category: Data Enrichment & Threat Intelligence provider: SpyCloud commonfields: id: SpyCloudEnterpriseProtectionEnrichment version: -1 configuration: - defaultvalue: https://api.spycloud.io/enterprise-v2/ display: API URL name: url required: true type: 0 - display: API Key hidden: false name: apikey required: true type: 4 - display: Trust any certificate (not secure) name: insecure required: false type: 8 - display: Use system proxy settings name: proxy required: false type: 8 description: Integrate the SpyCloud Enterprise Protection API to use enrichment commands (along with sample Enrichment Playbooks) to look up your watchlists, domains, emails, IP addresses, usernames, and passwords. Data for malware-infected devices and exposed corporate applications are available for SpyCloud Compass users. display: SpyCloud Enterprise Protection Enrichment name: SpyCloudEnterpriseProtectionEnrichment script: commands: - arguments: - default: false description: The maximum number of records to return from the collection. Limit default value is 50. isArray: false name: limit required: false secret: false - default: false description: This parameter allows you to define the starting point for a date range query on the spycloud_publish_date field. Example:- YYYY-MM-DD. isArray: false name: since required: false secret: false - default: false description: |- This parameter allows you to define the ending point for a date range query on the spycloud_publish_date field. Example:- YYYY-MM-DD. isArray: false name: until required: false secret: false - default: false description: The page number. Default is 1. isArray: false name: page required: false secret: false - default: false description: The number of requested results per page. Default is 50. isArray: false name: page_size required: false secret: false - default: false description: Query value to search the breach catalog for. isArray: false name: query required: false secret: false - auto: PREDEFINED default: false description: Fetch all results. isArray: false name: all_results predefined: - 'True' - 'False' required: false secret: false deprecated: false description: List the Breach Catalog. By default, this lists all breaches in SpyCloud. With the arguments, it's possible to scope the results. execution: false name: spycloud-breach-catalog-list outputs: - contextPath: SpyCloud.BreachList.site description: Website of breached organization, when available. type: String - contextPath: SpyCloud.BreachList.confidence description: Numerical score representing the confidence in the source of the breach. type: Number - contextPath: SpyCloud.BreachList.id description: Numerical breach ID. This number correlates to source_id data point found in breach records. type: Number - contextPath: SpyCloud.BreachList.acquisition_date description: The date on which our security research team first acquired the breached data. type: Date - contextPath: SpyCloud.BreachList.uuid description: UUID v4 encoded version of breach ID. This is relevant for users of Firehose, where each deliverable (records file) is named using the breach UUID. type: String - contextPath: SpyCloud.BreachList.num_records description: Number of records we parsed and ingested from this particular breach. This is after parsing, normalization and deduplication take place. type: Number - contextPath: SpyCloud.BreachList.type description: Denotes if a breach is considered public or private. A public breach is one that is easily found on the internet, while a private breach is often exclusive to SpyCloud. type: String - contextPath: SpyCloud.BreachList.title description: Breach title. For each ingested breach our security research team documents a breach title. This is only available when we can disclose the breach details, otherwise it will have a generic title. type: String - contextPath: SpyCloud.BreachList.spycloud_publish_date description: The date on which we ingested the breached data into our systems. This is the same date on which the data becomes publicly available to our customers. type: Date - contextPath: SpyCloud.BreachList.description description: Breach description. For each ingested breach our security research team documents a breach description. This is only available when we can disclose the breach details, otherwise it will have a generic description. type: String - contextPath: SpyCloud.BreachList.site_description description: Description of the breached organization, when available. type: String - contextPath: SpyCloud.BreachList.assets.phone description: Phone number. type: Number - contextPath: SpyCloud.BreachList.assets.gender description: Gender specifier. Typically set to 'M', 'F', 'Male', or 'Female'. type: Number - contextPath: SpyCloud.BreachList.assets.company_name description: Company name. type: Number - contextPath: SpyCloud.BreachList.assets.user_agent description: Browser agent string. type: Number - contextPath: SpyCloud.BreachList.assets.country description: Country name. type: Number - contextPath: SpyCloud.BreachList.assets.social_telegram description: Telegram username. type: Number - contextPath: SpyCloud.BreachList.assets.social_skype description: Skype username. type: Number - contextPath: SpyCloud.BreachList.assets.state description: State name. type: Number - contextPath: SpyCloud.BreachList.assets.account_login_time description: Last account login time. In ISO 8601 datetime format. type: Number - contextPath: SpyCloud.BreachList.assets.ip_addresses description: List of one or more IP addresses in alphanumeric format. Both IPV4 and IPv6 addresses are supported. type: Number - contextPath: SpyCloud.BreachList.assets.postal_code description: Postal code, usually zip code in USA. type: Number - contextPath: SpyCloud.BreachList.assets.dob description: Date of birth. In ISO 8601 datetime format. type: Number - contextPath: SpyCloud.BreachList.assets.account_signup_time description: Account signup date. In ISO 8601 datetime format. type: Number - contextPath: SpyCloud.BreachList.assets.homepage description: User's homepage URL. type: Number - contextPath: SpyCloud.BreachList.assets.first_name description: First name. type: Number - contextPath: SpyCloud.BreachList.assets.country_code description: Country code; derived from country. type: Number - contextPath: SpyCloud.BreachList.assets.account_modification_time description: Account modification date. In ISO 8601 datetime format. type: Number - contextPath: SpyCloud.BreachList.assets.full_name description: Full name. type: Number - contextPath: SpyCloud.BreachList.assets.address_1 description: Address line 1. type: Number - contextPath: SpyCloud.BreachList.assets.last_name description: Last name. type: Number - contextPath: SpyCloud.BreachList.assets.email description: Email address. type: Number - contextPath: SpyCloud.BreachList.assets.city description: City name. type: Number - contextPath: SpyCloud.BreachList.assets.password description: Account password. type: Number - contextPath: SpyCloud.BreachList.assets.username description: Username. type: Number - arguments: - default: false description: Numerical ID of the breach. Both integer and UUIDv4 ID formats are supported. You may also use a comma delimiter to request more than one breach at a time. isArray: false name: id required: true secret: false deprecated: false description: Get Breach Catalog Information by ID. execution: false name: spycloud-breach-catalog-get outputs: - contextPath: SpyCloud.BreachData.site description: Website of breached organization, when available. type: String - contextPath: SpyCloud.BreachData.confidence description: Numerical score representing the confidence in the source of the breach. type: Number - contextPath: SpyCloud.BreachData.id description: Numerical breach ID. This number correlates to source_id data point found in breach records. type: Number - contextPath: SpyCloud.BreachData.acquisition_date description: The date on which our security research team first acquired the breached data. type: Date - contextPath: SpyCloud.BreachData.uuid description: UUID v4 encoded version of breach ID. This is relevant for users of Firehose, where each deliverable (records file) is named using the breach UUID. type: String - contextPath: SpyCloud.BreachData.num_records description: Number of records we parsed and ingested from this particular breach. This is after parsing, normalization and deduplication take place. type: Number - contextPath: SpyCloud.BreachData.type description: Denotes if a breach is considered public or private. A public breach is one that is easily found on the internet, while a private breach is often exclusive to SpyCloud. type: String - contextPath: SpyCloud.BreachData.title description: Breach title. For each ingested breach our security research team documents a breach title. This is only available when we can disclose the breach details, otherwise it will have a generic title. type: String - contextPath: SpyCloud.BreachData.spycloud_publish_date description: The date on which we ingested the breached data into our systems. This is the same date on which the data becomes publicly available to our customers. type: Date - contextPath: SpyCloud.BreachData.description description: Breach description. For each ingested breach our security research team documents a breach description. This is only available when we can disclose the breach details, otherwise it will have a generic description. type: String - contextPath: SpyCloud.BreachData.site_description description: Description of the breached organization, when available. type: String - contextPath: SpyCloud.BreachData.assets.phone description: Phone number. type: Number - contextPath: SpyCloud.BreachData.assets.gender description: Gender specifier. Typically set to 'M', 'F', 'Male', or 'Female'. type: Number - contextPath: SpyCloud.BreachData.assets.company_name description: Company name. type: Number - contextPath: SpyCloud.BreachData.assets.user_agent description: Browser agent string. type: Number - contextPath: SpyCloud.BreachData.assets.country description: Country name. type: Number - contextPath: SpyCloud.BreachData.assets.social_telegram description: Telegram username. type: Number - contextPath: SpyCloud.BreachData.assets.social_skype description: Skype username. type: Number - contextPath: SpyCloud.BreachData.assets.state description: State name. type: Number - contextPath: SpyCloud.BreachData.assets.account_login_time description: Last