A Splunk® add-on providing a custom search command "haveibeenpwned" to query Troy Hunt's Have I Been Pwned API (https://haveibeenpwned.com/api/v3/) for known breaches of your (company's) domains or your friends'/family's/enemies'/hardly distantly related someone's/employees'/colleagues' mail adresses. Please respect people's privacy and adhere to the service's acceptable use (https://haveibeenpwned.com/API/v3#AcceptableUse). I tried respecting the limits posed on the API's use in the command's source code, which is why you'll have to have a little patience when querying for large amounts of mail addresses. I was unsatisfied with the publicly available Splunk add-ons already providing this functionality as they either didn't allow control over what and how is queried for or didn't format the output to my wishes. So I came up with my own Splunk add-on implementing these missing features. Cross-compatible with Python 2 and 3. Tested on Splunk Enterprise 9.0.2 and 8.2.3 on Windows, Linux and Splunk Cloud. Licensed under http://www.apache.org/licenses/LICENSE-2.0. Feel free to submit issues via https://github.com/hRun/SA-haveibeenpwned/issues.
(0)
Categories
Created By
Source Code
Type
Downloads
Licensing
Splunk Answers
Resources