name: room_id required: true description: The room ID for which to retrieve room information in a forum. To retrieve the room ID run the flashpoint-search-forum-posts command and see the value under the Flashpoint.Forum.Post.Room.id context path. outputs: - contextPath: Flashpoint.Forum.Room.Forum description: Forum details, including forum name, hostname, platform url, stats, tags, and so on. - contextPath: Flashpoint.Forum.Room.Title description: The room title. You can use the same title in the forum search command. type: string - contextPath: Flashpoint.Forum.Room.Url description: The forum room URL. type: string - contextPath: Flashpoint.Forum.Room.RoomId description: The forum room ID. type: string description: Retrieves forum room details using the room ID. To retrieve the room ID run the flashpoint-search-forum-posts command and see the value under the Flashpoint.Forum.Post.Room.id context path. - name: flashpoint-get-forum-user-details arguments: - name: user_id required: true description: The user ID used to retrieve a user's information. To retrieve the user ID, run the flashpoint-search-forum-posts command and see the value under the Flashpoint.Forum.Post.User.id context path. outputs: - contextPath: Flashpoint.Forum.User.Forum description: Forum details, including id, hostname, description, stats, tags, and so on. - contextPath: Flashpoint.Forum.User.Name description: The name of the user. type: string - contextPath: Flashpoint.Forum.User.PlatformUrl description: The platform URL of the user which is redirected to Flashpoint platform. type: string - contextPath: Flashpoint.Forum.User.Url description: The URL of user. type: string - contextPath: Flashpoint.Forum.User.UserId description: The unique ID of the forum user. type: string description: Retrieves user details using the user-id. To retrieve the user ID, run the flashpoint-search-forum-posts command and see the value under the Flashpoint.Forum.Post.User.id context path. - name: flashpoint-get-forum-post-details arguments: - name: post_id required: true description: The post ID, which gives post information embedded within the forum, room, user, and so on. To retrieve the post ID, run the flashpoint-search-forum-posts and see the value under the Flashpoint.Forum.Post.PostId context path. outputs: - contextPath: Flashpoint.Forum.Post.Forum description: Forum details of the post, including id, hostname, stats, description, tags, and so on. - contextPath: Flashpoint.Forum.Post.Room description: Room details of the post, including room title, id, url, platform url, and so on. - contextPath: Flashpoint.Forum.Post.User description: User details of the post, including user id, name, url, platform url, and so on. - contextPath: Flashpoint.Forum.Post.PlatformUrl description: Using platform URL user can redirect to Flashpoint platform. type: string - contextPath: Flashpoint.Forum.Post.PublishedAt description: The date that the post was published. - contextPath: Flashpoint.Forum.Post.Url description: The display URL of the post. - contextPath: Flashpoint.Forum.Post.PostId description: The forum post ID. type: string description: Retrieves post details using the post-id. To retrieve the post ID, run the flashpoint-search-forum-posts command and see the value under the Flashpoint.Forum.Post.PostId context path. command or some other investigation. - name: flashpoint-search-forum-sites arguments: - name: site_search required: true description: The site keyword or text for which to search. This keyword is used for search information in forum sites. This keyword or text is known by Flashpoint users. outputs: - contextPath: Flashpoint.Forum.Site description: A list of forum site details based on the search keyword. description: Searches forum sites using a keyword. it will search in site content like name, title, descripion etc. - name: flashpoint-search-forum-posts arguments: - name: post_search required: true description: The post keyword or text which is used for search information in forum posts, and is known by Flashpoint users. outputs: - contextPath: Flashpoint.Forum.Post description: A list of forum posts based on the search keyword. description: Search forum posts using a keyword. - arguments: - description: |- Filters the alerts based on the earliest date when the alerts were created. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. name: since - description: |- Filters the alerts based on the latest date when the alerts were created. