CompromisedCredentialsFindingDetail

import type { CompromisedCredentialsFindingDetail } from "https://googleapis.deno.dev/v1/threatintelligence:v1beta.ts";

Sample compromised credential detail.

interface CompromisedCredentialsFindingDetail {

author?: string;

credentialService?: string;

darkWebDoc?: string;

externalReferenceUri?: string;

fileDump?: string;

fileDumpHashes?: string[];

fileDumpSizeBytes?: bigint;

forum?: string;

malwareFamily?: string;

postedTime?: Date;

sourceUri?: string;

userKey?: string;

userSecretEvidence?: string;

}

§Properties

author?: string

[src]

Optional. Reference to the author this detail was extracted from. This is deprecated and will be removed.

credentialService?: string

[src]

Optional. Claimed site the credential is intended for.

darkWebDoc?: string

[src]

Optional. Reference to the dark web document. This is deprecated and will be removed.

externalReferenceUri?: string

[src]

Optional. This will contain a link to the external reference for this credential. If set, this is a link back to the DTM product to allow customers to get additional context about this finding.

fileDump?: string

[src]

Optional. If the source of the credential was from a file dump this will contain the name of the file the credential was found in. This can be used by customers for context on where the credential was found and to try to find other references to the file in the wild.

fileDumpHashes?: string[]

[src]

Optional. A list of hashes of the file dump. These will be prefixed with the algorithm. Example: "sha256:"

fileDumpSizeBytes?: bigint

[src]

Optional. If file_dump is set this will contain the size of the dump file in bytes. File dumps can be very large.

forum?: string

[src]

Optional. Reference to the forum this detail was extracted from. This is deprecated and will be removed.

malwareFamily?: string

[src]

Optional. This will indicate the malware family that leaked this credential, if known.

postedTime?: Date

[src]

Optional. This indicates our best guess as to when the credential was leaked to the particular venue that triggered this finding. This is not necessarily the time the credential was actually leaked and it may not always be be accurate.

sourceUri?: string

[src]

Optional. If the source of a credential is publicly addressable this will contain a uri to the where the credential was found.

userKey?: string

[src]

Required. This field will always be set and will be used to identify the user named in the credential leak. In cases where customers are authorized to see the actual user key this will be set to the actual user key. In cases where the customer is not authorized to see the actual user key this will be set to a hash of the user key. The hashed value is an intentionally opaque value that is not intended to be used for any other purpose than to uniquely identify the user in the context of this specific customer, service domain, and user name. Example: "user@example.com" or "redacted:".

userSecretEvidence?: string

[src]

Optional. Claimed evidence of the password/secret. This will always be hashed. In the event where the plaintext password is known it will be set to "redacted:" where the same hash will be presented when the same password is found for the same organization for the same service. Redaction is done by hashing the password with a salt that is unique to the customer organization and service. In the event where the plaintext password is not known it will be set to ":" where the algorithm is the hash algorithm used and the hash is the hash of the password using that algorithm. In the event we don't know the exact algorithm used we will set it to "hashed:".