category: Data Enrichment & Threat Intelligence provider: Troy Hunt commonfields: id: Have I Been Pwned? V2 version: -1 configuration: - display: API Key name: api_key type: 4 hidden: true required: false - displaypassword: API Key name: credentials_api_key hiddenusername: true type: 9 required: false - defaultvalue: '30' display: Maximum time per request (in seconds) name: max_retry_time type: 0 required: false - defaultvalue: SUSPICIOUS display: 'Email Severity: The DBot reputation for compromised emails (SUSPICIOUS or MALICIOUS)' name: default_dbot_score_email type: 0 required: false - defaultvalue: SUSPICIOUS display: 'Domain Severity: The DBot reputation for compromised domains (SUSPICIOUS or MALICIOUS)' name: default_dbot_score_domain type: 0 required: false - display: Trust any certificate (not secure) name: insecure type: 8 required: false - display: Use system proxy settings name: proxy type: 8 required: false - additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: A - Completely reliable display: Source Reliability name: integrationReliability options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged type: 15 required: false - defaultvalue: indicatorType name: feedExpirationPolicy display: '' options: - never - interval - indicatorType - suddenDeath type: 17 required: false - defaultvalue: '20160' name: feedExpirationInterval display: '' type: 1 required: false description: Uses the Have I Been Pwned? service to check whether email addresses, domains, or usernames were compromised in previous breaches. display: Have I Been Pwned? v2 name: Have I Been Pwned? V2 script: commands: - arguments: - default: true description: Comma-separated list of email addresses to check. isArray: true name: email required: true description: Checks if an email address was compromised. name: pwned-email outputs: - contextPath: Account.Email.Pwned-V2.Compromised.Vendor description: For compromised email addresses, the vendor that made the decision. type: String - contextPath: Account.Email.Pwned-V2.Compromised.Reporters description: For compromised email addresses, the reporters for the vendor to make the compromised decision. type: String - contextPath: Account.Email.Address description: The email address. type: String - contextPath: Email.Malicious.Vendor description: For malicious email addresses, the vendor that made the decision. type: String - contextPath: Email.Malicious.Description description: For malicious email addresses, the reason that the vendor made the decision. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: Vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - arguments: - default: true description: Comma-separated list of domains to check. isArray: true name: domain required: true description: Checks if a domain was compromised. name: pwned-domain outputs: - contextPath: Domain.Pwned-V2.Compromised.Vendor description: For compromised domains, the vendor that made the decision. type: String - contextPath: Domain.Pwned-V2.Compromised.Reporters description: For compromised domains, the reporters for the vendor to make the compromised decision. type: String - contextPath: Domain.Name description: Domain name. type: String - contextPath: Domain.Malicious.Vendor description: For malicious domains, the vendor that made the decision. type: String - contextPath: Domain.Malicious.Description description: For malicious domains, the reason that the vendor made the decision. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - arguments: - default: true description: Comma-separated list of email addresses to check. isArray: true name: email required: true description: Checks if an email address was compromised. name: email outputs: - contextPath: Account.Email.Pwned-V2.Compromised.Vendor description: For compromised email addresses, the vendor that made the decision. type: String - contextPath: Account.Email.Pwned-V2.Compromised.Reporters description: For compromised email addresses, the reporters for the vendor to make the compromised decision. type: String - contextPath: Account.Email.Address description: The email address. type: String - contextPath: Email.Malicious.Vendor description: For malicious email addresses, the vendor that made the decision. type: String - contextPath: Email.Malicious.Description description: For malicious email addresses, the reason that the vendor made the decision. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - arguments: - default: true description: Comma-separated list of domains to check. isArray: true name: domain required: true description: Checks if a domain was compromised. name: domain outputs: - contextPath: Domain.Pwned-V2.Compromised.Vendor description: For compromised domains, the vendor that made the decision. type: String - contextPath: Domain.Pwned-V2.Compromised.Reporters description: For compromised domains, the reporters for the vendor to make the compromised decision. type: String - contextPath: Domain.Name description: The domain name. type: String - contextPath: Domain.Malicious.Vendor description: For malicious domains, the vendor that made the decision. type: String - contextPath: Domain.Malicious.Description description: For malicious domains, the reason that the vendor made the decision. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - arguments: - default: true description: Comma-separated list of usernames to check. isArray: true name: username required: true description: Checks if a username was compromised. name: pwned-username outputs: - contextPath: Username.Pwned-V2.Compromised.Vendor description: For compromised usernames, the vendor that made the decision. type: String - contextPath: Username.Pwned-V2.Compromised.Reporters description: For compromised usernames, the reporters for the vendor to make the compromised decision. type: String - contextPath: Username.Name description: The username name. type: String - contextPath: Username.Malicious.Vendor description: For malicious usernames, the vendor that made the decision. type: String - contextPath: Username.Malicious.Description description: For malicious usernames, the reason that the vendor made the decision. type: String runonce: false script: '-' subtype: python3 dockerimage: demisto/python3:3.12.13.10116658 type: python tests: - Pwned v2 test fromversion: 5.0.0