Email Address Enrichment - Generic v2.1
Common Playbooks Pack.#
This Playbook is part of theEnriches email addresses.
- Get information from Active Directory for internal addresses
- Get the domain-squatting reputation for external addresses
#
DependenciesThis playbook uses the following sub-playbooks, integrations, and scripts.
#
Sub-playbooksThis playbook does not use any sub-playbooks.
#
IntegrationsThis playbook does not use any integrations.
#
Scripts- IsEmailAddressInternal
- EmailDomainSquattingReputation
- Exists
#
Commands- ad-get-user
#
Playbook InputsName | Description | Default Value | Source | Required |
---|---|---|---|---|
InternalDomains | The CSV list of internal domains. The list will be used to determine whether an email address is internal or external. | None | inputs.InternalDomains | Optional |
The email addresses to enrich. | Email.Address | Account | Optional | |
Domain | The domains associated with the incident. These domains will be checked for domain-squatting. | None | inputs.Domain | Optional |
#
Playbook OutputsPath | Description | Type |
---|---|---|
Account | The account object. | unknown |
Account.Email.NetworkType | The email account networktype. Can be, "Internal" or "External". | string |
Account.Email.Distance.Domain | The compared domain. | string |
Account.Email.Distance.Value | The distance between the email domain and the compared domain. | number |
DBotScore | The DBotScore object. | unknown |