id: Check Point - Credential Leak Validation and Response
version: -1
name: Check Point - Credential Leak Validation and Response
description: |-
  Validates and responds to leaked employee or customer credentials reported by Cyberint Argos.

  The playbook looks up leaked credentials for the configured company domain (or, when no domain is configured, uses the exposed credentials embedded in the triggering Cyberint alert), escalates the incident when exposed credentials are found, and drives an automated or semi-automated remediation flow (reset sessions, force password reset, or disable the account in the identity provider), followed by user and SOC notification.

  Identity-provider validation and remediation steps are modeled as manual tasks so the playbook works out of the box; connect them to your Active Directory, Microsoft Entra ID or Okta integration to fully automate the response.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: dfdaffce-f9cb-4c69-974e-3a7a945f3173
    type: start
    task:
      id: dfdaffce-f9cb-4c69-974e-3a7a945f3173
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "12"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: 5368e943-2e5b-45d7-8514-3b9b063362d8
    type: condition
    task:
      id: 5368e943-2e5b-45d7-8514-3b9b063362d8
      version: -1
      name: Is the Check Point EM Feed integration enabled?
      description: Runs the IsIntegrationAvailable script against the Check Point EM Feed integration so the playbook can short-circuit gracefully if no instance is configured.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: Builtin
    nexttasks:
      "no":
      - "14"
      "yes":
      - "1"
    scriptarguments:
      brandname:
        simple: Cyberint Feed
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": -35
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "14":
    id: "14"
    taskid: 5de79a4a-5e59-448c-b11e-20cfeb2bb601
    type: title
    task:
      id: 5de79a4a-5e59-448c-b11e-20cfeb2bb601
      version: -1
      name: Check Point EM Feed Not Available
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      \'#none#\':
      - "15"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 0e151546-8f1d-4390-a51a-3aab89fd2449
    type: condition
    task:
      id: 0e151546-8f1d-4390-a51a-3aab89fd2449
      version: -1
      name: Is a company domain configured?
      type: condition
      iscommand: false
      brand: ""
      description: Verifies that a company domain was provided to look up leaked credentials against. When no domain is configured, the playbook falls back to the credentials embedded in the triggering Cyberint alert.
    nexttasks:
      '#default#':
      - "16"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: inputs.CompanyDomain
            iscontext: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: 44567ef4-6af2-4b72-b4c7-6c007365ced3
    type: regular
    task:
      id: 44567ef4-6af2-4b72-b4c7-6c007365ced3
      version: -1
      name: Look up leaked credentials by domain
      description: Queries the Cyberint leaked-credentials API for all credentials exposed for the company domain, optionally filtered by the date they were last seen. The task is skipped if the Check Point EM Feed integration is not enabled, allowing the playbook to continue gracefully.
      script: '|||cyberint-credential-leak-lookup'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      domain:
        complex:
          root: inputs.CompanyDomain
      last_seen_from:
        complex:
          root: inputs.LastSeenFrom
      limit:
        complex:
          root: inputs.Limit
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "3":
    id: "3"
    taskid: db5b1aac-7482-4aa4-8a5c-69e33f0ad7c4
    type: condition
    task:
      id: db5b1aac-7482-4aa4-8a5c-69e33f0ad7c4
      version: -1
      name: Were leaked credentials found?
      type: condition
      iscommand: false
      brand: ""
      description: Checks whether exposed credentials were found, either from the domain lookup or from the credentials embedded in the Cyberint alert.
    nexttasks:
      '#default#':
      - "11"
      "yes":
      - "4"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: greaterThan
          left:
            value:
              simple: Cyberint.LeakedCredential.total
            iscontext: true
          right:
            value:
              simple: "0"
        - operator: isNotEmpty
          left:
            value:
              simple: Cyberint.LeakedCredential.employee_credentials
            iscontext: true
        - operator: isNotEmpty
          left:
            value:
              simple: Cyberint.LeakedCredential.customer_credentials
            iscontext: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "4":
    id: "4"
    taskid: bf552076-c2a2-4c5e-97bb-2d4e825cc545
    type: regular
    task:
      id: bf552076-c2a2-4c5e-97bb-2d4e825cc545
      version: -1
      name: Escalate incident with Cyberint evidence
      description: Raises the incident severity and tags it so the exposed credentials reported by Cyberint are tracked as a high-priority case.
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      severity:
        simple: "3"
      tags:
        simple: cyberint-credential-leak
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "5":
    id: "5"
    taskid: 1132bc9c-b6f6-41a4-a775-329fd1db1590
    type: condition
    task:
      id: 1132bc9c-b6f6-41a4-a775-329fd1db1590
      version: -1
      name: Automated remediation enabled?
      type: condition
      iscommand: false
      brand: ""
      description: Determines whether to remediate exposed accounts automatically or to require analyst review first.
    nexttasks:
      '#default#':
      - "7"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.AutoRemediate
            iscontext: true
          right:
            value:
              simple: "yes"
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: 02f7ac58-33ed-4fe2-a0b8-b07d39b24db0
    type: regular
    task:
      id: 02f7ac58-33ed-4fe2-a0b8-b07d39b24db0
      version: -1
      name: Automated remediation of exposed accounts
      type: regular
      iscommand: false
      brand: Builtin
      script: Print
      scriptName: Print
      description: |-
        For each exposed account that is still active in the identity provider (Active Directory, Microsoft Entra ID or Okta): revoke active sessions, force a password reset, or disable the account.

