hRun / SA-haveibeenpwned

Splunk add-on providing a custom search command to query Troy Hunt's haveibeenpwned API (https://haveibeenpwned.com/api/v3/) for known breaches of your domains or mail addresses.
https://splunkbase.splunk.com/app/5050/
Apache License 2.0
6 stars 4 forks source link

Extend App with additional "modes" (api endpoints) #11

Open sinloft opened 1 year ago

sinloft commented 1 year ago

Hi Harun,

it would be great if you could modify the app to include additional endpoints. I would be intrested in this one: GET https://haveibeenpwned.com/api/v3/breacheddomain/{domain} I understand, that it requires an Api key which might make it less valuable/interesting for a lot of users. But the https://haveibeenpwned.com/api/v3/breaches endpoint does not return any result if a breach was not against your company, but some company empoyees had accounts with their email in the breach.

Regards Chris

hRun commented 1 year ago

hi chris,

this sounds like a really good extension to the app indeed, no matter if key guarded or not. i currently have some time at hand and might be able to implement thi as early as next week. i'll keep you posted and have a look at some of the other endpoints as well.

cheers, harun

sinloft commented 1 year ago

Hi Harun,

Cool. I'm happy to test it, if you have time. But there is no hurry for me, the holiday season is not quite over yet.

Regards Chris

On 24 Aug 2023, at 17:41, hRun @.***> wrote:

hi chris,

this sounds like a really good extension to the app indeed, no matter if key guarded or not. i currently have some time at hand and might be able to implement thi as early as next week. i'll keep you posted and have a look at some of the other endpoints as well.

cheers, harun

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: @.***>

hRun commented 11 months ago

i pushed a version with the rudimentary implemented functionality "mode=monitored" to a new "develop" branch. as i myself don't own a domain with breached mail addresses, i could only simulate tests not do them with real data. would be happy if you could have a shot at testing and let me know about any issues and suggestions.

right now the command only pulls what is returned by the one endpoint directly, mail aliases and breach names. we could enrich that data with more info on the breaches (e.g. which personal info was breached) by doing some subsequent api calls. let me know if you think that would be meaningful.

the documentation on limitations of requests to the relevant api endpoints is a bit vague, but i already encountered them. i'll try to figure out how to improve the code in that regard, but we might have to accept that the command can be used only sparsely.

sinloft commented 11 months ago

Hi Harun,

sorry for not getting back. Thank you for the update. I did some tests which work all right. I noticed that we are underlicensed, I’ll try to get an upgrade and retest.

Regards Chris

On 8 Sep 2023, at 17:00, hRun @.***> wrote:

i pushed a version with the rudimentary implemented functionality "mode=monitored" to a new "develop" branch. as i myself don't own a domain with breached mail addresses, i could only simulate tests not do them with real data. would be happy if you could have a shot at testing and let me know about any issues and suggestions.

right now the command only pulls what is returned by the one endpoint directly, mail aliases and breach names. we could enrich that data with more info on the breaches (e.g. which personal info was breached) by doing some subsequent api calls. let me know if you think that would be meaningful.

the documentation on limitations of requests to the relevant api endpoints is a bit vague, but i already encountered them. i'll try to figure out how to improve the code in that regard, but we might have to accept that the command can be used only sparsely.

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: @.***>