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. name: until - description: |- Retrieves the next batch of alerts. Note: User can get the "scroll_id" from the HR of the same command "flashpoint-alert-list". name: scroll_id - defaultValue: '50' description: Number of alerts to retrieve in the response. (Maximum allowed size is 100). name: size description: Retrieves an alert or a list of alerts based on the filter values provided in the command arguments. Yields the alerts from Flashpoint collected sources and the alerts from data exposure. name: flashpoint-alert-list outputs: - contextPath: Flashpoint.Alerts.alert_id description: The ID of the alert. type: String - contextPath: Flashpoint.Alerts.fpid description: The ID of the resource that triggered the alert. type: String - contextPath: Flashpoint.Alerts.keyword.keyword_id description: The ID of the keyword. type: String - contextPath: Flashpoint.Alerts.keyword.keyword_text description: The value of the keyword. type: String - contextPath: Flashpoint.Alerts.highlights description: Snippets of the resource with the keywords highlighted. type: Unknown - contextPath: Flashpoint.Alerts.basetypes description: The data types of the resource. type: Unknown - contextPath: Flashpoint.Alerts.ts description: The timestamp of when the alert was created. type: Number - contextPath: Flashpoint.Alerts.tags.archived description: Whether the alert was archived or not. type: Boolean - contextPath: Flashpoint.Alerts.tags.flagged description: Whether the alert was starred or not. type: Boolean - contextPath: Flashpoint.Alerts.source.basetypes description: The data types of the resource. type: Unknown - contextPath: Flashpoint.Alerts.source.body.text/plain description: The body of the alert in text/plain format. type: String - contextPath: Flashpoint.Alerts.source.container.basetypes description: The data types for the thread or channel in which the content was posted. type: Unknown - contextPath: Flashpoint.Alerts.source.container.container.title description: The title of the container. type: String - contextPath: Flashpoint.Alerts.source.container.container.name description: The name of the container. type: String - contextPath: Flashpoint.Alerts.source.container.fpid description: The ID of the thread or channel in which the content was posted. type: String - contextPath: Flashpoint.Alerts.source.container.title description: The title of the thread or channel in which the content was posted. type: String - contextPath: Flashpoint.Alerts.source.created_at.date-time description: When the content was originally posted by its author. type: Date - contextPath: Flashpoint.Alerts.source.created_at.raw description: When the content was originally posted by its author, as raw format. type: String - contextPath: Flashpoint.Alerts.source.created_at.timestamp description: When the content was originally posted by its author, as a timestamp. type: Number - contextPath: Flashpoint.Alerts.source.first_observed_at.date-time description: The first time this piece of data was observed by Flashpoint. type: Date - contextPath: Flashpoint.Alerts.source.first_observed_at.raw description: The first time this piece of data was observed by Flashpoint, as raw format. type: String - contextPath: Flashpoint.Alerts.source.first_observed_at.timestamp description: The first time this piece of data was observed by Flashpoint, as a timestamp. type: Number - contextPath: Flashpoint.Alerts.source.fpid description: The ID of the resource. type: String - contextPath: Flashpoint.Alerts.source.last_observed_at.date-time description: The last time this piece of data was observed by Flashpoint. type: Date - contextPath: Flashpoint.Alerts.source.last_observed_at.raw description: The last time this piece of data was observed by Flashpoint, as raw format. type: String - contextPath: Flashpoint.Alerts.source.last_observed_at.timestamp description: The last time this piece of data was observed by Flashpoint, as a timestamp. type: Number - contextPath: Flashpoint.Alerts.source.native_id description: The ID used by the original site for the resource. type: String - contextPath: Flashpoint.Alerts.source.parent_message._schema description: The schema of the parent of this resource. type: String - contextPath: Flashpoint.Alerts.source.parent_message.basetypes description: The data types of the parent of this resource. type: Unknown - contextPath: Flashpoint.Alerts.source.parent_message.fpid description: The ID of the parent of this resource. type: String - contextPath: Flashpoint.Alerts.source.parent_message.native_id description: The ID used by the original site for the parent of this resource. type: String - contextPath: Flashpoint.Alerts.source.parent_message.type description: The type of the parent of this resource. type: String - contextPath: Flashpoint.Alerts.source.site.title description: The original site or platform where the resource was published. type: String - contextPath: Flashpoint.Alerts.source.site_actor.names.aliases description: The alias of the user who created the message, authored the blog