account login time. In ISO 8601 datetime format. type: Number - contextPath: SpyCloud.BreachData.assets.ip_addresses description: List of one or more IP addresses in alphanumeric format. Both IPV4 and IPv6 addresses are supported. type: Number - contextPath: SpyCloud.BreachData.assets.postal_code description: Postal code, usually zip code in USA. type: Number - contextPath: SpyCloud.BreachData.assets.dob description: Date of birth. In ISO 8601 datetime format. type: Number - contextPath: SpyCloud.BreachData.assets.account_signup_time description: Account signup date. In ISO 8601 datetime format. type: Number - contextPath: SpyCloud.BreachData.assets.homepage description: User's homepage URL. type: Number - contextPath: SpyCloud.BreachData.assets.first_name description: First name. type: Number - contextPath: SpyCloud.BreachData.assets.country_code description: Country code; derived from country. type: Number - contextPath: SpyCloud.BreachData.assets.account_modification_time description: Account modification date. In ISO 8601 datetime format. type: Number - contextPath: SpyCloud.BreachData.assets.full_name description: Full name. type: Number - contextPath: SpyCloud.BreachData.assets.address_1 description: Address line 1. type: Number - contextPath: SpyCloud.BreachData.assets.last_name description: Last name. type: Number - contextPath: SpyCloud.BreachData.assets.email description: Email address. type: Number - contextPath: SpyCloud.BreachData.assets.city description: City name. type: Number - contextPath: SpyCloud.BreachData.assets.password description: Account password. type: Number - contextPath: SpyCloud.BreachData.assets.username description: Username. type: Number - arguments: - default: true description: Domain or Subdomain name to search for. isArray: false name: domain required: true secret: false - default: false description: The maximum number of records to return from the collection. Limit default value is 50. isArray: false name: limit required: false secret: false - auto: PREDEFINED default: false description: This parameter lets you filter results by several types. The allowed values are 'corporate' for corporate records, and 'infected' for infected user records, email_domain to just match against email domains, and target_domain to just match against target domains or subdomains. If no value has been provided the API function will, by default, return all record types. isArray: false name: type predefined: - corporate - infected - '' - email_domain - target_domain required: false secret: false - default: false description: This parameter allows you to define the starting point for a date range query on the spycloud_publish_date field. Example:- YYYY-MM-DD. isArray: false name: since required: false secret: false - default: false description: |- This parameter allows you to define the ending point for a date range query on the spycloud_publish_date field. Example:- YYYY-MM-DD. isArray: false name: until required: false secret: false - default: false description: |- This parameter allows you to filter based on the numeric severity code. Possible values are: 2 -> Email only severity. This record is part of an email-only list. 5 -> Informational severity. This severity value is given to breach records where we have a non-crackable password hash, or no password at all. 20 ->High severity. This severity value is given to breach records where we have an email address and a plaintext password. 25 -> Critical severity. This severity value is given to breach records recovered from an infected machine (botnet data). These records will always have a plaintext password and most will have an email address. isArray: false name: severity predefined: - '' required: false secret: false - default: false description: This parameter allows you to filter based on a particular breach source. isArray: false name: source_id required: false secret: false - default: false description: The page number. Default is 1. isArray: false name: page required: false secret: false - default: false description: The number of requested results per page. Default is 50. isArray: false name: page_size required: false secret: false - auto: PREDEFINED default: false description: Fetch all results. isArray: false name: all_results predefined: - 'True' - 'False' required: false secret: false - default: false description: This parameter allows you to define the starting point for a date range query on when an already published record was modified (record_modification_date). isArray: false name: since_modification_date required: false secret: false - default: false description: This parameter allows you to define the ending point for a date range query on the when an already published record was modified (record_modification_date). isArray: false name: until_modification_date required: false secret: false - default: false description: If hashing is enabled for your API key, you have the option to provide a 10 to 24 character, high entropy salt otherwise the pre-configured salt will be used. isArray: false name: salt required: false secret: false deprecated: false description: Get Breach Data by Domain. execution: false name: spycloud-domain-data-get outputs: - contextPath: SpyCloud.Domain.username description: Username. type: String - contextPath: SpyCloud.Domain.password description: Account password. type: String - contextPath: SpyCloud.Domain.password_plaintext description: The cracked, plaintext version of the password (where the password is crackable). type: String - contextPath: SpyCloud.Domain.password_type description: Password type for original password as found in the data breach. This will either be plaintext or one of the many password hash/encryption types (SHA1, MD5, 3DES, etc). type: String - contextPath: SpyCloud.Domain.target_url description: URL extracted from Botnet data. This is the URL that is captured from a key logger installed on an infected user's system. type: String - contextPath: SpyCloud.Domain.user_browser description: Browser name. type: String - contextPath: SpyCloud.Domain.ip_addresses description: List of one or more IP addresses in alphanumeric format. Both IPV4 and IPv6 addresses are supported. type: String - contextPath: SpyCloud.Domain.infected_machine_id description: A unique identifier either extracted from an infostealer log, when present, or an RFC 4122-compliant universally unique identifier (UUID) generated by SpyCloud, when no identifier is present in an infected record. The method of generation of these identifiers varies by malware family and may or may not conform to a UUID format. For the ID's in the aforementioned UUID format, there is not currently any way to determine whether an infected_machine_id was extracted from a malware log or generated by SpyCloud. type: String - contextPath: SpyCloud.Domain.infected_path description: The local path to the malicious software installed on the infected user's system. type: String - contextPath: SpyCloud.Domain.infected_time description: The time at which the user's system was infected with malicious software. type: Date - contextPath: SpyCloud.Domain.user_sys_domain description: System domain. This usually comes from Botnet data. type: String - contextPath: SpyCloud.Domain.user_hostname description: System hostname. This usually comes from Botnet data. type: String - contextPath: SpyCloud.Domain.user_os description: System OS name. This usually comes from Botnet data. type: String - contextPath: SpyCloud.Domain.user_sys_registered_owner description: System registered owner name. This usually comes from Botnet data. type: String - contextPath: SpyCloud.Domain.source_id description: Numerical breach ID. This correlates directly with the id field in Breach Catalog objects. type: Number - contextPath: SpyCloud.Domain.spycloud_publish_date description: The date on which we ingested the breached data into our systems. This is the same date on which the data becomes publicly available to our customers. type: Date - contextPath: SpyCloud.Domain.target_domain description: SLD extracted from 'target_url' field. type: String - contextPath: SpyCloud.Domain.target_subdomain description: Subdomain and SLD extracted from 'target_url' field. type: String - contextPath: SpyCloud.Domain.severity description: 'Severity is a numeric code representing severity of a breach record. This can be used in API requests to ensure only Breach Records with plaintext password are returned. Possible values are: 2 -> Email only severity. This record is part of an email-only list. 5 -> Informational severity. This severity value is given to breach records where we have a non-crackable password hash, or no password at all. 20 -> High severity. This severity value is given to breach records where we have an email address and a plaintext password. 25 -> Critical severity. This severity value is given to breach records recovered from an infected machine (botnet data). These records will always have a plaintext password and most will have an email address.' type: Number - contextPath: SpyCloud.Domain.document_id description: UUID v4 string which uniquely identifies this breach record in our data set. type: String - contextPath: SpyCloud.Domain.email description: Email address. type: String - contextPath: SpyCloud.Domain.email_domain description: Domain extracted from 'email_address' field. This is not a SLD, but everything after the '@' symbol. type: String - contextPath: SpyCloud.Domain.email_username description: Username extracted from 'email' field. This is everything before the '@' symbol. type: String - contextPath: SpyCloud.Domain.domain description: Domain name. type: String - arguments: - default: false description: This parameter allows you to define the starting point for a date range query on the spycloud_publish_date field. isArray: false name: since required: false secret: false - default: false description: This parameter allows you to define the ending point for a date range query on the spycloud_publish_date field. isArray: false name: until required: false secret: false - default: false description: This parameter allows you to define the starting point for a date range query on when an already published record was modified (record_modification_date). isArray: false name: since_modification_date required: false secret: false - default: false description: |- This parameter allows you to define the ending point for a date range query on the when an already published record was modified (record_modification_date). isArray: false name: until_modification_date required: false secret: false - default: false description: |- This parameter allows you to filter based on the numeric severity code. Possible values are: 2 -> Email only severity. This record is part of an email-only list. 5 -> Informational severity. This severity value is given to breach records where we have a non-crackable password hash, or no password at all. 20 ->High severity. This severity value is given to breach records where we have an email address and a plaintext password. 