        Connect this task to your identity-provider integration (for example ad-disable-account, msgraph-user-session-revoke, or okta-clear-user-sessions) to fully automate remediation.
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      value:
        simple: "Trigger automated remediation in your identity provider (Active Directory, Microsoft Entra ID or Okta): revoke active sessions, force a password reset, or disable the account.\nExposed employee accounts: ${Cyberint.LeakedCredential.employee_credentials.username}\nExposed customer accounts: ${Cyberint.LeakedCredential.customer_credentials.username}\nWire this task to your IdP integration (e.g. ad-disable-account, msgraph-user-session-revoke, or okta-clear-user-sessions) to fully automate remediation."
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 270,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: 6f248589-b32f-4254-bc61-d3e30104270f
    type: regular
    task:
      id: 6f248589-b32f-4254-bc61-d3e30104270f
      version: -1
      name: Analyst review and remediation approval
      type: regular
      iscommand: false
      brand: ""
      description: |-
        Analyst review required. This is a manual approval gate: the playbook pauses here until you complete this task.

        Exposed employee accounts: ${Cyberint.LeakedCredential.employee_credentials.username}
        Exposed customer accounts: ${Cyberint.LeakedCredential.customer_credentials.username}

        Review the leaked credentials returned by Cyberint (see Cyberint.LeakedCredential in the context), verify which exposed accounts are still active in the identity provider, and remediate the relevant accounts (revoke active sessions, force a password reset, or disable the account). Mark this task complete to approve and continue to the notification step.
    nexttasks:
      '#none#':
      - "8"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 660,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: f4258329-4413-4be3-9c36-038c5769a640
    type: regular
    task:
      id: f4258329-4413-4be3-9c36-038c5769a640
      version: -1
      name: Notify affected users and SOC team
      type: regular
      iscommand: false
      brand: Builtin
      script: Print
      scriptName: Print
      description: |-
        Notify the affected users that their credentials were exposed and have been remediated, and inform the SOC team that the credential leak has been handled.