post, or posted a product for sale. type: Unknown - contextPath: Flashpoint.Alerts.source.site_actor.names.handle description: The handle of the user who created the message, authored the blog post, or posted a product for sale. type: String - contextPath: Flashpoint.Alerts.source.sort_date description: Sort date of the alert. type: Date - contextPath: Flashpoint.Alerts.source.title description: The title of the alert. type: String - contextPath: Flashpoint.Alerts.source.file description: File name for the matched alert. type: String - contextPath: Flashpoint.Alerts.source.owner description: Author of the repo. type: String - contextPath: Flashpoint.Alerts.source.repo description: Repository name. type: String - contextPath: Flashpoint.Alerts.source.snippet description: Small blob of code/text that matched the keyword. type: String - contextPath: Flashpoint.Alerts.source.source description: Code repository platform. type: String - contextPath: Flashpoint.Alerts.source.url description: Link to the alerted source. type: String - contextPath: Flashpoint.PageToken.Alert.scroll_id description: The scroll_id for the next page. type: String - contextPath: Flashpoint.PageToken.Alert.size description: The size for the next page. type: String - contextPath: Flashpoint.PageToken.Alert.since description: The since date for the next page. type: String - contextPath: Flashpoint.PageToken.Alert.until description: The until date for the next page. type: String - contextPath: Flashpoint.PageToken.Alert.name description: The command name. type: String - arguments: - description: |- Filters the data based on the start date of the breach (UTC). Note: Will consider current time as default for end_date if start_date is initialized. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. name: start_date - description: |- Filters the data based on the end date of the breach (UTC). Note: Requires start_date along with the given argument. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc. name: end_date - auto: PREDEFINED description: |- Filters the compromised credential's breach data by either created or first observed date. Note: Requires the argument value for at least 'start_date' and 'end_date'. name: filter_date predefined: - created_at - first_observed_at - defaultValue: '50' description: 'The maximum number of result objects to return per page. Note: The maximum value is 1,000.' name: page_size - defaultValue: '1' description: 'Specify a page number to retrieve the compromised credentials. Note: The multiplication of page_size and page_number parameters cannot exceed 10,000.' name: page_number - auto: PREDEFINED description: 'Sort the compromised credential''s breach data by either created or first observed date. Note: Will consider ascending as default for sort_order if sort_date is initialized.' name: sort_date predefined: - created_at - first_observed_at - auto: PREDEFINED description: 'Specify the order to sort the data in. Note: Requires sort_date along with the given argument.' name: sort_order predefined: - asc - desc - auto: PREDEFINED description: 'Whether to fetch the fresh compromised credentials or not. Possible values are: true, false.' name: is_fresh predefined: - 'true' - 'false' description: Retrieves the compromised credentials based on the filter values provided in the command arguments. name: flashpoint-compromised-credentials-list outputs: - contextPath: Flashpoint.CompromisedCredential._id description: ID of the IoC. type: String - contextPath: Flashpoint.CompromisedCredential._source.affected_domain description: Affected domain of the IoC. type: String - contextPath: Flashpoint.CompromisedCredential._source.basetypes description: The array contains the underlying type of the credentials object, in this case ["credential-sighting"]. type: Unknown - contextPath: Flashpoint.CompromisedCredential._source.body.raw description: This is the raw content captured from the breach Flashpoint discovered. type: String - contextPath: Flashpoint.CompromisedCredential._source.breach._header description: This is the breach header object. type: String - contextPath: Flashpoint.CompromisedCredential._source.breach.basetypes description: Array containing underlying base type of breach object, i.e. ["breach"]. type: Unknown - contextPath: Flashpoint.CompromisedCredential._source.breach.breach_type description: Constant for future use. type: String - contextPath: Flashpoint.CompromisedCredential._source.breach.created_at.date-time description: Datetime object formatted as YYYY-mm-ddTHH:MM:SSZ. type: Date - contextPath: Flashpoint.CompromisedCredential._source.breach.created_at.timestamp description: UNIX timestamp. type: Number - contextPath: Flashpoint.CompromisedCredential._source.breach.first_observed_at.date-time