25 -> Critical severity. This severity value is given to breach records recovered from an infected machine (botnet data). These records will always have a plaintext password and most will have an email address. isArray: false name: severity predefined: - '' required: false secret: false - default: false description: This parameter allows you to filter based on a particular breach source. isArray: false name: source_id required: false secret: false - default: false description: The page number. Default is 1. isArray: false name: page required: false secret: false - default: false description: The number of requested results per page. Default is 50. isArray: false name: page_size required: false secret: false - default: false description: The maximum number of records to return from the collection. Limit default value is 50. isArray: false name: limit required: false secret: false - default: true description: Username you wish to search for. isArray: false name: username required: true secret: false - auto: PREDEFINED default: false description: Fetch all results. isArray: false name: all_results predefined: - 'True' - 'False' required: false secret: false - default: false description: If hashing is enabled for your API key, you have the option to provide a 10 to 24 character, high entropy salt otherwise the pre-configured salt will be used. isArray: false name: salt required: false secret: false deprecated: false description: Get Breach Data by Username. execution: false name: spycloud-username-data-get outputs: - contextPath: SpyCloud.Username.username description: Username. type: String - contextPath: SpyCloud.Username.password description: Account password. type: String - contextPath: SpyCloud.Username.password_plaintext description: The cracked, plaintext version of the password (where the password is crackable). type: String - contextPath: SpyCloud.Username.password_type description: Password type for original password as found in the data breach. This will either be plaintext or one of the many password hash/encryption types (SHA1, MD5, 3DES, etc). type: String - contextPath: SpyCloud.Username.target_url description: URL extracted from Botnet data. This is the URL that is captured from a key logger installed on an infected user's system. type: String - contextPath: SpyCloud.Username.user_browser description: Browser name. type: String - contextPath: SpyCloud.Username.ip_addresses description: List of one or more IP addresses in alphanumeric format. Both IPV4 and IPv6 addresses are supported. type: String - contextPath: SpyCloud.Username.infected_machine_id description: A unique identifier either extracted from an infostealer log, when present, or an RFC 4122-compliant universally unique identifier (UUID) generated by SpyCloud, when no identifier is present in an infected record. The method of generation of these identifiers varies by malware family and may or may not conform to a UUID format. For the ID's in the aforementioned UUID format, there is not currently any way to determine whether an infected_machine_id was extracted from a malware log or generated by SpyCloud. type: String - contextPath: SpyCloud.Username.infected_path description: The local path to the malicious software installed on the infected user's system. type: String - contextPath: SpyCloud.Username.infected_time description: The time at which the user's system was infected with malicious software. type: Date - contextPath: SpyCloud.Username.user_sys_domain description: System domain. This usually comes from Botnet data. type: String - contextPath: SpyCloud.Username.user_hostname description: System hostname. This usually comes from Botnet data. type: String - contextPath: SpyCloud.Username.user_os description: System OS name. This usually comes from Botnet data. type: String - contextPath: SpyCloud.Username.user_sys_registered_owner description: System registered owner name. This usually comes from Botnet data. type: String - contextPath: SpyCloud.Username.source_id description: Numerical breach ID. This correlates directly with the id field in Breach Catalog objects. type: Number - contextPath: SpyCloud.Username.spycloud_publish_date description: The date on which we ingested the breached data into our systems. This is the same date on which the data becomes publicly available to our customers. type: Date - contextPath: SpyCloud.Username.target_domain description: SLD extracted from 'target_url' field. type: String - contextPath: SpyCloud.Username.target_subdomain description: Subdomain and SLD extracted from 'target_url' field. type: String - contextPath: SpyCloud.Username.severity description: 'Severity is a numeric code representing severity of a breach record. This can be used in API requests to ensure only Breach Records with plaintext password are returned. Possible values are: 2 -> Email only severity. This record is part of an email-only list. 5 -> Informational severity. This severity value is given to breach records where we have a non-crackable password hash, or no password at all. 20 -> High severity. This severity value is given to breach records where we have an email address and a plaintext password. 25 -> Critical severity. This severity value is given to breach records recovered from an infected machine (botnet data). These records will always have a plaintext password and most will have an email address.' type: Number - contextPath: SpyCloud.Username.document_id description: UUID v4 string which uniquely identifies this breach record in our data set. type: String - contextPath: SpyCloud.Username.email description: Email address. type: String - contextPath: SpyCloud.Username.email_domain description: Domain extracted from 'email_address' field. This is not a SLD, but everything after the '@' symbol. type: String - contextPath: SpyCloud.Username.email_username description: Username extracted from 'email' field. This is everything before the '@' symbol. type: String - contextPath: SpyCloud.Username.domain description: Domain name. type: String - arguments: - default: false description: This parameter allows you to define the starting point for a date range query on the spycloud_publish_date field. isArray: false name: since required: false secret: false - default: false description: This parameter allows you to define the ending point for a date range query on the spycloud_publish_date field. isArray: false name: until required: false secret: false - default: false description: This parameter allows you to define the starting point for a date range query on when an already published record was modified (record_modification_date). isArray: false name: since_modification_date required: false secret: false - default: false description: |- This parameter allows you to define the ending point for a date range query on the when an already published record was modified (record_modification_date). isArray: false name: until_modification_date required: false secret: false - default: false description: |- This parameter allows you to filter based on the numeric severity code. Possible values are: 2 -> Email only severity. This record is part of an email-only list. 5 -> Informational severity. This severity value is given to breach records where we have a non-crackable password hash, or no password at all. 20 ->High severity. This severity value is given to breach records where we have an email address and a plaintext password. 25 -> Critical severity. This severity value is given to breach records recovered from an infected machine (botnet data). These records will always have a plaintext password and most will have an email address. isArray: false name: severity predefined: - '' required: false secret: false - default: false description: This parameter allows you to filter based on a particular breach source. isArray: false name: source_id required: false secret: false - default: false description: The page number. Default is 1. isArray: false name: page required: false secret: false - default: false description: The number of requested results per page. Default is 50. isArray: false name: page_size required: false secret: false - default: false description: The maximum number of records to return from the collection. Limit default value is 50. isArray: false name: limit required: false secret: false - default: true description: IP address or network CIDR notation to search for. For CIDR notation, use an underscore instead of a slash. isArray: false name: ip required: true secret: false - auto: PREDEFINED default: false description: Fecth all results. isArray: false name: all_results predefined: - 'True' - 'False' required: false secret: false - default: false description: If hashing is enabled for your API key, you have the option to provide a 10 to 24 character, high entropy salt otherwise the pre-configured salt will be used. isArray: false name: salt required: false secret: false deprecated: false description: Get Breach Data by IP Address. execution: false name: spycloud-ip-address-data-get outputs: - contextPath: SpyCloud.IPAddress.username description: Username. type: String - contextPath: SpyCloud.IPAddress.password description: Account password. type: String - contextPath: SpyCloud.IPAddress.password_plaintext description: The cracked, plaintext version of the password (where the password is crackable). type: String - contextPath: SpyCloud.IPAddress.password_type description: Password type for original password as found in the data breach. This will either be plaintext or one of the many password hash/encryption types (SHA1, MD5, 3DES, etc). type: String - contextPath: SpyCloud.IPAddress.target_url description: URL extracted from Botnet data. This is the URL that is captured from a key logger installed on an infected user's system. type: String - contextPath: SpyCloud.IPAddress.user_browser description: Browser name. type: String - contextPath: SpyCloud.IPAddress.ip_addresses description: List of one or more IP addresses in alphanumeric format. Both IPV4 and IPv6 addresses are supported. type: String - contextPath: SpyCloud.IPAddress.infected_machine_id description: A unique identifier either extracted from an infostealer log, when present, or an RFC 4122-compliant universally unique identifier (UUID) generated by SpyCloud, when no identifier is present in an infected record. The method of generation of these identifiers varies by malware family and may or may not conform to a UUID format. For the ID's in the aforementioned UUID format, there is not currently any way to determine whether an infected_machine_id was extracted from a malware log or generated by SpyCloud. type: String - contextPath: SpyCloud.IPAddress.infected_path description: The local path to the malicious software installed on the infected user's system. type: String - contextPath: SpyCloud.IPAddress.infected_time description: The time at which the user's system was infected with malicious software. type: Date - contextPath: SpyCloud.IPAddress.user_sys_domain description: System domain. This usually comes from Botnet data. type: String - contextPath: SpyCloud.IPAddress.user_hostname description: System hostname. This usually comes from Botnet data. type: String - contextPath: SpyCloud.IPAddress.user_os description: System OS name. This usually comes from Botnet data. type: String - contextPath: SpyCloud.IPAddress.user_sys_registered_owner description: System registered owner name. This usually comes from Botnet data. type: String - contextPath: SpyCloud.IPAddress.source_id description: Numerical breach ID. This correlates directly with the id field in Breach Catalog objects. type: Number - contextPath: SpyCloud.IPAddress.spycloud_publish_date description: The date on which we ingested the breached data into our systems. This is the same date on which the data becomes publicly available to our customers. type: Date - contextPath: SpyCloud.IPAddress.target_domain description: SLD extracted from 'target_url' field. type: String - contextPath: SpyCloud.IPAddress.target_subdomain description: Subdomain and SLD extracted from 'target_url' field. type: String - contextPath: SpyCloud.IPAddress.severity description: 'Severity is a numeric code representing severity of a breach record. This can be used in API requests to ensure only Breach Records with plaintext password are returned. Possible values are: 2 -> Email only severity. This record is part of an email-only list. 5 -> Informational severity. This severity value is given to breach records where we have a non-crackable password hash, or no password at all. 20 -> High severity. This severity value is given to breach records where we have an email address and a plaintext password. 25 -> Critical severity. This severity value is given to breach records recovered from an infected machine (botnet data). These records will always have a plaintext password and most will have an email address.' type: Number - contextPath: SpyCloud.IPAddress.document_id description: UUID v4 string which uniquely identifies this breach record in our data set. type: String - contextPath: SpyCloud.IPAddress.email description: Email address. type: String - contextPath: SpyCloud.IPAddress.email_domain description: Domain extracted from 'email_address' field. This is not a SLD, but everything after the '@' symbol. type: String - contextPath: SpyCloud.IPAddress.email_username description: Username extracted from 'email' field. This is everything before the '@' symbol. type: String - contextPath: SpyCloud.IPAddress.domain description: Domain name. type: String - arguments: - default: false description: This parameter allows you to define the starting point for a date range query on the spycloud_publish_date field. isArray: false name: since required: false secret: false - default: false description: This parameter allows you to define the ending point for a date range query on the spycloud_publish_date field. isArray: false name: until required: false secret: false - default: false description: This parameter allows you to define the starting point for a date range query on when an already published record was modified (record_modification_date). isArray: false name: since_modification_date required: false secret: false - default: false description: |- This parameter allows you to define the ending point for a date range query on the when an already published record was modified (record_modification_date). isArray: false name: until_modification_date required: false secret: false - default: false description: |- This parameter allows you to filter based on the numeric severity code. Possible values are: 2 -> Email only severity. This record is part of an email-only list. 5 -> Informational severity. This severity value is given to breach records where we have a non-crackable password hash, or no password at all. 20 ->High severity. This severity value is given to breach records where we have an email address and a plaintext password. 25 -> Critical severity. This severity value is given to breach records recovered from an infected machine (botnet data). These records will always have a plaintext password and most will have an email address. isArray: false name: severity predefined: - '' required: false secret: false - default: false description: This parameter allows you to filter based on a particular breach source. isArray: false name: source_id required: false secret: false - default: false description: The page number. Default is 1. isArray: false name: page required: false secret: false - default: false description: The number of requested results per page. Default is 50. isArray: false name: page_size required: false secret: false - default: false description: The maximum number of records to return from the collection. Limit default value is 50. isArray: false name: limit required: false secret: false - default: true description: Email address to search for. isArray: false name: email required: true secret: false - auto: PREDEFINED default: false description: Fetch all results. isArray: false name: all_results predefined: - 'True' - 'False' required: false secret: false - default: false description: If hashing is enabled for your API key, you have the option to provide a 10 to 24 character, high entropy salt otherwise the pre-configured salt will be used. isArray: false name: salt required: false secret: false deprecated: false description: Get Breach Data by Email. execution: false name: spycloud-email-data-get outputs: - contextPath: SpyCloud.EmailAddress.username description: Username. type: String - contextPath: SpyCloud.EmailAddress.password description: Account password. type: String - contextPath: SpyCloud.EmailAddress.password_plaintext description: The cracked, plaintext version of the password (where the password is crackable). type: String - contextPath: SpyCloud.EmailAddress.password_type description: Password type for original password as found in the data breach. This will either be plaintext or one of the many password hash/encryption types (SHA1, MD5, 3DES, etc). type: String - contextPath: SpyCloud.EmailAddress.target_url description: URL extracted from Botnet data. This is the URL that is captured from a key logger installed on an infected user's system. type: String - contextPath: SpyCloud.EmailAddress.user_browser description: Browser name. type: String - contextPath: SpyCloud.EmailAddress.ip_addresses description: List of one or more IP addresses in alphanumeric format. Both IPV4 and IPv6 addresses are supported. type: String - contextPath: SpyCloud.EmailAddress.infected_machine_id description: A unique identifier either extracted from an infostealer log, when present, or an RFC 4122-compliant universally unique identifier (UUID) generated by SpyCloud, when no identifier is present in an infected record. The method of generation of these identifiers varies by malware family and may or may not conform to a UUID format. For the ID's in the aforementioned UUID format, there is not currently any way to determine whether an infected_machine_id was extracted from a malware log or generated by SpyCloud. type: String - contextPath: SpyCloud.EmailAddress.infected_path description: The local path to the malicious software installed on the infected user's system. type: String - contextPath: SpyCloud.EmailAddress.infected_time description: The time at which the user's system was infected with malicious software. type: Date - contextPath: SpyCloud.EmailAddress.user_sys_domain description: System domain. This usually comes from Botnet data. type: String - contextPath: SpyCloud.EmailAddress.user_hostname description: System hostname. This usually comes from Botnet data. type: String - contextPath: SpyCloud.EmailAddress.user_os description: System OS name. This usually comes from Botnet data. type: String - contextPath: SpyCloud.EmailAddress.user_sys_registered_owner description: System registered owner name. This usually comes from Botnet data. type: String - contextPath: SpyCloud.EmailAddress.source_id description: Numerical breach ID. This correlates directly with the id field in Breach Catalog objects. type: Number - contextPath: SpyCloud.EmailAddress.spycloud_publish_date description: The date on which we ingested the breached data into our systems. This is the same date on which the data becomes publicly available to our customers. type: Date - contextPath: SpyCloud.EmailAddress.target_domain description: SLD extracted from 'target_url' field. type: String - contextPath: SpyCloud.EmailAddress.target_subdomain description: Subdomain and SLD extracted from 'target_url' field. type: String - contextPath: SpyCloud.EmailAddress.severity description: 'Severity is a numeric code representing severity of a breach record. This can be used in API requests to ensure only Breach Records with plaintext password are returned. Possible values are: 2 -> Email only severity. This record is part of an email-only list. 5 -> Informational severity. This severity value is given to breach records where we have a non-crackable password hash, or no password at all. 20 -> High severity. This severity value is given to breach records where we have an email address and a plaintext password. 