HackNotice

The HackNotice connector allows users to integrate real-time data breach alerts and threat intelligence into their security workflows.

Hacknotice is a digital guardian that provides real-time monitoring and analysis of data leaks and breaches. the hacknotice connector for swimlane turbine enables users to search for specific terms, count occurrences, and retrieve documents related to data leaks, both current and historical. this integration empowers security teams to proactively monitor for potential threats, analyze historical data for risk assessment, and respond swiftly to incidents. by leveraging hacknotice's capabilities within swimlane turbine, organizations can enhance their cyber threat intelligence and maintain a vigilant stance against data breaches.

Prerequisites

To effectively utilize the HackNotice connector for Turbine, ensure you have the following:

Custom Asset authentication with these parameters:

URL: The endpoint URL for the HackNotice API.

Username: Your HackNotice account username.

Password: Your HackNotice account password.

API Key: A unique key provided by HackNotice for accessing their API.

Capabilities

The HackNotice Has The Following Capabilities:

Count Search Term

Count Search Term with Start and End Dates

Read a Document

Read a Document From Leaked Files

Search all Leaked Files

Search all Leaks

Search Filename Term and Page

Search Term and Page

Search Term and Page with Start and End Dates

Search Word Pool and Page

Search Word Pool and Page with Start and End Dates

API Documentation Link

HackNotice API Documentation Link

Additional Documentation

HackNotice Connector Documentation

HackNotice API Documentation

Configurations

HackNotice Custom Asset

Authenticates using Custom Asset

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
verify_ssl	Verify SSL certificate.	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional
username	Username	string	Required
password	Password	string	Required
x-apikey	API key	string	Required

Actions

Count Search Term

Counts the occurrences of a search term in HackNotice, requiring specific data body and headers.

Endpoint

URL: /research/count/term

Method: POST

Input

Argument Name	Type	Required	Description
data_body	object	Required	Response data
data_body.term	string	Required	Any search word or phrase.
data_body.searchtype	string	Optional	Search types are match_phrase, wildcard_pre, wildcard_post, wildcard_both. If no or incorrect type is given, defaults to match_phrase.
data_body.filename	string	Optional	Response data
data_body.filesearchtype	string	Optional	Response data
headers	object	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request

Input Example

{"data_body":{"term":"example.org","searchtype":"match_phrase","filename":"000002_0.csv_recon-07-09-20","filesearchtype":"wildcard_post"},"headers":{"Content-Type":"application/x-www-form-urlencoded"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"X-Powered-By":"Express","content-type":"application/json","content-length":"1","Date":"Tue, 23 Apr 2024 07:02:36 GMT","Connection":"keep-alive"},"reason":"OK","json_body":0}

Count Search Term with Start and End Dates

Counts the occurrences of a search term within a specified date range in HackNotice, requiring data body and headers.

Endpoint

URL: /research/count/term

Method: POST

Input

Argument Name	Type	Required	Description
data_body	object	Required	Response data
data_body.term	string	Required	Any search word or phrase.
data_body.searchtype	string	Optional	Search types are match_phrase, wildcard_pre, wildcard_post, wildcard_both. If no or incorrect type is given, defaults to match_phrase.
data_body.startdate	string	Optional	Enter the start date in YYYY-MM-DD format.
data_body.enddate	string	Optional	Enter the end date in YYYY-MM-DD format.
headers	object	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request

Input Example

{"data_body":{"term":"example.com","searchtype":"match_phrase","startdate":"2019-01-01","enddate":"2019-04-01"},"headers":{"Content-Type":"application/x-www-form-urlencoded"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"X-Powered-By":"Express","content-type":"application/json","content-length":"5","Date":"Tue, 23 Apr 2024 16:33:12 GMT","Connection":"keep-alive"},"reason":"OK","json_body":94064}

Read a Document

Retrieve a specific document from HackNotice using the unique document ID provided in the path parameters.