        Connect this task to your email, Slack or Microsoft Teams integration to automate the notification.
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      value:
        simple: "Notification: exposed credentials reported by Cyberint have been remediated.\nAffected employee accounts: ${Cyberint.LeakedCredential.employee_credentials.username}\nAffected customer accounts: ${Cyberint.LeakedCredential.customer_credentials.username}\nWire this task to your email, Slack or Microsoft Teams integration to dispatch a real notification (e.g. send-mail, slack-send, ms-teams-message)."
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: be8c7280-5e00-412c-8e2c-f8d9b452c21b
    type: title
    task:
      id: be8c7280-5e00-412c-8e2c-f8d9b452c21b
      version: -1
      name: Credential Leak Response Complete
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      \'#none#\':
      - "15"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1430
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: 2e69a0dc-758e-4988-958c-8b269ef16226
    type: title
    task:
      id: 2e69a0dc-758e-4988-958c-8b269ef16226
      version: -1
      name: Missing Company Domain
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      \'#none#\':
      - "15"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 60,
          "y": 385
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: eeeda531-5d7f-45a2-a56b-2a6fc35ab512
    type: title
    task:
      id: eeeda531-5d7f-45a2-a56b-2a6fc35ab512
      version: -1
      name: No Leaked Credentials Found
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      \'#none#\':
      - "15"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 850,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "16":
    id: "16"
    taskid: a1111111-0000-4000-8000-000000000016
    type: condition
    task:
      id: a1111111-0000-4000-8000-000000000016
      version: -1
      name: Does the Cyberint alert contain exposed credentials?
      type: condition
      iscommand: false
      brand: ""
      description: When no company domain is configured, checks whether the triggering Cyberint alert carries its own exposed-credential records so the playbook can validate and respond to them directly.
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "17"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: incident.cyberintcredentialsexposedcsv
            iscontext: true
    view: |-
      {
        "position": {
          "x": 850,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "17":
    id: "17"
    taskid: a1111111-0000-4000-8000-000000000017
    type: condition
    task:
      id: a1111111-0000-4000-8000-000000000017
      version: -1
      name: Are these customer credentials?
      type: condition
      iscommand: false
      brand: ""
      description: Routes the alert's exposed credentials to the customer or employee record set based on the Cyberint alert type.
    nexttasks:
      '#default#':
      - "19"
      "yes":
      - "18"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: incident.cyberinttype
            iscontext: true
          right:
            value:
              simple: compromised_customer_credentials
          ignorecase: true
    view: |-
      {
        "position": {
          "x": 850,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "18":
    id: "18"
    taskid: a1111111-0000-4000-8000-000000000018
    type: regular
    task:
      id: a1111111-0000-4000-8000-000000000018
      version: -1
      name: Load customer credentials from the alert
      description: Populates the Cyberint.LeakedCredential customer records from the credentials embedded in the Cyberint alert.
      scriptName: Set
      script: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      key:
        simple: Cyberint.LeakedCredential.customer_credentials
      value:
        simple: ${incident.cyberintcredentialsexposedcsv}
      append:
        simple: "false"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 720,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "19":
    id: "19"
    taskid: a1111111-0000-4000-8000-000000000019
    type: regular
    task:
      id: a1111111-0000-4000-8000-000000000019
      version: -1
      name: Load employee credentials from the alert
      description: Populates the Cyberint.LeakedCredential employee records from the credentials embedded in the Cyberint alert.
      scriptName: Set
      script: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      key:
        simple: Cyberint.LeakedCredential.employee_credentials
      value:
        simple: ${incident.cyberintcredentialsexposedcsv}
      append:
        simple: "false"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 980,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "15":
    id: "15"
    taskid: cb74be11-77b0-4416-9861-58c6a201a363
    type: title
    task:
      id: cb74be11-77b0-4416-9861-58c6a201a363
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1875
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 2090,
        "width": 1180,
        "x": 50,
        "y": -150
      }
    }
  }
inputs:
- key: CompanyDomain
  value: {}
  required: false
  description: 'The company domain to look up leaked credentials for. Expected format: registered domain (no scheme, no path), e.g. ``example.com`` or ``acme.co``. When left empty, the playbook falls back to the exposed credentials embedded in the triggering Cyberint alert.'
  playbookInputQuery:
- key: LastSeenFrom
  value: {}
  required: false
  description: 'Only validate credentials last seen on or after this ISO-8601 date. Expected format: ``YYYY-MM-DDTHH:MM:SSZ``, e.g. ``2026-05-01T00:00:00Z``. Use this when running the playbook on a recurring schedule to process only newly leaked credentials.'
  playbookInputQuery:
- key: Limit
  value: {}
  required: false
  description: 'Maximum number of leaked credential records to retrieve per credential type (employee/customer). Accepts a positive integer, e.g. ``100``.'
  playbookInputQuery:
- key: AutoRemediate
  value:
    simple: "no"
  required: false
  description: 'Whether to remediate exposed accounts automatically (``yes``) or to require analyst review and approval first (``no``). Default is ``no``.'
  playbookInputQuery:
outputs:
- contextPath: Cyberint.LeakedCredential
  description: The leaked credentials returned by the Cyberint lookup, split into employee and customer records, each with username, exposure entries and first/last-seen dates.
  type: unknown
tests:
- Check Point - Credential Leak Validation and Response - Test
fromversion: 6.10.0
marketplaces:
- xsoar
- marketplacev2
- platform