Connect this data source on your own, using the Hunters platform.
TL;DR
Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
|---|---|---|---|---|---|---|---|
CloudSEK Incidents | ✅ | cloudsek_incidents | NDJSON | API |
Overview
CloudSEK is a cybersecurity company specializing in predictive threat intelligence powered by artificial intelligence. It offers solutions like XVigil, which monitors and identifies threats such as data leaks, phishing attacks, and brand impersonation across the web, including the dark and deep web. CloudSEK focuses on proactive risk management, helping organizations mitigate potential threats before they escalate. Its AI-driven approach provides real-time insights and actionable intelligence, empowering businesses to protect their assets and reputation effectively.
Supported data types
CloudSEK Incidents
Table name: cloudsek_incidents
CloudSEK incidents refer to cybersecurity threats and breaches identified and reported by CloudSEK’s threat intelligence platform. These incidents often include data leaks, phishing campaigns, brand impersonations, and vulnerabilities in digital assets. By leveraging AI-powered monitoring, CloudSEK proactively detects and alerts organizations to such incidents, offering actionable insights to mitigate risks. Their detailed incident reports help businesses respond swiftly to prevent further damage and strengthen their security posture.
Send data to Hunters
Hunters supports the ingestion of CloudSEK logs via API.
To connect CloudSEK logs:
Follow this CloudSEK guide to retrieve your API key from CloudSEK.
Complete the process on the Hunters platform, following this guide.
Expected format
Logs are expected in JSON format.
{
"created_at": "2024-11-03T07:30:33.891Z",
"event_details": {
"acquisition_time": "2024-11-03T07:27:24.249668+00:00",
"analyzed_time": "2024-11-03T07:29:19.180185+00:00",
"attachments": [
{
"type": "image",
"url": "https://api.cloudsek.com/attachments?id=cm9vdC01NDM2X2ZkZl8yMDI0LjAxLjA5X2luZGV4LTAwMDAwMSNjZDJlNzQzNTRlMzRiOGFl&type=image&label=1080p"
}
],
"event_id": "cm9vdC01NDM2X2ZkZl8yMDI0LjAxLjA5X2luZGV4LTAwMDAwMSNjZDJlNzQzNTRlMzRiOGFl",
"event_summary": ".",
"event_url": "https://app.cloudsek.com/events/brand-monitor/fdf?org=5436&details=cm9vdC01NDM2X2ZkZl8yMDI0LjAxLjA5X2luZGV4LTAwMDAwMSNjZDJlNzQzNTRlMzRiOGFl",
"incident_details": {
"assignee": "Unassigned",
"created_time": "2024-11-03T07:30:33.191Z",
"incident_id": "XVA-7048149",
"incident_status": "open",
"incident_url": "https://app.cloudsek.com/incidents?org=5436&details=a60b01b2-62d5-4db3-ab8d-788a03bad67d",
"matched_alert_rule": "Live domains hosting content",
"priority": "P0"
},
"matched_assets": {},
"posted_time": "2024-11-03T07:27:24.249668+00:00",
"scan_date": "2024-11-03T07:29:19.180185+00:00",
"suspect_url": "http://asd.com/",
"threat_magnitude": "low",
"threat_tags": [
{
"identifier": 435,
"name": "WHOIS: Emails",
"value": [
"abuse@dasdasd.com",
"6ckkxzgdrobt@gwegwegwag.email",
"ryh5ecy4dhdp@gwegwegwag.email",
"tpuducsut2sk@gwegwegwag.email"
],
"value_type": "Array"
},
{
"identifier": 436,
"name": "WHOIS: Registrar",
"value": [
"Domeneshop AS dba dasdasd.com"
],
"value_type": "Array"
},
{
"identifier": 437,
"name": "WHOIS: Domain Name",
"value": [
"asd.COM"
],
"value_type": "Array"
},
{
"identifier": 439,
"name": "WHOIS: DNSSEC",
"value": [
"unsigned"
],
"value_type": "Array"
},
{
"identifier": 441,
"name": "WHOIS: Nameservers",
"value": [
"NS-1315.asd-36.ORG",
"NS-1983.asd-55.CO.UK",
"NS-452.asd-56.COM",
"NS-769.asd-32.NET"
],
"value_type": "Array"
},
{
"identifier": 442,
"name": "WHOIS: Organization",
"value": [
"asd ApS"
],
"value_type": "Array"
},
{
"identifier": 443,
"name": "WHOIS: Creation Date",
"value": [
"2017-09-18T18:26:28.000000+00:00"
],
"value_type": "Array"
},
{
"identifier": 444,
"name": "Mailservers",
"value": [
"0 asdasd.com.",
"0 asdasd.com."