Endpoint

URL: /leakReportsv2/{{documentId}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.documentId	string	Required	Parameters for the Read a Document action
headers	object	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request

Input Example

{"path_parameters":{"documentId":"5dc1d78637cb98580338fd6c"},"headers":{"Content-Type":"application/x-www-form-urlencoded"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
filenames	array	Name of the resource
filenames.file_name	string	Name of the resource
filenames.file	string	Name of the resource
_id	string	Unique identifier
domain	string	Output field: domain
leak_name	string	Name of the resource
description	string	Output field: description
published_date	string	Date value
timestamp	string	Output field: timestamp
tags	array	Output field: tags
tags.tags	array	Output field: tags.tags
tags._id	string	Unique identifier
tags.valueIndex	number	Value for the parameter
predicted_tags	array	Output field: predicted_tags
predicted_tags.file_name	string	Name of the resource
predicted_tags.file	string	Output field: predicted_tags.file
__v	number	Output field: __v
breachresolved	boolean	Output field: breachresolved

Output Example

{"status_code":200,"response_headers":{"X-Powered-By":"Express","content-type":"application/json","content-length":"450","etag":"\"296339361\"","Date":"Tue, 23 Apr 2024 07:34:03 GMT","Connection":"keep-alive"},"reason":"OK","json_body":{"filenames":[],"_id":"5dc1d78637cb98580338fd6c","domain":"twitter.com","leak_name":"Twitter.com","description":"Alleged leak of information related to the domain twitter.com","published_date":"2019-10-01T00:00:00.540Z","timestamp":"2019-11-05T20:11:50.180Z","tags...

Read a Document from Leaked Files

Retrieve a specific document from leaked files in HackNotice using the provided document ID.

Endpoint

URL: /leakfile/{{documentId}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.documentId	string	Required	Parameters for the Read a Document from Leaked Files action
headers	object	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request

Input Example

{"path_parameters":{"documentId":"5b74372f7629834dfefc15a5"},"headers":{"Content-Type":"application/x-www-form-urlencoded"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
size	number	Output field: size
linecount	number	Count value
password_type	string	Type of the resource
_id	string	Unique identifier
filename	object	Name of the resource
folder	object	Output field: folder
timestamp	object	Output field: timestamp
__v	number	Output field: __v
domain	string	Output field: domain
description	string	Output field: description
leak_name	string	Name of the resource
published_mo_yr	string	Output field: published_mo_yr
process_timestamp	object	Output field: process_timestamp
attemptedTag	boolean	Output field: attemptedTag
tags	array	Output field: tags
tags.tags	array	Output field: tags.tags
tags._id	string	Unique identifier
tags.valueIndex	number	Value for the parameter
retag	boolean	Output field: retag
predicted_tags	array	Output field: predicted_tags
predicted_tags.file_name	string	Name of the resource
predicted_tags.file	string	Output field: predicted_tags.file

Output Example

{"status_code":200,"response_headers":{"X-Powered-By":"Express","content-type":"application/json","content-length":"764","etag":"\"-229788744\"","Date":"Tue, 23 Apr 2024 15:34:36 GMT","Connection":"keep-alive"},"reason":"OK","json_body":{"size":4081437,"linecount":149695,"password_type":"none","_id":"5b74372f7629834dfefc15a5","filename":null,"folder":null,"timestamp":null,"__v":1,"domain":"leak.1-2019-combo","description":"A credential combination list shared during January 2019 in the hacker co...

Search All Leaked Files

Searches all leaked documents in HackNotice and returns them in reverse chronological order, requiring a data body input.

Endpoint

URL: /leakfile/search

Method: POST

Input

Argument Name	Type	Required	Description
data_body	object	Required	Response data
data_body.term	string	Required	String search for the exact value in the domain.

Input Example

{"data_body":{"term":"twitter.com"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"X-Powered-By":"Express","content-type":"application/json","content-length":"94487","Date":"Wed, 24 Apr 2024 07:44:03 GMT","Connection":"keep-alive"},"reason":"OK","json_body":[{"size":117046440,"linecount":3606790,"password_type":"plaintext","_id":"66020a8254f5372e640d1afe","filename":null,"__v":0,"published_mo_yr":"2024-03-01T00:00:00.488Z","timestamp":null,"process_timestamp":null,"folder":null,"domain":"twitter.com","description":"Alleged leak of inform...

Search All Leaks

Searches all HackNotice documents and returns them in reverse chronological order, requiring a data body input.

Endpoint

URL: /leakReportsv2/search

Method: POST

Input

Argument Name	Type	Required	Description
data_body	object	Required	Response data
data_body.term	string	Required	Inclusive string search for the value in the domain or title.

