Spycloud

The SpyCloud connector provides access to a comprehensive database of breached credentials and personal information, enabling proactive threat mitigation and account protection.

SpyCloud is a leader in cybercrime analytics and identity protection, offering a comprehensive database of compromised assets. The SpyCloud Turbine Connector enables users to automate the retrieval of compromised application and device data, breach details, and specific application or device breach information. By integrating with SpyCloud, Swimlane Turbine users can proactively protect against account takeovers, streamline breach analysis, and enhance their security posture with actionable intelligence on exposed credentials and potential threats.

Prerequisites

To effectively utilize the SpyCloud connector with Swimlane Turbine, ensure you have the following:

API Key Authentication with the necessary parameters:

URL: Endpoint for SpyCloud API services.

SpyCloud API Key: Unique identifier to authenticate requests.

Capabilities

This plugin provides the following capabilities:

Get Compass Applications List

Get Compass Breach Data by Application Search

Get Compass Breach Data

Get Compass Devices Data

Get Compass Devices List

API Documentation Link

For more information on SpyCloud is found at: SpyCloud API Documentation

Configurations

SpyCloud API Key Authentication

Authenticates using an API Key

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
X-API-KEY	SpyCloud API key.	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Get Compass Applications List

Retrieve a list of compromised applications from SpyCloud's Compass database.

Endpoint

URL: /enterprise-v2/compass/applications

Method: GET

Input

Argument Name	Type	Required	Description
parameters.since	string	Optional	This parameter allows you to define the starting point for a date range query on the spycloud_publish_date field.
parameters.until	string	Optional	This parameter allows you to define the ending point for a date range query on the spycloud_publish_date field.
parameters.cursor	string	Optional	Token used for iterating through multiple pages of results.

Input Example

{"parameters":{"since":"2018-02-15","until":"2020-02-15","cursor":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
cursor	string	Output field: cursor
hits	number	Output field: hits
results	array	Result of the operation
results.target_application	string	Result of the operation
results.latest_spycloud_publish_date	string	Result of the operation
results.first_spycloud_publish_date	string	Result of the operation
results.total_records	number	Result of the operation
results.compromised_device_count	number	Result of the operation
results.email_count	number	Result of the operation
results.username_count	number	Name of the resource
results.on_watchlist	string	Result of the operation

Output Example

{"status_code":200,"response_headers":{"Cache-Control":"no-store, no-cache","Pragma":"no-cache","Content-Type":"application/json; charset=utf-8","Expires":"-1","Strict-Transport-Security":"max-age=31536000; includeSubDomains","Date":"Mon, 09 Sep 2024 10:38:54 GMT","Content-Length":"1460"},"reason":"OK","json_body":{"cursor":"","hits":3,"results":[{},{},{}]}}

Get Compass Breach Data

Retrieve breach data from SpyCloud Compass, providing insights into exposed credentials and potential threats.

Endpoint

URL: /enterprise-v2/compass/data

Method: GET

Input

Argument Name	Type	Required	Description
parameters.source_id	string	Optional	This parameter allows you to filter based on a particular breach source. A comma separated list of source ids can also be used.
parameters.since	string	Optional	This parameter allows you to define the starting point for a date range query on the spycloud_publish_date field.
parameters.until	string	Optional	This parameter allows you to define the ending point for a date range query on the spycloud_publish_date field.
parameters.since_infected	string	Optional	This parameter allows you to define the starting point for a date range query on the infected_time field.
parameters.until_infected	string	Optional	This parameter allows you to define the ending point for a date range query on the infected_time field.
parameters.type	string	Optional	This parameter will return records that are verified or unverified, meaning those that matched the watchlist or not. By default if type is not used, both types will be returned.
parameters.cursor	string	Optional	Token used for iterating through multiple pages of results.
parameters.salt	string	Optional	If hashing is enabled for your API key, you have the option to provide a 10 to 24 character, high entropy salt otherwise the pre-configured salt will be used.

Input Example

{"parameters":{"source_id":"93894","since":"2018-02-15","until":"2020-02-15","since_infected":"2019-02-15","until_infected":"2021-02-15","type":"plaintext","cursor":"","salt":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
cursor	string	Output field: cursor
hits	number	Output field: hits
results	array	Result of the operation
results.user_browser	string	Result of the operation
results.password	string	Result of the operation
results.document_id	string	Unique identifier
results.source_id	number	Unique identifier
results.email	string	Result of the operation
results.ip_addresses	array	Result of the operation
results.country	string	Result of the operation
results.infected_machine_id	string	Unique identifier
results.infected_path	string	Result of the operation
results.user_os	string	Result of the operation
results.av_softwares	array	Result of the operation
results.log_id	string	Unique identifier
results.user_hostname	string	Name of the resource
results.user_sys_registered_owner	string	Result of the operation
results.keyboard_languages	string	Result of the operation
results.target_url	string	URL endpoint for the request
results.infected_time	string	Result of the operation
results.spycloud_publish_date	string	Result of the operation
results.email_domain	string	Result of the operation
results.email_username	string	Name of the resource

Output Example

Get Compass Breach Data by Application Search

Retrieve breach data for a specified application from SpyCloud's Compass database using the target application parameter.

