--- title: Spycloud slug: connectors/spycloud docTags: createdAt: 2026-06-09T16:29:49.348Z --- The SpyCloud connector provides access to a comprehensive database of breached credentials and personal information, enabling proactive threat mitigation and account protection. SpyCloud is a leader in cybercrime analytics and identity protection, offering a comprehensive database of compromised assets. The SpyCloud Turbine Connector enables users to automate the retrieval of compromised application and device data, breach details, and specific application or device breach information. By integrating with SpyCloud, Swimlane Turbine users can proactively protect against account takeovers, streamline breach analysis, and enhance their security posture with actionable intelligence on exposed credentials and potential threats. ## Prerequisites To effectively utilize the SpyCloud connector with Swimlane Turbine, ensure you have the following: - API Key Authentication with the necessary parameters: - URL: Endpoint for SpyCloud API services. - SpyCloud API Key: Unique identifier to authenticate requests. ## Capabilities This plugin provides the following capabilities: - Get Compass Applications List - Get Compass Breach Data by Application Search - Get Compass Breach Data - Get Compass Devices Data - Get Compass Devices List ## API Documentation Link - For more information on SpyCloud is found at: [SpyCloud API Documentation](https://spycloud-external.readme.io/sc-enterprise-api/reference/compass-data-get) # Configurations ## SpyCloud API Key Authentication Authenticates using an API Key ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | X-API-KEY | SpyCloud API key. | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Get Compass Applications List Retrieve a list of compromised applications from SpyCloud's Compass database. ### Endpoint - **URL:** `/enterprise-v2/compass/applications` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------- | | `parameters.since` | string | Optional | This parameter allows you to define the starting point for a date range query on the spycloud\_publish\_date field. | | `parameters.until` | string | Optional | This parameter allows you to define the ending point for a date range query on the spycloud\_publish\_date field. | | `parameters.cursor` | string | Optional | Token used for iterating through multiple pages of results. | ### Input Example `{"parameters":{"since":"2018-02-15","until":"2020-02-15","cursor":""}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `cursor` | string | Output field: cursor | | `hits` | number | Output field: hits | | `results` | array | Result of the operation | | `results.target_application` | string | Result of the operation | | `results.latest_spycloud_publish_date` | string | Result of the operation | | `results.first_spycloud_publish_date` | string | Result of the operation | | `results.total_records` | number | Result of the operation | | `results.compromised_device_count` | number | Result of the operation | | `results.email_count` | number | Result of the operation | | `results.username_count` | number | Name of the resource | | `results.on_watchlist` | string | Result of the operation | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"no-store, no-cache","Pragma":"no-cache","Content-Type":"application/json; charset=utf-8","Expires":"-1","Strict-Transport-Security":"max-age=31536000; includeSubDomains","Date":"Mon, 09 Sep 2024 10:38:54 GMT","Content-Length":"1460"},"reason":"OK","json_body":{"cursor":"","hits":3,"results":[{},{},{}]}}` ## Get Compass Breach Data Retrieve breach data from SpyCloud Compass, providing insights into exposed credentials and potential threats. ### Endpoint - **URL:** `/enterprise-v2/compass/data` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.source_id` | string | Optional | This parameter allows you to filter based on a particular breach source. A comma separated list of source ids can also be used. | | `parameters.since` | string | Optional | This parameter allows you to define the starting point for a date range query on the spycloud\_publish\_date field. | | `parameters.until` | string | Optional | This parameter allows you to define the ending point for a date range query on the spycloud\_publish\_date field. | | `parameters.since_infected` | string | Optional | This parameter allows you to define the starting point for a date range query on the infected\_time field. | | `parameters.until_infected` | string | Optional | This parameter allows you to define the ending point for a date range query on the infected\_time field. | | `parameters.type` | string | Optional | This parameter will return records that are verified or unverified, meaning those that matched the watchlist or not. By default if type is not used, both types will be returned. | | `parameters.cursor` | string | Optional | Token used for iterating through multiple pages of results. | | `parameters.salt` | string | Optional | If hashing is enabled for your API key, you have the option to provide a 10 to 24 character, high entropy salt otherwise the pre-configured salt will be used. | ### Input Example `{"parameters":{"source_id":"93894","since":"2018-02-15","until":"2020-02-15","since_infected":"2019-02-15","until_infected":"2021-02-15","type":"plaintext","cursor":"","salt":""}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `cursor` | string | Output field: cursor | | `hits` | number | Output field: hits | | `results` | array | Result of the operation | | `results.user_browser` | string | Result of the operation | | `results.password` | string | Result of the operation | | `results.document_id` | string | Unique identifier | | `results.source_id` | number | Unique identifier | | `results.email` | string | Result of the operation | | `results.ip_addresses` | array | Result of the operation | | `results.country` | string | Result of the operation | | `results.infected_machine_id` | string | Unique identifier | | `results.infected_path` | string | Result of the operation | | `results.user_os` | string | Result of the operation | | `results.av_softwares` | array | Result of the operation | | `results.log_id` | string | Unique identifier | | `results.user_hostname` | string | Name of the resource | | `results.user_sys_registered_owner` | string | Result of the operation | | `results.keyboard_languages` | string | Result of the operation | | `results.target_url` | string | URL endpoint for the request | | `results.infected_time` | string | Result of the operation | | `results.spycloud_publish_date` | string | Result of the operation | | `results.email_domain` | string | Result of the operation | | `results.email_username` | string | Name of the resource | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"no-store, no-cache","Pragma":"no-cache","Content-Type":"application/json; charset=utf-8","Expires":"-1","Strict-Transport-Security":"max-age=31536000; includeSubDomains","Date":"Mon, 09 Sep 2024 10:38:54 GMT","Content-Length":"1460"},"reason":"OK","json_body":{"cursor":"","hits":2,"results":[{},{}]}}` ## Get Compass Breach Data by Application Search Retrieve breach data for a specified application from SpyCloud's Compass database using the target application parameter. ### Endpoint - **URL:** `/enterprise-v2/compass/data/applications/{{target_application}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------ | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.source_id` | number | Optional | This parameter allows you to filter based on a particular breach source. | | `parameters.since` | string | Optional | This parameter allows you to define the starting point for a date range query on the spycloud\_publish\_date field. | | `parameters.until` | string | Optional | This parameter allows you to define the ending point for a date range query on the spycloud\_publish\_date field. | | `parameters.salt` | string | Optional | If hashing is enabled for your API key, you have the option to provide a 10 to 24 character, high entropy salt otherwise the pre-configured salt will be used. | | `path_parameters.target_application` | string | Required | One or more comma delimited Compass target application (subdomain or domain) to search for. | ### Input Example `{"parameters":{"source_id":42436,"since":"2018-02-15","until":"2020-02-15","salt":""},"path_parameters":{"target_application":"19372"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `cursor` | string | Output field: cursor | | `hits` | number | Output field: hits | | `results` | array | Result of the operation | | `results.username` | string | Name of the resource | | `results.password` | string | Result of the operation | | `results.password_plaintext` | string | Result of the operation | | `results.password_type` | string | Type of the resource | | `results.target_url` | string | URL endpoint for the request | | `results.user_browser` | string | Result of the operation | | `results.ip_addresses` | array | Result of the operation | | `results.av_softwares` | array | Result of the operation | | `results.log_id` | string | Unique identifier | | `results.infected_machine_id` | string | Unique identifier | | `results.infected_path` | string | Result of the operation | | `results.infected_time` | string | Result of the operation | | `results.user_sys_domain` | string | Result of the operation | | `results.user_hostname` | string | Name of the resource | | `results.user_os` | string | Result of the operation | | `results.user_sys_registered_owner` | string | Result of the operation | | `results.source_id` | number | Unique identifier | | `results.spycloud_publish_date` | string | Result of the operation | | `results.target_domain` | string | Result of the operation | | `results.target_subdomain` | string | Result of the operation | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"no-store, no-cache","Pragma":"no-cache","Content-Type":"application/json; charset=utf-8","Expires":"-1","Strict-Transport-Security":"max-age=31536000; includeSubDomains","Date":"Mon, 09 Sep 2024 10:38:54 GMT","Content-Length":"1460"},"reason":"OK","json_body":{"cursor":"","hits":2,"results":[{},{}]}}` ## Get Compass Devices Data Retrieve breach data for a specific infected machine from SpyCloud using the machine's unique ID. ### Endpoint - **URL:** `/enterprise-v2/compass/data/devices/{{infected_machine_id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.cursor` | string | Optional | Token used for iterating through multiple pages of results. | | `parameters.salt` | string | Optional | If hashing is enabled