Input Example

{"data_body":{"term":"twitter.com"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Search Filename Term and Page

Performs a search for filenames across HackNotice pages, requiring path parameters and data body inputs.

Endpoint

URL: /research/search/filename/term/page/{{pageno}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.pageno	number	Required	Parameters for the Search Filename Term and Page action
data_body	object	Required	Response data
data_body.term	string	Required	Any search word or phrase.
data_body.searchtype	string	Required	Search types are match_phrase, wildcard_post. If incorrect type is given, defaults to match_phrase.
data_body.order	string	Optional	optional. default is asc (top of file first), can be desc.
data_body.searchafter	string	Optional	Optional. The sort integer of the last object. You use this to get pages after page 199. If this is set, it ignores the page in the url.
data_body.offset	number	Optional	Response data
data_body.creds	boolean	Optional	Response data
data_body.ncsv	boolean	Optional	Response data
data_body.redacted	boolean	Optional	Response data
headers	object	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request

Input Example

{"path_parameters":{"pageno":1},"data_body":{"term":"000002_0.csv_recon-07-09-20","searchtype":"wildcard_post","order":"asc","searchafter":"17374216","offset":18000,"creds":true,"ncsv":true,"redacted":true},"headers":{"Content-Type":"application/x-www-form-urlencoded"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"X-Powered-By":"Express","content-type":"application/json","content-length":"127650","Date":"Tue, 23 Apr 2024 17:17:33 GMT","Connection":"keep-alive"},"reason":"OK","json_body":[{"_index":"newleaks2","_type":"leak","_id":"+QtMK/1pD5FdJLoFdZpp+N9P0FI=","_score":null,"_source":{},"sort":[],"partial":false,"leakfileDoc":{}}]}

Search Term and Page

Performs a search in HackNotice using specified terms and retrieves results from the page number provided.

Endpoint

URL: /research/search/term/page/{{pageno}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.pageno	number	Required	Parameters for the Search Term and Page action
data_body	object	Required	Response data
data_body.term	string	Required	Any search word or phrase.
data_body.searchtype	string	Required	Search types are match_phrase, wildcard_pre, wildcard_post, wildcard_both. If incorrect type is given, defaults to match_phrase.
data_body.filename	string	Required	Response data
data_body.filesearchtype	string	Required	Response data
data_body.order	string	Optional	optional. default is desc (newest first), can be asc.
data_body.searchafter	number	Optional	Optional. The sort integer of the last object. You use this to get pages after page 199. If this is set, it ignores the page in the url.
data_body.creds	boolean	Optional	Response data
data_body.domainfilter	boolean	Optional	Response data
data_body.csv	boolean	Optional	Response data
data_body.word	boolean	Optional	Response data
data_body.credsonly	boolean	Optional	Response data
data_body.reacted	boolean	Optional	Response data
data_body.monthly	boolean	Optional	Response data
data_body.fullrecords	boolean	Optional	Response data
headers	object	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request

Input Example

{"path_parameters":{"pageno":1},"data_body":{"term":"google.com","searchtype":"match_phrase","filename":"000002_0.csv_recon-07-09-20","filesearchtype":"wildcard_post","order":"asc","searchafter":1522160999476,"creds":true,"domainfilter":true,"csv":true,"word":true,"credsonly":true,"reacted":false,"monthly":true,"fullrecords":true},"headers":{"Content-Type":"application/x-www-form-urlencoded"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
message	string	Response message

Output Example

{"status_code":401,"response_headers":{"X-Powered-By":"Express","content-type":"application/json","content-length":"34","Date":"Tue, 23 Apr 2024 17:22:38 GMT","Connection":"keep-alive"},"reason":"Unauthorized","json_body":{"message":"Search term required"}}

Search Term and Page with Start and End Dates

Performs a search in HackNotice using a term within specified start and end dates, returning results for a given page number.