25 -> Critical severity. This severity value is given to breach records recovered from an infected machine (botnet data). These records will always have a plaintext password and most will have an email address.' type: Number - contextPath: SpyCloud.EmailAddress.document_id description: UUID v4 string which uniquely identifies this breach record in our data set. type: String - contextPath: SpyCloud.EmailAddress.email description: Email address. type: String - contextPath: SpyCloud.EmailAddress.email_domain description: Domain extracted from 'email_address' field. This is not a SLD, but everything after the '@' symbol. type: String - contextPath: SpyCloud.EmailAddress.email_username description: Username extracted from 'email' field. This is everything before the '@' symbol. type: String - contextPath: SpyCloud.EmailAddress.domain description: Domain name. type: String - arguments: - default: false description: This parameter allows you to define the starting point for a date range query on the spycloud_publish_date field. isArray: false name: since required: false secret: false - default: false description: This parameter allows you to define the ending point for a date range query on the spycloud_publish_date field. isArray: false name: until required: false secret: false - default: false description: This parameter allows you to define the starting point for a date range query on when an already published record was modified (record_modification_date). isArray: false name: since_modification_date required: false secret: false - default: false description: |- This parameter allows you to define the ending point for a date range query on the when an already published record was modified (record_modification_date). isArray: false name: until_modification_date required: false secret: false - default: false description: |- This parameter allows you to filter based on the numeric severity code. Possible values are: 2 -> Email only severity. This record is part of an email-only list. 5 -> Informational severity. This severity value is given to breach records where we have a non-crackable password hash, or no password at all. 20 ->High severity. This severity value is given to breach records where we have an email address and a plaintext password. 25 -> Critical severity. This severity value is given to breach records recovered from an infected machine (botnet data). These records will always have a plaintext password and most will have an email address. isArray: false name: severity predefined: - '' required: false secret: false - default: false description: This parameter allows you to filter based on a particular breach source. isArray: false name: source_id required: false secret: false - default: false description: The page number. Default is 1. isArray: false name: page required: false secret: false - default: false description: The number of requested results per page. Default is 50. isArray: false name: page_size required: false secret: false - default: false description: The maximum number of records to return from the collection. Limit default value is 50. isArray: false name: limit required: false secret: false - default: true description: Password you wish to search for. isArray: false name: password required: true secret: false - auto: PREDEFINED default: false description: Fetch all results. isArray: false name: all_results predefined: - 'True' - 'False' required: false secret: false - default: false description: If hashing is enabled for your API key, you have the option to provide a 10 to 24 character, high entropy salt otherwise the pre-configured salt will be used. isArray: false name: salt required: false secret: false deprecated: false description: Get Breach Data by Password. execution: false name: spycloud-password-data-get outputs: - contextPath: SpyCloud.Password.username description: Username. type: String - contextPath: SpyCloud.Password.password description: Account password. type: String - contextPath: SpyCloud.Password.password_plaintext description: The cracked, plaintext version of the password (where the password is crackable). type: String - contextPath: SpyCloud.Password.password_type description: Password type for original password as found in the data breach. This will either be plaintext or one of the many password hash/encryption types (SHA1, MD5, 3DES, etc). type: String - contextPath: SpyCloud.Password.target_url description: URL extracted from Botnet data. This is the URL that is captured from a key logger installed on an infected user's system. type: String - contextPath: SpyCloud.Password.user_browser description: Browser name. type: String - contextPath: SpyCloud.Password.ip_addresses description: List of one or more IP addresses in alphanumeric format. Both IPV4 and IPv6 addresses are supported. type: String - contextPath: SpyCloud.Password.infected_machine_id description: A unique identifier either extracted from an infostealer log, when present, or an RFC 4122-compliant universally unique identifier (UUID) generated by SpyCloud, when no identifier is present in an infected record. The method of generation of these identifiers varies by malware family and may or may not conform to a UUID format. For the ID's in the aforementioned UUID format, there is not currently any way to determine whether an infected_machine_id was extracted from a malware log or generated by SpyCloud. type: String - contextPath: SpyCloud.Password.infected_path description: The local path to the malicious software installed on the infected user's system. type: String - contextPath: SpyCloud.Password.infected_time description: The time at which the user's system was infected with malicious software. type: Date - contextPath: SpyCloud.Password.user_sys_domain description: System domain. This usually comes from Botnet data. type: String - contextPath: SpyCloud.Password.user_hostname description: System hostname. This usually comes from Botnet data. type: String - contextPath: SpyCloud.Password.user_os description: System OS name. This usually comes from Botnet data. type: String - contextPath: SpyCloud.Password.user_sys_registered_owner description: System registered owner name. This usually comes from Botnet data. type: String - contextPath: SpyCloud.Password.source_id description: Numerical breach ID. This correlates directly with the id field in Breach Catalog objects. type: Number - contextPath: SpyCloud.Password.spycloud_publish_date description: The date on which we ingested the breached data into our systems. This is the same date on which the data becomes publicly available to our customers. type: Date - contextPath: SpyCloud.Password.target_domain description: SLD extracted from 'target_url' field. type: String - contextPath: SpyCloud.Password.target_subdomain description: Subdomain and SLD extracted from 'target_url' field. type: String - contextPath: SpyCloud.Password.severity description: 'Severity is a numeric code representing severity of a breach record. This can be used in API requests to ensure only Breach Records with plaintext password are returned. Possible values are: 2 -> Email only severity. This record is part of an email-only list. 5 -> Informational severity. This severity value is given to breach records where we have a non-crackable password hash, or no password at all. 20 -> High severity. This severity value is given to breach records where we have an email address and a plaintext password. 25 -> Critical severity. This severity value is given to breach records recovered from an infected machine (botnet data). These records will always have a plaintext password and most will have an email address.' type: Number - contextPath: SpyCloud.Password.document_id description: UUID v4 string which uniquely identifies this breach record in our data set. type: String - contextPath: SpyCloud.Password.email description: Email address. type: String - contextPath: SpyCloud.Password.email_domain description: Domain extracted from 'email_address' field. This is not a SLD, but everything after the '@' symbol. type: String - contextPath: SpyCloud.Password.email_username description: Username extracted from 'email' field. This is everything before the '@' symbol. type: String - contextPath: SpyCloud.Password.domain description: Domain name. type: String - arguments: - default: false description: This parameter allows you to define the starting point for a date range query on the spycloud_publish_date field. isArray: false name: since required: false secret: false - default: false description: This parameter allows you to define the ending point for a date range query on the spycloud_publish_date field. isArray: false name: until required: false secret: false - default: false description: This parameter allows you to define the starting point for a date range query on when an already published record was modified (record_modification_date). isArray: false name: since_modification_date required: false secret: false - default: false description: |- This parameter allows you to define the ending point for a date range query on the when an already published record was modified (record_modification_date). isArray: false name: until_modification_date required: false secret: false - default: false description: |- This parameter allows you to filter based on the numeric severity code. Possible values are: 2 -> Email only severity. This record is part of an email-only list. 5 -> Informational severity. This severity value is given to breach records where we have a non-crackable password hash, or no password at all. 20 ->High severity. This severity value is given to breach records where we have an email address and a plaintext password. 