SpyCloud Integrations
Maximize efficiency and streamline workflows with out-of-the-box integrations that enable enterprises to leverage their existing tech stacks to centralize data and make informed, actionable decisions.
Seamlessly integrate into your preferred technology solutions and business critical applications.
SpyCloud surfaces darknet exposures specific to your users, with continuous collection and dynamic correlation that reveals risks previously unseen. Take action to prevent cyberattacks, secure business data, protect employee and consumer credentials, and accelerate cybercrime investigations.
SpyCloud offers out-of-the-box API integrations with top technology vendors across SIEM, SOAR, XDR, TIPs and more – delivering Cybercrime Analytics at scale to automate:
- Triage and escalation
- Ops and incident response workflows
- ATO and ransomware prevention
- Post-Infection Remediation
- Investigate anomalous activity
- Centralize intelligence collection
USM Anywhere
Detect and remediate compromised passwords exposed from malware and third-party breaches.
SpyCloud AlienApp enables you to seamlessly integrate SpyCloud’s breach and malware exposure alerts into USM Anywhere – delivering actionable recaptured darknet data to protect your business from cyberattacks.
With the AlienApp for SpyCloud you can:
- Get alerts and take action when user credentials are exposed on the darkweb.
- Safeguard your executives personal accounts and privileged users accounts (e.g. IT admins).
- Prevent bad password hygiene.
The AlienApp for SpyCloud is available to all USM Anywhere users and the API will feed into your existing workflow.
Chronicle SOAR By Siemplify
Incorporate SpyCloud’s powerful Cyber Analytics Engine to access darknet data.
Easily integrate SpyCloud’s Cyber Analytics Engine of 400+ billion recaptured darknet assets into your Chronicle SOAR By Siemplify to enrich the data available to you during your incident response workflows. This will empower your teams to maximize efficiency and make informed decisions with confidence.
Cisco SecureX Threat Response
Cloud-native SecureX integrates the Cisco Secure portfolio with the entire security infrastructure – speeding detection, response, and recovery.
Cisco SecureX delivers a consistent, built-in experience across your products. Get unified visibility, intuitive automation, and robust security for your entire security portfolio. The SecureX Threat Response SpyCloud Module empowers users to initiate an investigation into a SHA256. The module adds context around a compromised email and username associated with that email and context about a user for an environment. If the Cisco Secure Email module is enabled, then it returns that this SHA256 has been sent to, for example, these email addresses have been seen in the data breaches.
Jupyter Notebook
Investigations.
Enhance your instance of SpyCloud investigations with pre-built Jupyter Notebook templates. View potential trouble spots and filter the data to highlight the most actionable records and optionally export those records into a CSV for sharing or use in other tools.
Maltego Enterprise
Pivot using SpyCloud’s extensive dataset of breach and malware data.
SpyCloud Investigations Integration for Maltego enables analysts to efficiently piece together decades-worth of criminals’ digital breadcrumbs to de-anonymize specific threat actors engaging in cybercrime, financial fraud, and other illegal activities. With this powerful integration, you can:
- Access high-volume darknet data
- Shorten the timeline of your investigations
- Discover previously unknown and anomalous connections between entities
Active Directory, Microsoft
Detect and reset Active Guardian passwords automatically.
Automate Active Directory protection out of the box using SpyCloud Active Directory Guardian. It includes two components that can be used together or separately to prevent, detect, and reset weak or compromised passwords automatically.
- The password filter prevents employees from setting weak passwords that could put corporate resources at risk. When an employee sets a new Active Directory password, the password filter automatically screens their choices for repeated or sequential characters, up to 50,000 custom dictionary words, and any previously-exposed passwords that SpyCloud has recaptured from the dark web.
- The scanner checks employee credentials for exposures on an ongoing basis. Security teams can schedule automated scans to check for compromised credentials, custom banned passwords, 1,000 “fuzzy” variations of banned and exposed passwords, and any previously-exposed passwords.