description: Datetime object formatted as YYYY-mm-ddTHH:MM:SSZ. type: Date - contextPath: Flashpoint.CompromisedCredential._source.breach.first_observed_at.timestamp description: UNIX timestamp. type: Number - contextPath: Flashpoint.CompromisedCredential._source.breach.fpid description: Flashpoint ID of the breach. type: String - contextPath: Flashpoint.CompromisedCredential._source.breach.source description: Data source of breach (i.e. Analyst Research, CredentialStealer, etc.). type: String - contextPath: Flashpoint.CompromisedCredential._source.breach.source_type description: Type of source of the breach. type: String - contextPath: Flashpoint.CompromisedCredential._source.breach.title description: Title of breach. type: String - contextPath: Flashpoint.CompromisedCredential._source.breach.victim description: Victim of the breach. type: String - contextPath: Flashpoint.CompromisedCredential._source.credential_record_fpid description: This is the Flashpoint ID of the associated record object. This is used to retrieve sightings for a credential. type: String - contextPath: Flashpoint.CompromisedCredential._source.customer_id description: Customer ID of the IoC. type: String - contextPath: Flashpoint.CompromisedCredential._source.domain description: This is the domain object extracted off of the email address. type: String - contextPath: Flashpoint.CompromisedCredential._source.email description: The email address for the compromised credential. type: String - contextPath: Flashpoint.CompromisedCredential._source.extraction_id description: Extraction ID of the IoC. type: String - contextPath: Flashpoint.CompromisedCredential._source.extraction_record_id description: Extraction record ID of the IoC. type: String - contextPath: Flashpoint.CompromisedCredential._source.fpid description: The Flashpoint ID of this credentials object. type: String - contextPath: Flashpoint.CompromisedCredential._source.header_.indexed_at description: Timestamp for when this document was indexed into the Flashpoint database. type: String - contextPath: Flashpoint.CompromisedCredential._source.header_.pipeline_duration description: Pipeline duration header information of the IoC. type: String - contextPath: Flashpoint.CompromisedCredential._source.is_fresh description: This will be "true" if the credential has not been seen before, and it hasn't been marked "not fresh" by an analyst. (Historical breaches are not "fresh".). type: Boolean - contextPath: Flashpoint.CompromisedCredential._source.last_observed_at.date-time description: If exists, time object for when the credential was previously observed. Datetime object formatted as YYYY-mm-ddTHH:MM:SSZ. type: Date - contextPath: Flashpoint.CompromisedCredential._source.last_observed_at.timestamp description: UNIX timestamp. type: Number - contextPath: Flashpoint.CompromisedCredential._source.password description: The password for the credential (in plain text, if possible). type: String - contextPath: Flashpoint.CompromisedCredential._source.password_complexity.has_lowercase description: Boolean true/false if lowercase letters are present. type: Boolean - contextPath: Flashpoint.CompromisedCredential._source.password_complexity.has_number description: Boolean true/false if numbers are present. type: Boolean - contextPath: Flashpoint.CompromisedCredential._source.password_complexity.has_symbol description: Boolean true/false if symbols are present. type: Boolean - contextPath: Flashpoint.CompromisedCredential._source.password_complexity.has_uppercase description: Boolean true/false if uppercase letters are present. type: Boolean - contextPath: Flashpoint.CompromisedCredential._source.password_complexity.length description: Integer value that represents number of characters in password. type: Number - contextPath: Flashpoint.CompromisedCredential._source.password_complexity.probable_hash_algorithms description: List of possible hash algorithms suspected based on textpattern of the password (May include values like "MD5", "SHA-1", "SHA-256", "bcrypt", etc.) type: Unknown - contextPath: Flashpoint.CompromisedCredential._source.times_seen description: Integer representing the number of times the credential has been seen at Flashpoint. type: Number - contextPath: Flashpoint.CompromisedCredential._type description: Type of the IoC. type: String - contextPath: Flashpoint.CompromisedCredential.matched_queries description: Matching queries of the IoC. type: Unknown - contextPath: Flashpoint.CompromisedCredential.sort description: Sort value of the IoC. type: Unknown dockerimage: demisto/python3:3.12.8.1983910 isfetch: true runonce: false subtype: python3 tests: - Flashpoint_event-Test - Flashpoint_forum-Test - Flashpoint_report-Test - Flashpoint_reputation-Test fromversion: 5.0.0