for your API key, you have the option to provide a 10 to 24 character, high entropy salt otherwise the pre-configured salt will be used. | | `path_parameters.infected_machine_id` | string | Required | An Infected Machine ID to search for compass breach records. | ### Input Example `{"parameters":{"cursor":"","salt":""},"path_parameters":{"infected_machine_id":"76c9a60b-1d06-4bc1-8e08-4f07f82c0bdd"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `cursor` | string | Output field: cursor | | `hits` | number | Output field: hits | | `results` | array | Result of the operation | | `results.user_browser` | string | Result of the operation | | `results.password` | string | Result of the operation | | `results.document_id` | string | Unique identifier | | `results.source_id` | number | Unique identifier | | `results.email` | string | Result of the operation | | `results.ip_addresses` | array | Result of the operation | | `results.country` | string | Result of the operation | | `results.infected_machine_id` | string | Unique identifier | | `results.infected_path` | string | Result of the operation | | `results.user_os` | string | Result of the operation | | `results.av_softwares` | array | Result of the operation | | `results.log_id` | string | Unique identifier | | `results.user_hostname` | string | Name of the resource | | `results.user_sys_registered_owner` | string | Result of the operation | | `results.keyboard_languages` | string | Result of the operation | | `results.target_url` | string | URL endpoint for the request | | `results.infected_time` | string | Result of the operation | | `results.spycloud_publish_date` | string | Result of the operation | | `results.email_domain` | string | Result of the operation | | `results.email_username` | string | Name of the resource | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"no-store, no-cache","Pragma":"no-cache","Content-Type":"application/json; charset=utf-8","Expires":"-1","Strict-Transport-Security":"max-age=31536000; includeSubDomains","Date":"Mon, 09 Sep 2024 10:38:54 GMT","Content-Length":"1460"},"reason":"OK","json_body":{"cursor":"","hits":2,"results":[{},{}]}}` ## Get Compass Devices List Retrieve a list of compromised devices from SpyCloud's Compass database for analysis or monitoring. ### Endpoint - **URL:** `/enterprise-v2/compass/devices` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.source_id` | string | Optional | This parameter allows you to filter based on a particular breach source. A comma separated list of source ids can also be used. | | `parameters.since` | string | Optional | This parameter allows you to define the starting point for a date range query on the spycloud\_publish\_date field. | | `parameters.until` | string | Optional | This parameter allows you to define the ending point for a date range query on the spycloud\_publish\_date field. | | `parameters.since_infected` | string | Optional | This parameter allows you to define the starting point for a date range query on the infected\_time. | | `parameters.until_infected` | string | Optional | This parameter allows you to define the ending point for a date range query on the infected\_time field. | | `parameters.salt` | string | Optional | If hashing is enabled for your API key, you have the option to provide a 10 to 24 character, high entropy salt otherwise the pre-configured salt will be used. | ### Input Example `{"parameters":{"source_id":"40347","since":"2018-02-15","until":"2020-02-15","since_infected":"2019-02-15","until_infected":"2021-02-15","salt":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `hits` | number | Output field: hits | | `results` | array | Result of the operation | | `results.log_id` | string | Unique identifier | | `results.user_hostname` | string | Name of the resource | | `results.user_os` | string | Result of the operation | | `results.ip_addresses` | array | Result of the operation | | `results.source_id` | number | Unique identifier | | `results.spycloud_publish_date` | string | Result of the operation | | `results.infected_time` | string | Result of the operation | | `results.application_count` | number | Result of the operation | | `results.infected_device_id` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Cache-Control":"no-store, no-cache","Pragma":"no-cache","Content-Type":"application/json; charset=utf-8","Expires":"-1","Strict-Transport-Security":"max-age=31536000; includeSubDomains","Date":"Mon, 09 Sep 2024 10:38:54 GMT","Content-Length":"1460"},"reason":"OK","json_body":{"hits":3,"results":[{},{},{}]}}` # Response Headers | **Header** | **Description** | **Example** | | ------------------------- | ---------------------------------------------------------- | ----------------------------------- | | Cache-Control | Directives for caching mechanisms | no-store, no-cache | | Content-Length | The length of the response body in bytes | 1460 | | Content-Type | The media type of the resource | application/json; charset=utf-8 | | Date | The date and time at which the message was originated | Mon, 09 Sep 2024 10:38:54 GMT | | Expires | The date/time after which the response is considered stale | -1 | | Pragma | HTTP response header: Pragma | no-cache | | Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=31536000; includeSubDomains |