],
"value_type": "Array"
},
{
"identifier": 446,
"name": "WHOIS: Last Updated",
"value": [
"2024-10-31T18:10:38.000000+00:00"
],
"value_type": "Array"
},
{
"identifier": 456,
"name": "WHOIS: Registrar WHOIS Details Server",
"value": [
"asd.dasdasd.com"
],
"value_type": "Array"
},
{
"identifier": 457,
"name": "WHOIS: Country",
"value": [
"DK"
],
"value_type": "Array"
},
{
"identifier": 459,
"name": "WHOIS: Expiration Date",
"value": [
"2025-09-18T18:26:28.000000+00:00"
],
"value_type": "Array"
},
{
"identifier": 909,
"name": "Keyword Presence In",
"value": [
"Keyword is present in page text"
],
"value_type": "Array"
},
{
"identifier": 923,
"name": "Threat Reason",
"value": [
"asdbrands."
],
"value_type": "Array"
},
{
"identifier": 933,
"name": "Fake Domain Threat Indicators",
"value": [
"Keyword Presence",
"MX Check",
"v0.123123"
],
"value_type": "Array"
},
{
"identifier": 1575,
"name": "Suspect Domains & URLs",
"value": [
"http://asd.com/"
],
"value_type": "Array"
},
{
"identifier": 1668,
"name": "Type: Domain or Subdomain",
"value": [
"url"
],
"value_type": "Array"
},
{
"identifier": 1718,
"name": "Discussion Context",
"value": [
"- safasfe"
],
"value_type": "Array"
},
{
"identifier": 1719,
"name": "Topic Sub-Category",
"value": [
"Fake Url http://asd.com/ found : Document content related to client"
],
"value_type": "Array"
},
{
"identifier": 1781,
"name": "Client Assets Present in Content",
"value": [
"charge point"
],
"value_type": "Array"
},
{
"identifier": 321,
"name": "Nameservers",
"value": [
"ns-asd.asd-36.org."
],
"value_type": "Array"
},
{
"identifier": 447,
"name": "A Record",
"value": [
"1.2.3.4",
"2.2.3.4"
],
"value_type": "Array"
},
{
"identifier": 1728,
"name": "Domain Status Code",
"value": [
301
],
"value_type": "Array"
},
{
"identifier": 1729,
"name": "Domain Status Code Family",
"value": [
"3xx"
],
"value_type": "Array"
},
{
"identifier": 1730,
"name": "Domain is Live",
"value": [
true
],
"value_type": "Array"
},
{
"identifier": 1748,
"name": "Page Text Related To Client",
"value": [
true
],
"value_type": "Array"
},
{
"identifier": 1749,
"name": "Page Text Contains Suspicious Words",
"value": [
true
],
"value_type": "Array"
},
{
"identifier": 1763,
"name": "Phishing Threat Type",
"value": [
"threat"
],
"value_type": "Array"
},
{
"identifier": 1764,
"name": "Phishing Magnitude",
"value": [
"high"
],
"value_type": "Array"
},
{
"identifier": 1882,
"name": "Web Page Type",
"value": [
"normal_page"
],
"value_type": "Array"
},
{
"identifier": 2263,
"name": "AS Number",
"value": [
16509
],
"value_type": "Array"
},
{
"identifier": 2264,
"name": "AS Name",
"value": [
"AMAZON-02, US"
],
"value_type": "Array"
},
{
"identifier": 2265,
"name": "BGP Prefix",
"value": [
"1.2.3.0/20",
"2.2.3.0/20"
],
"value_type": "Array"
},
{
"identifier": 2266,
"name": "AS Organization Name",
"value": [
"Amazon.com, Inc."
],
"value_type": "Array"
},
{
"identifier": 2267,
"name": "AS Organization Country",
"value": [
"United States"
],
"value_type": "Array"
},
{
"identifier": 2268,
"name": "AS Organization Country Code",
"value": [
"US"
],
"value_type": "Array"
},
{
"identifier": 2269,
"name": "RIPE URL",
"value": [
"https://asodkpoaskdpoaskdsad.com"
],
"value_type": "Array"
}
],
"updated_time": "2024-11-03T07:30:19.906247+00:00"
},
"module_name": "Brand Risk Monitoring",
"sub_module": "Fake URLs and Phishing",
"updated_at": "2024-11-03T07:30:33.891Z",
"vendor": "CloudSEK"
}