25 -> Critical severity. This severity value is given to breach records recovered from an infected machine (botnet data). These records will always have a plaintext password and most will have an email address. isArray: false name: severity predefined: - '' required: false secret: false - default: false description: This parameter allows you to filter based on a particular breach source. isArray: false name: source_id required: false secret: false - default: false description: The page number. Default is 1. isArray: false name: page required: false secret: false - default: false description: The number of requested results per page. Default is 50. isArray: false name: page_size required: false secret: false - default: false description: The maximum number of records to return from the collection. Limit default value is 50. isArray: false name: limit required: false secret: false - auto: PREDEFINED default: false description: This parameter lets you filter results by type. The allowed values are 'corporate' for corporate records, and 'infected' for infected user records (from botnet data). If no value has been provided the API function will, by default, return all record types. isArray: false name: type predefined: - corporate - infected required: false secret: false - auto: PREDEFINED default: false description: This parameters lets you filter results for only emails or only domains on your watchlist. If no value has been provided, the API will return all watchlist types. isArray: false name: watchlist_type predefined: - email - domain - subdomain - ip required: false secret: false - auto: PREDEFINED default: false description: Fetch all results. isArray: false name: all_results predefined: - 'True' - 'False' required: false secret: false - default: false description: If hashing is enabled for your API key, you have the option to provide a 10 to 24 character, high entropy salt otherwise the pre-configured salt will be used. isArray: false name: salt required: false secret: false deprecated: false description: List Breach Data. By default, this lists all breach data for the customer's configured watchlist. With the arguments, it's possible to scope the results. execution: false name: spycloud-watchlist-data-list outputs: - contextPath: SpyCloud.Watchlist.username description: Username. type: String - contextPath: SpyCloud.Watchlist.password description: Account password. type: String - contextPath: SpyCloud.Watchlist.password_plaintext description: The cracked, plaintext version of the password (where the password is crackable). type: String - contextPath: SpyCloud.Watchlist.password_type description: Password type for original password as found in the data breach. This will either be plaintext or one of the many password hash/encryption types (SHA1, MD5, 3DES, etc). type: String - contextPath: SpyCloud.Watchlist.target_url description: URL extracted from Botnet data. This is the URL that is captured from a key logger installed on an infected user's system. type: String - contextPath: SpyCloud.Watchlist.user_browser description: Browser name. type: String - contextPath: SpyCloud.Watchlist.ip_addresses description: List of one or more IP addresses in alphanumeric format. Both IPV4 and IPv6 addresses are supported. type: String - contextPath: SpyCloud.Watchlist.infected_machine_id description: A unique identifier either extracted from an infostealer log, when present, or an RFC 4122-compliant universally unique identifier (UUID) generated by SpyCloud, when no identifier is present in an infected record. The method of generation of these identifiers varies by malware family and may or may not conform to a UUID format. For the ID's in the aforementioned UUID format, there is not currently any way to determine whether an infected_machine_id was extracted from a malware log or generated by SpyCloud. type: String - contextPath: SpyCloud.Watchlist.infected_path description: The local path to the malicious software installed on the infected user's system. type: String - contextPath: SpyCloud.Watchlist.infected_time description: The time at which the user's system was infected with malicious software. type: Date - contextPath: SpyCloud.Watchlist.user_sys_domain description: System domain. This usually comes from Botnet data. type: String - contextPath: SpyCloud.Watchlist.user_hostname description: System hostname. This usually comes from Botnet data. type: String - contextPath: SpyCloud.Watchlist.user_os description: System OS name. This usually comes from Botnet data. type: String - contextPath: SpyCloud.Watchlist.user_sys_registered_owner description: System registered owner name. This usually comes from Botnet data. type: String - contextPath: SpyCloud.Watchlist.source_id description: Numerical breach ID. This correlates directly with the id field in Breach Catalog objects. type: Number - contextPath: SpyCloud.Watchlist.spycloud_publish_date description: The date on which we ingested the breached data into our systems. This is the same date on which the data becomes publicly available to our customers. type: Date - contextPath: SpyCloud.Watchlist.target_domain description: SLD extracted from 'target_url' field. type: String - contextPath: SpyCloud.Watchlist.target_subdomain description: Subdomain and SLD extracted from 'target_url' field. type: String - contextPath: SpyCloud.Watchlist.severity description: 'Severity is a numeric code representing severity of a breach record. This can be used in API requests to ensure only Breach Records with plaintext password are returned. Possible values are: 2 -> Email only severity. This record is part of an email-only list. 5 -> Informational severity. This severity value is given to breach records where we have a non-crackable password hash, or no password at all. 20 -> High severity. This severity value is given to breach records where we have an email address and a plaintext password. 25 -> Critical severity. This severity value is given to breach records recovered from an infected machine (botnet data). These records will always have a plaintext password and most will have an email address.' type: Number - contextPath: SpyCloud.Watchlist.document_id description: UUID v4 string which uniquely identifies this breach record in our data set. type: String - contextPath: SpyCloud.Watchlist.email description: Email address. type: String - contextPath: SpyCloud.Watchlist.email_domain description: Domain extracted from 'email_address' field. This is not a SLD, but everything after the '@' symbol. type: String - contextPath: SpyCloud.Watchlist.email_username description: Username extracted from 'email' field. This is everything before the '@' symbol. type: String - contextPath: SpyCloud.Watchlist.domain description: Domain name. type: String - arguments: - default: false description: One or more comma delimited Infected Machine ID to search for compass breach records. isArray: false name: infected_machine_id required: true secret: false - default: false description: The maximum number of records to return from the collection. Limit default value is 50. isArray: false name: limit required: false secret: false - default: false description: The page number. Default is 1. isArray: false name: page required: false secret: false - default: false description: The number of requested results per page. Default is 50. isArray: false name: page_size required: false secret: false - default: false description: If hashing is enabled for your API key, you have the option to provide a 10 to 24 character, high entropy salt otherwise the pre-configured salt will be used. isArray: false name: salt required: false secret: false deprecated: false description: Get Compass device data by infected_machine_id. execution: false name: spycloud-compass-device-data-get outputs: - contextPath: SpyCloud.CompassDeviceData.username description: Username. type: String - contextPath: SpyCloud.CompassDeviceData.password description: Account password. type: String - contextPath: SpyCloud.CompassDeviceData.password_plaintext description: The cracked, plaintext version of the password (where the password is crackable). type: String - contextPath: SpyCloud.CompassDeviceData.password_type description: Password type for original password as found in the data breach. This will either be plaintext or one of the many password hash/encryption types (SHA1, MD5, 3DES, etc). type: String - contextPath: SpyCloud.CompassDeviceData.target_url description: URL extracted from Botnet data. This is the URL that is captured from a key logger installed on an infected user's system. type: String - contextPath: SpyCloud.CompassDeviceData.user_browser description: Browser name. type: String - contextPath: SpyCloud.CompassDeviceData.ip_addresses description: List of one or more IP addresses in alphanumeric format. Both IPV4 and IPv6 addresses are supported. type: String - contextPath: SpyCloud.CompassDeviceData.infected_machine_id description: A unique identifier either extracted from an infostealer log, when present, or an RFC 4122-compliant universally unique identifier (UUID) generated by SpyCloud, when no identifier is present in an infected record. The method of generation of these identifiers varies by malware family and may or may not conform to a UUID format. For the ID's in the aforementioned UUID format, there is not currently any way to determine whether an infected_machine_id was extracted from a malware log or generated by SpyCloud. type: String - contextPath: SpyCloud.CompassDeviceData.infected_path description: The local path to the malicious software installed on the infected user's system. type: String - contextPath: SpyCloud.CompassDeviceData.infected_time description: The time at which the user's system was infected with malicious software. type: Date - contextPath: SpyCloud.CompassDeviceData.user_sys_domain description: System domain. This usually comes from Botnet data. type: String - contextPath: SpyCloud.CompassDeviceData.user_hostname description: System hostname. This usually comes from Botnet data. type: String - contextPath: SpyCloud.CompassDeviceData.user_os description: System OS name. This usually comes from Botnet data. type: String - contextPath: SpyCloud.CompassDeviceData.user_sys_registered_owner description: System registered owner name. This usually comes from Botnet data. type: String - contextPath: SpyCloud.CompassDeviceData.source_id description: Numerical breach ID. This correlates directly with the id field in Breach Catalog objects. type: Number - contextPath: SpyCloud.CompassDeviceData.spycloud_publish_date description: The date on which we ingested the breached data into our systems. This is the same date on which the data becomes publicly available to our customers. type: Date - contextPath: SpyCloud.CompassDeviceData.target_domain description: SLD extracted from 'target_url' field. type: String - contextPath: SpyCloud.CompassDeviceData.target_subdomain description: Subdomain and SLD extracted from 'target_url' field. type: String - contextPath: SpyCloud.CompassDeviceData.severity description: 'Severity is a numeric code representing severity of a breach record. This can be used in API requests to ensure only Breach Records with plaintext password are returned. Possible values are: 2 -> Email only severity. This record is part of an email-only list. 5 -> Informational severity. This severity value is given to breach records where we have a non-crackable password hash, or no password at all. 20 -> High severity. This severity value is given to breach records where we have an email address and a plaintext password. 