Changelog

Synapse-Spycloud Changelog

Added spycloud.enterprise.watchlist to ingest breach records for the assets on your SpyCloud watchlist.
Added spycloud.config commands to manage API keys and per-configuration proxy, proxy_user, proxy_passwd and ssl_verify settings. These replaced the spycloud.setup.consumer.key and spycloud.setup.investigative.key commands, which have been removed.
Added --config to the spycloud.investigations, spycloud.consumer.ato and spycloud.enterprise.watchlist commands.
Updated ingest to set risk:compromise:type from the breach catalog category, as a spycloud. taxonomy entry.
Updated the --severity and --source-id arguments to accept a single value or a list of values. A comma delimited string is no longer accepted.
Updated the --type argument of spycloud.investigations to only accept the values the API supports.

Extended spycloud.investigations to accept additional input forms: it:host (Infected Machine ID), hash:sha256 (Log ID), econ:bank:account, econ:pay:pan (SHA1-hashed PAN), gov:us:ssn (SHA1-hashed SSN), transport:land:license, and ou:id:number (routed to the National ID or Passport endpoint based on the ou:id:type :name property).
When breach records returned by spycloud.investigations contain cc_number, bank_number, social_security_number, drivers_license, national_id, or passport_number fields, those assets are ingested as econ:pay:pan, econ:bank:account, gov:us:ssn, transport:land:license, or ou:id:number nodes referenced from the resulting it:account.

Updated spycloud.investigations and spycloud.consumer.ato to populate the it:exec:query:synuser property.

Update breach record ingest to populate additional properties on it:host nodes representing infected assets.
Populate the :browser property on it:exec:url nodes.

Fix bug with auth:creds deconfliction where an existing node with the same password/hash combination could be incorrectly reused for multiple accounts.

Update paginated result handling to avoid cursor expiration during ingest.
Update the User-Agent header used in API requests to include the Power-Up version.
Update the spycloud.consumer.ato and spycloud.investigations commands to create it:exec:query nodes with a -(refs)> edge to the node that was enriched and -(found)> edges to results.

Update the spycloud.consumer.ato and spycloud.investigations commands to allow lists of values for the --severity argument.

Update it:host creation to use the :desc property to record host description rather than the deprecated :model property.