Get Alert Compromised Credentials - BlinkOps Documentation

Get the compromised credentials of a specified alert, as CSV. The credentials are not part of the alert details. ZeroFox provides them as a separate breach file, which this action returns. To work with the credentials as JSON, pass the output of this action to the Convert CSV To JSON action. Note: The request fails with a 404 status code when the alert has no compromised credentials.

External DocumentationTo learn more, visit the ZeroFox documentation.

Parameters

Parameter	Description
Alert ID	The ID of the alert. You can get alert IDs using the `List Alerts` action.

Example Output

domain,email,username,password,breach_name,impacted_domain,discovered_date,created_date
example.com,user@example.com,user@example.com,password123,"Combolist: 'paste.services.txt' (202,998 Records)",N/A,2024-05-27T00:00:00Z,2024-05-27T23:20:24.288508611Z

Workflow Library Example

Get Alert Compromised Credentials with Zerofox and Send Results Via Email

Preview this Workflow on desktop

​Parameters

​Example Output

​Workflow Library Example

Parameters

Example Output

Workflow Library Example