25 -> Critical severity. This severity value is given to breach records recovered from an infected machine (botnet data). These records will always have a plaintext password and most will have an email address.' type: Number - contextPath: SpyCloud.CompassDeviceData.document_id description: UUID v4 string which uniquely identifies this breach record in our data set. type: String - contextPath: SpyCloud.CompassDeviceData.email description: Email address. type: String - contextPath: SpyCloud.CompassDeviceData.email_domain description: Domain extracted from 'email_address' field. This is not a SLD, but everything after the '@' symbol. type: String - contextPath: SpyCloud.CompassDeviceData.email_username description: Username extracted from 'email' field. This is everything before the '@' symbol. type: String - contextPath: SpyCloud.CompassDeviceData.domain description: Domain name. type: String - arguments: - default: false description: |- This parameter allows you to define the starting point for a date range query on the spycloud_publish_date field. isArray: false name: since required: false secret: false - default: false description: |- This parameter allows you to define the ending point for a date range query on the spycloud_publish_date field. isArray: false name: until required: false secret: false - default: false description: This parameter allows you to define the starting point for a date range query on the infected_time field. isArray: false name: since_infected required: false secret: false - default: false description: This parameter allows you to define the ending point for a date range query on the infected_time field. isArray: false name: until_infected required: false secret: false - default: false description: This parameter allows you to filter based on a particular breach source. isArray: false name: source_id required: false secret: false - default: false description: The page number. Default is 1. isArray: false name: page required: false secret: false - default: false description: The number of requested results per page. Default is 50. isArray: false name: page_size required: false secret: false - default: false description: |- The maximum number of records to return from the collection. Limit default value is 50. isArray: false name: limit required: false secret: false - auto: PREDEFINED default: false description: This parameter will return records that are verified or unverified, meaning those that matched the watchlist or not. By default if type is not used, both types will be returned. isArray: false name: type predefined: - verified - unverified required: false secret: false - auto: PREDEFINED default: false description: Fetch all results. isArray: false name: all_results predefined: - 'True' - 'False' required: false secret: false deprecated: false description: List Compass data. By default, this lists all Compass data. With the arguments, it's possible to scope the results. execution: false name: spycloud-compass-data-list outputs: - contextPath: SpyCloud.CompassDataList.username description: Username. type: String - contextPath: SpyCloud.CompassDataList.password description: Account password. type: String - contextPath: SpyCloud.CompassDataList.password_plaintext description: The cracked, plaintext version of the password (where the password is crackable). type: String - contextPath: SpyCloud.CompassDataList.password_type description: Password type for original password as found in the data breach. This will either be plaintext or one of the many password hash/encryption types (SHA1, MD5, 3DES, etc). type: String - contextPath: SpyCloud.CompassDataList.target_url description: URL extracted from Botnet data. This is the URL that is captured from a key logger installed on an infected user's system. type: String - contextPath: SpyCloud.CompassDataList.user_browser description: Browser name. type: String - contextPath: SpyCloud.CompassDataList.ip_addresses description: List of one or more IP addresses in alphanumeric format. Both IPV4 and IPv6 addresses are supported. type: String - contextPath: SpyCloud.CompassDataList.infected_machine_id description: A unique identifier either extracted from an infostealer log, when present, or an RFC 4122-compliant universally unique identifier (UUID) generated by SpyCloud, when no identifier is present in an infected record. The method of generation of these identifiers varies by malware family and may or may not conform to a UUID format. For the ID's in the aforementioned UUID format, there is not currently any way to determine whether an infected_machine_id was extracted from a malware log or generated by SpyCloud. type: String - contextPath: SpyCloud.CompassDataList.infected_path description: The local path to the malicious software installed on the infected user's system. type: String - contextPath: SpyCloud.CompassDataList.infected_time description: The time at which the user's system was infected with malicious software. type: Date - contextPath: SpyCloud.CompassDataList.user_sys_domain description: System domain. This usually comes from Botnet data. type: String - contextPath: SpyCloud.CompassDataList.user_hostname description: System hostname. This usually comes from Botnet data. type: String - contextPath: SpyCloud.CompassDataList.user_os description: System OS name. This usually comes from Botnet data. type: String - contextPath: SpyCloud.CompassDataList.user_sys_registered_owner description: System registered owner name. This usually comes from Botnet data. type: String - contextPath: SpyCloud.CompassDataList.source_id description: Numerical breach ID. This correlates directly with the id field in Breach Catalog objects. type: Number - contextPath: SpyCloud.CompassDataList.spycloud_publish_date description: The date on which we ingested the breached data into our systems. This is the same date on which the data becomes publicly available to our customers. type: Date - contextPath: SpyCloud.CompassDataList.target_domain description: SLD extracted from 'target_url' field. type: String - contextPath: SpyCloud.CompassDataList.target_subdomain description: Subdomain and SLD extracted from 'target_url' field. type: String - contextPath: SpyCloud.CompassDataList.severity description: 'Severity is a numeric code representing severity of a breach record. This can be used in API requests to ensure only Breach Records with plaintext password are returned. Possible values are: 2 -> Email only severity. This record is part of an email-only list. 5 -> Informational severity. This severity value is given to breach records where we have a non-crackable password hash, or no password at all. 20 -> High severity. This severity value is given to breach records where we have an email address and a plaintext password. 25 -> Critical severity. This severity value is given to breach records recovered from an infected machine (botnet data). These records will always have a plaintext password and most will have an email address.' type: Number - contextPath: SpyCloud.CompassDataList.document_id description: UUID v4 string which uniquely identifies this breach record in our data set. type: String - contextPath: SpyCloud.CompassDataList.email description: Email address. type: String - contextPath: SpyCloud.CompassDataList.email_domain description: Domain extracted from 'email_address' field. This is not a SLD, but everything after the '@' symbol. type: String - contextPath: SpyCloud.CompassDataList.email_username description: Username extracted from 'email' field. This is everything before the '@' symbol. type: String - contextPath: SpyCloud.CompassDataList.domain description: Domain name. type: String - arguments: - default: false description: This parameter allows you to filter based on a particular breach source. isArray: false name: source_id required: false secret: false - default: false description: This parameter allows you to define the starting point for a date range query on the spycloud_publish_date field. isArray: false name: since required: false secret: false - default: false description: This parameter allows you to define the ending point for a date range query on the spycloud_publish_date field. isArray: false name: until required: false secret: false - default: false description: This parameter allows you to define the starting point for a date range query on the infected_time. isArray: false name: since_infected required: false secret: false - default: false description: This parameter allows you to define the ending point for a date range query on the infected_time field. isArray: false name: until_infected required: false secret: false - default: false description: |- The maximum number of records to return from the collection. Limit default value is 50. isArray: false name: limit required: false secret: false - default: false description: The page number. Default is 1. isArray: false name: page required: false secret: false - default: false description: The number of requested results per page. Default is 50. isArray: false name: page_size required: false secret: false deprecated: false description: List Compass device data. By default, this lists all devices. With the arguments, it's possible to scope the results. execution: false name: spycloud-compass-device-list outputs: - contextPath: SpyCloud.CompassDeviceList.username description: Username. type: String - contextPath: SpyCloud.CompassDeviceList.password description: Account password. type: String - contextPath: SpyCloud.CompassDeviceList.password_plaintext description: The cracked, plaintext version of the password (where the password is crackable). type: String - contextPath: SpyCloud.CompassDeviceList.password_type description: Password type for original password as found in the data breach. This will either be plaintext or one of the many password hash/encryption types (SHA1, MD5, 3DES, etc). type: String - contextPath: SpyCloud.CompassDeviceList.target_url description: URL extracted from Botnet data. This is the URL that is captured from a key logger installed on an infected user's system. type: String - contextPath: SpyCloud.CompassDeviceList.user_browser