Endpoint

URL: /research/search/term/page/{{pageno}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.pageno	number	Required	Parameters for the Search Term and Page with Start and End Dates action
data_body	object	Required	Response data
data_body.term	string	Required	Any search word or phrase.
data_body.searchtype	string	Required	Search types are match_phrase, wildcard_pre, wildcard_post, wildcard_both. If incorrect type is given, defaults to match_phrase.
data_body.startdate	string	Required	Enter a start date In YYYY-MM-DD format.
data_body.enddate	string	Required	Enter a end date In YYYY-MM-DD format.
data_body.order	string	Optional	optional. default is desc (newest first), can be asc.
data_body.searchafter	number	Optional	Optional. The sort integer of the last object. You use this to get pages after page 199. If this is set, it ignores the page in the url.
headers	object	Required	HTTP headers for the request
headers.Content-Type	string	Required	HTTP headers for the request

Input Example

{"path_parameters":{"pageno":1},"data_body":{"term":"example.org","searchtype":"match_phrase","startdate":"2019-03-01","enddate":"2019-04-01","order":"asc","searchafter":1551549891640},"headers":{"Content-Type":"application/x-www-form-urlencoded"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Search Word Pool and Page

Executes a search within a specified word pool and page number in HackNotice, requiring parameters like searchtype, pool, and match.

Endpoint

URL: /research/search/pool/page/{{pageno}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.pageno	number	Required	Parameters for the Search Word Pool and Page action
searchtype	string	Optional	Search types are match_phrase, wildcard_pre, wildcard_post, wildcard_both. If incorrect type is given, defaults to match_phrase.
pool	array	Optional	Parameter for Search Word Pool and Page
match	string	Optional	Parameter for Search Word Pool and Page
startdate	string	Optional	Enter a start date In YYYY-MM-DD format.
enddate	string	Optional	Enter a end date In YYYY-MM-DD format.
fullrecords	boolean	Optional	Parameter for Search Word Pool and Page

Input Example

{"json_body":{"searchtype":"word_pool","pool":["first","second"],"match":"2","startdate":"2015-04-03","enddate":"2022-07-30","fullrecords":true},"path_parameters":{"pageno":1}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"X-Powered-By":"Express","content-type":"application/json","content-length":"125992","Date":"Wed, 24 Apr 2024 08:13:11 GMT","Connection":"keep-alive"},"reason":"OK","json_body":[{"_index":"newleaks2","_type":"leak","_id":"+nJjuemP/hGzrkUpzyeQmNri2Ic=","_score":null,"_source":{},"highlight":{},"sort":[],"partial":true,"highlightv2":[],"leakfileDoc":{}}]}

Search Word Pool and Page with Start and End Dates

Performs a search within a specified word pool on HackNotice, filtering by dates and returning results for a given page number.

Endpoint

URL: /research/search/pool/page/{{pageno}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.pageno	number	Required	Parameters for the Search Word Pool and Page with Start and End Dates action
searchtype	string	Optional	Search types are match_phrase, wildcard_pre, wildcard_post, wildcard_both. If incorrect type is given, defaults to match_phrase.
pool	array	Optional	Parameter for Search Word Pool and Page with Start and End Dates
match	string	Optional	Parameter for Search Word Pool and Page with Start and End Dates
startdate	string	Optional	Enter a start date In YYYY-MM-DD format.
enddate	string	Optional	Enter a end date In YYYY-MM-DD format.
order	string	Optional	Parameter for Search Word Pool and Page with Start and End Dates
searchafter	number	Optional	Parameter for Search Word Pool and Page with Start and End Dates

Input Example

{"json_body":{"searchtype":"word_pool","pool":["1600","pennsylvania","washington"],"match":"3","startdate":"2018-12-01","enddate":"2019-04-01","order":"asc","searchafter":1544741801755},"path_parameters":{"pageno":1}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"X-Powered-By":"Express","content-type":"application/json","content-length":"363305","Date":"Wed, 24 Apr 2024 09:18:06 GMT","Connection":"keep-alive"},"reason":"OK","json_body":[{"_index":"newleaks2","_type":"leak","_id":"zwNU0L+pApEEGjj+c0GwZB+crRs=","_score":null,"_source":{},"highlight":{},"sort":[],"partial":true,"highlightv2":[],"leakfileDoc":{}}]}

Response Headers

Header	Description	Example
Connection	HTTP response header: Connection	keep-alive
content-length	The length of the response body in bytes	125992
content-type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Tue, 23 Apr 2024 16:33:12 GMT
etag	An identifier for a specific version of a resource	"-229788744"
X-Powered-By	HTTP response header: X-Powered-By	Express