Together, they provide prevention (password filter) and detection (scanner). The password filter prevents employees from setting weak or compromised passwords in the first place, and the scanner detects and resets additional exposures as new exposures occur over time.
Polarity Platform
Knowledge and data is spread across disparate systems and fuses them into one unified view.
Polarity isn’t just another tool teams can add to their toolkit. It’s a unified view of all the tools, data, and knowledge that they use every day, and follows users throughout their workflow, eliminating the need to switch between endless tabs or search through chat/email history to complete a task. Polarity revolutionizes how teams work, what they spend their time doing (completing tasks, not searching for context), and how informed their day to day decisions are. Mutual customers can operationalize SpyCloud’s database of nearly 400B recaptured darknet assets.
Splunk Enterprise and Cloud
Access and download SpyCloud apps and add-ons to your Splunk instance.
Splunk users can leverage SpyCloud into their existing workflow with SpyCloud’s various APIs.
- The SpyCloud Investigations App for Splunk enables users to explore criminal activity through the lens of recaptured data and provides access to SpyCloud’s repository of close to 400B+ recaptured darknet assets from within your Splunk environment to assist with cybercrime and fraud investigations.
- The SpyCloud Add-On for Splunk leverages SpyCloud’s Enterprise API, allowing users to download breach alerts directly into Splunk so security teams can take action immediately.
ThreatConnect
Automate threat detection and response for exposed company assets.
SpyCloud is proud to be one of ThreatConnect’s Data Enrichment Partners. With this integration, users can:
- Operationalize SpyCloud’s powerful Cyber Analytics Engine that contains billions recaptured darknet assets.
- Automate logging and remediation tasks when an exposure is detected by SpyCloud.
- Leverage additional ThreatConnect integrations for further enrichment or triage.
Synapse Enterprise
Query, ingest, and visualize data for SpyCloud Investigations with the Synapse-SpyCloud Power-Up.
Enhance your investigations and attribute cybercrime faster by enriching your existing threat intelligence sources. Synapse Enterprise customers can use the Synapse-SpyCloud Power-Up to query, ingest, and model indicators found in SpyCloud’s comprehensive breach database.
Custom Integrations
We have options if there is not a pre-built integration for your specific toolset or use case.
SpyCloud provides custom, high-volume APIs with simple configuration to help you integrate our Cyber Analytics Engine to use in with your current tech ecosystem. Contact us to to become one of our Technology Partners.
More Integrations
Coming Soon
add more integrations
The SpyCloud API was super easy to integrate. It took a day and a half for our engineers, and then it was just up and running. We’ve had the integration in place for a year now and had zero issues, zero downtime. On the technology side, it’s an enterprise-grade API for us.
FINTECH
SpyCloud Enabled a Global Fintech Company to Protect Thousands of Vulnerable Accounts Representing Tens of Millions of Dollars
How It Works
SpyCloud’s Cyber Analytics Engine ingests and analyzes 12B+ darknet assets per month and delivers automated insights via REST-based APIs. Our APIs include easy-to-understand, resource-oriented URLs, and use HTTP response codes to indicate API errors. All API responses return JSON, including those with errors.
Any application with the ability to query an external API endpoint can integrate SpyCloud data. Once the application has been configured to query the SpyCloud API within appropriate parameters, such as providing an email or target domain, the results should be mapped to appropriate fields within your solution.
Additional Resources
We break down the steps that enable the shift from a machine-focused approach to malware infection response to an identity-focused approach that truly reduces the enterprise’s risk of ransomware.
Cybercrime Analytics
Learn about the new way to disrupt cybercrime with automated analytics that drive action. Discover why market leaders across all industries are choosing Cybercrime Analytics over threat intelligence, how this approach boosts anti-fraud solutions, and its use cases and benefits in detail.
Living Security announced a partnership with SpyCloud to better identify segments of human risk inside organizations and help security leaders create a proactive plan to mitigate attacks.
Don’t see your preferred technology vendor?
SpyCloud’s solutions aim to support a vendor agnostic technology ecosystem that maximizes enterprise extensibility. Contact us to learn more about custom integrations.
