Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

Enzoic is a security platform that helps prevent account takeover and fraud through compromised credential detection and password policy enforcement.

The Enzoic CDF for ThreatQ enables the automatic ingestion of all public exposures, or exposures pertaining to a particular domain. These exposures will be ingested as Events, which can be used to alert you of any new exposures that are discovered.

The integration provides the following feeds:

• Enzoic Exposures - ingests all public Exposures from the Enzoic API.
• Enzoic Exposures by Domain - ingests all Exposures and users for a specified domain from the Enzoic API.

The integration ingests the following system object types:

• Identities
  • Identity Attributes
• Events
  • Event Attributes

Installation

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Commercial option from the Category dropdown (optional).

   If you are installing the integration for the first time, it will be located under the Disabled tab.

3. Click on the integration entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   Parameter	Description
   API Key	Your Enzoic API Key.
   API Secret	Your Enzoic API Secret.
   Require Exposed Password	When enabled, the feeds will only ingest exposures that contain a password.
   Require Category (Exposures feed only)	When enabled, the feed will only ingest exposures that contain a category.  Example: Exposures listed as Unspecified will not be ingested.
   Minimum Entries (Exposures feed only)	The minimum number of entries an exposure must have in order to be ingested into the platform.
   Minimum Affected Domains (Exposures feed only)	The minimum number of affected domains an exposure must have in order to be ingested into the platform.
   Account Domain (Exposures by Domain feed only)	The domain to return exposures.  You must have permission to view exposures for the domain.

   
   
5. Review any additional settings, make any changes if needed, and click on Save.
6. Click on the toggle switch, located above the Additional Information section, to enable it.

ThreatQ Mapping

{
  "count": 3,
  "pagingToken": null,
  "exposures": [
    {
      "category": "Unspecified",
      "date": "2023-05-16T00:00:00.000Z",
      "dateAdded": "2023-05-16T07:02:13.000Z",
      "domainsAffected": 10,
      "entries": 60,
      "exposedData": ["Emails", "Passwords"],
      "id": "64632a759c64dcd3258785f0",
      "passwordType": "Cleartext",
      "source": "Messaging Services",
      "sourceFileCount": 1,
      "sourceURLs": ["telegram client"],
      "title": "Telegram File Download #2528 on Channel #-1001780683792"
    },
    {
      "category": "Unspecified",
      "date": "2023-05-16T00:00:00.000Z",
      "dateAdded": "2023-05-16T10:54:30.000Z",
      "domainsAffected": 2,
      "entries": 59,
      "exposedData": ["Emails", "Passwords"],
      "id": "646360e61368b1a3e91333f8",
      "passwordType": "Cleartext",
      "source": "Messaging Services",
      "sourceFileCount": 1,
      "sourceURLs": [],
      "title": "Telegram Message #45216 on Channel #-1001227389993"
    },
    {
      "category": "Unspecified",
      "date": "2023-05-16T00:00:00.000Z",
      "dateAdded": "2023-05-16T13:08:57.000Z",
      "domainsAffected": 4,
      "entries": 9,
      "exposedData": ["Emails", "Passwords"],
      "id": "646380694b721434189ae7e5",
      "passwordType": "Cleartext",
      "source": "Messaging Services",
      "sourceFileCount": 1,
      "sourceURLs": [],
      "title": "Telegram File Download #2531 on Channel #-1001780683792"
    }
  ]
}

{
  "count": 1,
  "pagingToken": "598e5b844eb6d82ea07c5783",
  "users": [
    {
      "username": "sample@email.tst",
      "exposures": ["57dc11964d6db21300991b78"]
    }
  ]
}

{
  "id": "57dc11964d6db21300991b78",
  "title": "funsurveys.net",
  "entries": 5123,
  "date": "2015-05-01T00:00:00.000Z",
  "category": "Manufacturing",
  "source": "Cybercrime Forums",
  "passwordType": "Cleartext",
  "exposedData": [
    "Emails",
    "Passwords"
  ],
  "dateAdded": "2016-09-16T15:36:54.000Z",
  "sourceURLs": [
    "https://www.someplace.com"
  ],
  "domainsAffected": 683,
  "sourceFileCount": 1
}

Average Feed Run

Object counts and Feed runtime are supplied as generalities only - objects returned by a provider can differ based on credential configurations and Feed runtime may vary based on system resources and load.

Enzoic Exposures

Enzoic Exposures by Domain

Known Issues / Limitations

• Enzoic Exposures - due to an Enzoic API limitation, the exposure feed can only return exposures found in the past 30 days.  

Change Log

• Version 1.0.0
  • Initial release