Endpoint

URL: /enterprise-v2/compass/data/applications/{{target_application}}

Method: GET

Input

Argument Name	Type	Required	Description
parameters.source_id	number	Optional	This parameter allows you to filter based on a particular breach source.
parameters.since	string	Optional	This parameter allows you to define the starting point for a date range query on the spycloud_publish_date field.
parameters.until	string	Optional	This parameter allows you to define the ending point for a date range query on the spycloud_publish_date field.
parameters.salt	string	Optional	If hashing is enabled for your API key, you have the option to provide a 10 to 24 character, high entropy salt otherwise the pre-configured salt will be used.
path_parameters.target_application	string	Required	One or more comma delimited Compass target application (subdomain or domain) to search for.

Input Example

{"parameters":{"source_id":42436,"since":"2018-02-15","until":"2020-02-15","salt":""},"path_parameters":{"target_application":"19372"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
cursor	string	Output field: cursor
hits	number	Output field: hits
results	array	Result of the operation
results.username	string	Name of the resource
results.password	string	Result of the operation
results.password_plaintext	string	Result of the operation
results.password_type	string	Type of the resource
results.target_url	string	URL endpoint for the request
results.user_browser	string	Result of the operation
results.ip_addresses	array	Result of the operation
results.av_softwares	array	Result of the operation
results.log_id	string	Unique identifier
results.infected_machine_id	string	Unique identifier
results.infected_path	string	Result of the operation
results.infected_time	string	Result of the operation
results.user_sys_domain	string	Result of the operation
results.user_hostname	string	Name of the resource
results.user_os	string	Result of the operation
results.user_sys_registered_owner	string	Result of the operation
results.source_id	number	Unique identifier
results.spycloud_publish_date	string	Result of the operation
results.target_domain	string	Result of the operation
results.target_subdomain	string	Result of the operation

Output Example

Get Compass Devices Data

Retrieve breach data for a specific infected machine from SpyCloud using the machine's unique ID.

Endpoint

URL: /enterprise-v2/compass/data/devices/{{infected_machine_id}}

Method: GET

Input

Argument Name	Type	Required	Description
parameters.cursor	string	Optional	Token used for iterating through multiple pages of results.
parameters.salt	string	Optional	If hashing is enabled for your API key, you have the option to provide a 10 to 24 character, high entropy salt otherwise the pre-configured salt will be used.
path_parameters.infected_machine_id	string	Required	An Infected Machine ID to search for compass breach records.

Input Example

{"parameters":{"cursor":"","salt":""},"path_parameters":{"infected_machine_id":"76c9a60b-1d06-4bc1-8e08-4f07f82c0bdd"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
cursor	string	Output field: cursor
hits	number	Output field: hits
results	array	Result of the operation
results.user_browser	string	Result of the operation
results.password	string	Result of the operation
results.document_id	string	Unique identifier
results.source_id	number	Unique identifier
results.email	string	Result of the operation
results.ip_addresses	array	Result of the operation
results.country	string	Result of the operation
results.infected_machine_id	string	Unique identifier
results.infected_path	string	Result of the operation
results.user_os	string	Result of the operation
results.av_softwares	array	Result of the operation
results.log_id	string	Unique identifier
results.user_hostname	string	Name of the resource
results.user_sys_registered_owner	string	Result of the operation
results.keyboard_languages	string	Result of the operation
results.target_url	string	URL endpoint for the request
results.infected_time	string	Result of the operation
results.spycloud_publish_date	string	Result of the operation
results.email_domain	string	Result of the operation
results.email_username	string	Name of the resource

Output Example

Get Compass Devices List

Retrieve a list of compromised devices from SpyCloud's Compass database for analysis or monitoring.

Endpoint

URL: /enterprise-v2/compass/devices

Method: GET

Input

Argument Name	Type	Required	Description
parameters.source_id	string	Optional	This parameter allows you to filter based on a particular breach source. A comma separated list of source ids can also be used.
parameters.since	string	Optional	This parameter allows you to define the starting point for a date range query on the spycloud_publish_date field.
parameters.until	string	Optional	This parameter allows you to define the ending point for a date range query on the spycloud_publish_date field.
parameters.since_infected	string	Optional	This parameter allows you to define the starting point for a date range query on the infected_time.
parameters.until_infected	string	Optional	This parameter allows you to define the ending point for a date range query on the infected_time field.
parameters.salt	string	Optional	If hashing is enabled for your API key, you have the option to provide a 10 to 24 character, high entropy salt otherwise the pre-configured salt will be used.

Input Example

{"parameters":{"source_id":"40347","since":"2018-02-15","until":"2020-02-15","since_infected":"2019-02-15","until_infected":"2021-02-15","salt":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
hits	number	Output field: hits
results	array	Result of the operation
results.log_id	string	Unique identifier
results.user_hostname	string	Name of the resource
results.user_os	string	Result of the operation
results.ip_addresses	array	Result of the operation
results.source_id	number	Unique identifier
results.spycloud_publish_date	string	Result of the operation
results.infected_time	string	Result of the operation
results.application_count	number	Result of the operation
results.infected_device_id	string	Unique identifier

Output Example

Response Headers

Header	Description	Example
Cache-Control	Directives for caching mechanisms	no-store, no-cache
Content-Length	The length of the response body in bytes	1460
Content-Type	The media type of the resource	application/json; charset=utf-8
Date	The date and time at which the message was originated	Mon, 09 Sep 2024 10:38:54 GMT
Expires	The date/time after which the response is considered stale	-1
Pragma	HTTP response header: Pragma	no-cache
Strict-Transport-Security	HTTP response header: Strict-Transport-Security	max-age=31536000; includeSubDomains