description: Browser name. type: String - contextPath: SpyCloud.CompassDeviceList.ip_addresses description: List of one or more IP addresses in alphanumeric format. Both IPV4 and IPv6 addresses are supported. type: String - contextPath: SpyCloud.CompassDeviceList.infected_machine_id description: A unique identifier either extracted from an infostealer log, when present, or an RFC 4122-compliant universally unique identifier (UUID) generated by SpyCloud, when no identifier is present in an infected record. The method of generation of these identifiers varies by malware family and may or may not conform to a UUID format. For the ID's in the aforementioned UUID format, there is not currently any way to determine whether an infected_machine_id was extracted from a malware log or generated by SpyCloud. type: String - contextPath: SpyCloud.CompassDeviceList.infected_path description: The local path to the malicious software installed on the infected user's system. type: String - contextPath: SpyCloud.CompassDeviceList.infected_time description: The time at which the user's system was infected with malicious software. type: Date - contextPath: SpyCloud.CompassDeviceList.user_sys_domain description: System domain. This usually comes from Botnet data. type: String - contextPath: SpyCloud.CompassDeviceList.user_hostname description: System hostname. This usually comes from Botnet data. type: String - contextPath: SpyCloud.CompassDeviceList.user_os description: System OS name. This usually comes from Botnet data. type: String - contextPath: SpyCloud.CompassDeviceList.user_sys_registered_owner description: System registered owner name. This usually comes from Botnet data. type: String - contextPath: SpyCloud.CompassDeviceList.source_id description: Numerical breach ID. This correlates directly with the id field in Breach Catalog objects. type: Number - contextPath: SpyCloud.CompassDeviceList.spycloud_publish_date description: The date on which we ingested the breached data into our systems. This is the same date on which the data becomes publicly available to our customers. type: Date - contextPath: SpyCloud.CompassDeviceList.target_domain description: SLD extracted from 'target_url' field. type: String - contextPath: SpyCloud.CompassDeviceList.target_subdomain description: Subdomain and SLD extracted from 'target_url' field. type: String - contextPath: SpyCloud.CompassDeviceList.severity description: 'Severity is a numeric code representing severity of a breach record. This can be used in API requests to ensure only Breach Records with plaintext password are returned. Possible values are: 2 -> Email only severity. This record is part of an email-only list. 5 -> Informational severity. This severity value is given to breach records where we have a non-crackable password hash, or no password at all. 20 -> High severity. This severity value is given to breach records where we have an email address and a plaintext password. 25 -> Critical severity. This severity value is given to breach records recovered from an infected machine (botnet data). These records will always have a plaintext password and most will have an email address.' type: Number - contextPath: SpyCloud.CompassDeviceList.document_id description: UUID v4 string which uniquely identifies this breach record in our data set. type: String - contextPath: SpyCloud.CompassDeviceList.email description: Email address. type: String - contextPath: SpyCloud.CompassDeviceList.email_domain description: Domain extracted from 'email_address' field. This is not a SLD, but everything after the '@' symbol. type: String - contextPath: SpyCloud.CompassDeviceList.email_username description: Username extracted from 'email' field. This is everything before the '@' symbol. type: String - contextPath: SpyCloud.CompassDeviceList.domain description: Domain name. type: String - arguments: - default: false description: One or more comma delimited Compass target application (subdomain or domain) to search for. isArray: false name: target_application required: true secret: false - default: false description: This parameter allows you to define the starting point for a date range query on the spycloud_publish_date field. isArray: false name: since required: false secret: false - default: false description: This parameter allows you to define the ending point for a date range query on the spycloud_publish_date field. isArray: false name: until required: false secret: false - default: false description: This parameter allows you to filter based on a particular breach source. isArray: false name: source_id required: false secret: false - default: false description: |- The maximum number of records to return from the collection. Limit default value is 50. isArray: false name: limit required: false secret: false - default: false description: The page number. Default is 1. isArray: false name: page required: false secret: false - default: false description: The number of requested results per page. Default is 50. isArray: false name: page_size required: false secret: false - default: false description: If hashing is enabled for your API key, you have the option to provide a 10 to 24 character, high entropy salt otherwise the pre-configured salt will be used. isArray: false name: salt required: false secret: false deprecated: false description: Get Compass application data for a specific application. execution: false name: spycloud-compass-application-data-get outputs: - contextPath: SpyCloud.CompassApplicationData.username description: Username. type: String - contextPath: SpyCloud.CompassApplicationData.password description: Account password. type: String - contextPath: SpyCloud.CompassApplicationData.password_plaintext description: The cracked, plaintext version of the password (where the password is crackable). type: String - contextPath: SpyCloud.CompassApplicationData.password_type description: Password type for original password as found in the data breach. This will either be plaintext or one of the many password hash/encryption types (SHA1, MD5, 3DES, etc). type: String - contextPath: SpyCloud.CompassApplicationData.target_url description: URL extracted from Botnet data. This is the URL that is captured from a key logger installed on an infected user's system. type: String - contextPath: SpyCloud.CompassApplicationData.user_browser description: Browser name. type: String - contextPath: SpyCloud.CompassApplicationData.ip_addresses description: List of one or more IP addresses in alphanumeric format. Both IPV4 and IPv6 addresses are supported. type: String - contextPath: SpyCloud.CompassApplicationData.infected_machine_id description: A unique identifier either extracted from an infostealer log, when present, or an RFC 4122-compliant universally unique identifier (UUID) generated by SpyCloud, when no identifier is present in an infected record. The method of generation of these identifiers varies by malware family and may or may not conform to a UUID format. For the ID's in the aforementioned UUID format, there is not currently any way to determine whether an infected_machine_id was extracted from a malware log or generated by SpyCloud. type: String - contextPath: SpyCloud.CompassApplicationData.infected_path description: The local path to the malicious software installed on the infected user's system. type: String - contextPath: SpyCloud.CompassApplicationData.infected_time description: The time at which the user's system was infected with malicious software. type: Date - contextPath: SpyCloud.CompassApplicationData.user_sys_domain description: System domain. This usually comes from Botnet data. type: String - contextPath: SpyCloud.CompassApplicationData.user_hostname description: System hostname. This usually comes from Botnet data. type: String - contextPath: SpyCloud.CompassApplicationData.user_os description: System OS name. This usually comes from Botnet data. type: String - contextPath: SpyCloud.CompassApplicationData.user_sys_registered_owner description: System registered owner name. This usually comes from Botnet data. type: String - contextPath: SpyCloud.CompassApplicationData.source_id description: Numerical breach ID. This correlates directly with the id field in Breach Catalog objects. type: Number - contextPath: SpyCloud.CompassApplicationData.spycloud_publish_date description: The date on which we ingested the breached data into our systems. This is the same date on which the data becomes publicly available to our customers. type: Date - contextPath: SpyCloud.CompassApplicationData.target_domain description: SLD extracted from 'target_url' field. type: String - contextPath: SpyCloud.CompassApplicationData.target_subdomain description: Subdomain and SLD extracted from 'target_url' field. type: String - contextPath: SpyCloud.CompassApplicationData.severity description: 'Severity is a numeric code representing severity of a breach record. This can be used in API requests to ensure only Breach Records with plaintext password are returned. Possible values are: 2 -> Email only severity. This record is part of an email-only list. 5 -> Informational severity. This severity value is given to breach records where we have a non-crackable password hash, or no password at all. 20 -> High severity. This severity value is given to breach records where we have an email address and a plaintext password. 25 -> Critical severity. This severity value is given to breach records recovered from an infected machine (botnet data). These records will always have a plaintext password and most will have an email address.' type: Number - contextPath: SpyCloud.CompassApplicationData.document_id description: UUID v4 string which uniquely identifies this breach record in our data set. type: String - contextPath: SpyCloud.CompassApplicationData.email description: Email address. type: String - contextPath: SpyCloud.CompassApplicationData.email_domain description: Domain extracted from 'email_address' field. This is not a SLD, but everything after the '@' symbol. type: String - contextPath: SpyCloud.CompassApplicationData.email_username description: Username extracted from 'email' field. This is everything before the '@' symbol. type: String - contextPath: SpyCloud.CompassApplicationData.domain description: Domain name. type: String runonce: false script: '-' type: python subtype: python3 dockerimage: demisto/python3:3.12.13.10116658 fromversion: 6.10.0 tests: - No tests (auto formatted)