elastic / elastic/integrations

[New Integration] HaveIBeenPwned

Open
#17,352 3 comments 0 reactions 0 assignees View on GitHub
Category: Vulnerability Assessment New Integration Team:Security-Service Integrations
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 17h
Merged PRs (30d)
225

Description

HaveIBeenPwned (HIBP) is a service that allows users and organization admins to search for usernames and email addresses included in data breaches. Orgs can also use the HIBP API to retrieve breach information for all email addresses using the org's domains.

Useful API endpoints to retrieve

- **breacheddomain** : A list of email aliases on a domain. Each email alias has a list of breaches it was in
- **breaches**: This collects a list of all breaches and details of the breach.
- **subscribeddomains**: All domains the API key is subscribed to. This includes aggregated information such as total accounts and total accounts minus spamlists. It also includes information on the subscription itself, such as renewal date.

Example of breaches:
```json
[
{
"Name": "Adobe",
"Title": "Adobe",
"Domain": "adobe.com",
"BreachDate": "2013-10-04",
"AddedDate": "2013-12-04T00:00:00Z",
"ModifiedDate": "2022-05-15T23:52:49Z",
"PwnCount": 152445165,
"Description": "In October 2013, 153 million Adobe accounts were breached with each containing an internal ID, username, email, encrypted password and a password hint in plain text. The password cryptography was poorly done and many were quickly resolved back to plain text. The unencrypted hints also disclosed much about the passwords adding further to the risk that hundreds of millions of Adobe customers already faced.",
"LogoPath": "Adobe.png",
"DataClasses": [
"Email addresses",
"Password hints",
"Passwords",
"Usernames"
],
"IsVerified": true,
"IsFabricated": false,
"IsSensitive": false,
"IsRetired": false,
"IsSpamList": false,
"IsMalware": false,
"IsStealerLog": false,
"IsSubscriptionFree": false
},
```

Example of breached domain endpoint:

```json

{
"alias1": [
"Adobe"
],
"alias2": [
"Adobe",
"Gawker",
"Stratfor"
],
"alias3": [
"AshleyMadison"
]
}
```

Uses cases would be enrichment of alerts or events based on users included in breaches, threat intel enrichment, and entity-risk measurement.

---

I do have a custom integration built with elastic-package for for this. I'm willing to add that in a PR, though I'm not really sure how to go about that with a *new* integration.

Image

Example dashboard (most panels need the custom enrichment)

Image

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.