Assess third-party risk
Action ID:tools.hudsonrock.assess_third_party_risk
Assess third-party risk. Calls POST /json/v3/search-by-domain/assessment directly.
Reference: https://docs.hudsonrock.com/docs/third-party-risk-assessment
Secrets
Required secrets:hudsonrock: required valuesHUDSONROCK_API_KEY.
Input fields
string
required
The domain to evaluate for potential security risks.
string | null
Base URL of the HudsonRock API.Default:
null.Discover assets
Action ID:tools.hudsonrock.discover_assets
Discover assets. Calls POST /json/v3/search-by-domain/discovery directly.
Reference: https://docs.hudsonrock.com/reference/assets-discovery
Secrets
Required secrets:hudsonrock: required valuesHUDSONROCK_API_KEY.
Input fields
array[string]
required
List of domains to perform discovery on. Accepts root domains (example.com) and will match all subdomains. Between 1-500 domains can be specified per request.
string | null
Base URL of the HudsonRock API.Default:
null.string | null
Base64 encoded pagination cursor for retrieving the next set of results. Obtained from the ‘nextCursor’ field in the previous response.Default:
null.array[string] | null
Optional keywords to narrow discovery results to specific services or applications.Default:
null.string | null
Determines how multiple keywords are matched during discovery. ‘any’ returns results matching at least one keyword (broader discovery), while ‘all’ requires all keywords to match.Default:
null.array[string] | null
Types of compromises to discover. ‘employees’ finds corporate email credentials (@company.com), while ‘users’ finds consumer credentials.Default:
null.Get account info
Action ID:tools.hudsonrock.get_account_info
Get account information. Calls GET /json/v3/my-account directly.
Reference: https://docs.hudsonrock.com/reference/getmyaccount
Secrets
Required secrets:hudsonrock: required valuesHUDSONROCK_API_KEY.
Input fields
string | null
Base URL of the HudsonRock API.Default:
null.Get domain overview
Action ID:tools.hudsonrock.get_domain_overview
Get a domain overview. Calls POST /json/v3/search-by-domain/overview directly.
Reference: https://docs.hudsonrock.com/reference/domains-overview
Secrets
Required secrets:hudsonrock: required valuesHUDSONROCK_API_KEY.
Input fields
array[string]
required
List of domains to retrieve compromise overview statistics for. Accepts root domains (example.com) and will aggregate data across all subdomains. Between 1-500 domains can be specified per request.
string | null
Base URL of the HudsonRock API.Default:
null.string | null
Base64 encoded pagination cursor for retrieving the next set of overview results. Obtained from the ‘nextCursor’ field in the previous response. Essential for processing large domain lists.Default:
null.string | null
ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter for domains with employee compromises after this date. Identifies domains with recent corporate breaches.Default:
null.string | null
ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter for domains with employee data uploaded after this date. Reflects when the data became available in our system.Default:
null.string | null
ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter for domains with user compromises after this date. Identifies domains with recent consumer-facing breaches.Default:
null.string | null
ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter for domains with user data uploaded after this date. Reflects when the data became available in our system.Default:
null.integer | null
Maximum threshold for employee compromises. Returns only domains with no more than this many compromised employee accounts. Useful for focusing on organizations within specific size ranges.Default:
null.integer | null
Maximum threshold for user compromises. Returns only domains with no more than this many compromised user accounts. Helps focus on domains with specific consumer impact ranges.Default:
null.integer | null
Minimum threshold for employee compromises. Returns only domains with at least this many compromised employee accounts. Useful for filtering out domains with negligible compromise counts.Default:
null.integer | null
Minimum threshold for user compromises. Returns only domains with at least this many compromised user accounts. Helps identify domains with significant consumer impact.Default:
null.string | null
Field to sort overview results by. Time-based sorting helps identify recent breaches, while count-based sorting identifies the most severely affected domains.Default:
null.string | null
‘desc’ prioritizes recent breaches or highest compromise counts (recommended for threat monitoring), while ‘asc’ shows oldest breaches or lowest counts first.Default:
null.Search domain compromises
Action ID:tools.hudsonrock.search_domain_compromises
Search domain compromises. Calls POST /json/v3/search-by-domain directly.
Reference: https://docs.hudsonrock.com/reference/search-by-domains
Secrets
Required secrets:hudsonrock: required valuesHUDSONROCK_API_KEY.
Input fields
array[string]
required
List of domains to filter results by. Accepts root domains (example.com) and will match all subdomains. Maximum 50 domains per request.
array[string] | null
Optional additional data to include in results: ‘search_data’, ‘installed_software’, ‘employee_session_cookies’, ‘password_strength’, ‘sensitive_applications’, ‘dir_tree’.Default:
null.string | null
Base URL of the HudsonRock API.Default:
null.string | null
Base64 encoded pagination cursor for retrieving the next set of results. Obtained from the ‘nextCursor’ field in the previous response.Default:
null.string | null
Filter results up to this date/time. Applies to the field specified in ‘sort_by’.Default:
null.array[string] | null
List of third-party domains associated with your organization to search for. Ideal for SaaS platforms (company.salesforce.com), cloud services, or other external services your organization uses. Limited to 50 domains per request.Default:
null.boolean | null
When true, returns only credentials matching the search criteria. When false, returns all credentials from matching stealers.Default:
null.array[string] | null
Filter results to URLs containing specified keywords. Useful for finding credentials for specific services. Case-insensitive matching. Maximum 10 keywords per request.Default:
null.string | null
‘any’ returns results matching at least one keyword (broader results), while ‘all’ requires all keywords to match.Default:
null.string | null
Field to sort results by. ‘date_compromised’ sorts by when the infection occurred, while ‘date_uploaded’ sorts by when the data was integrated into our platform.Default:
null.string | null
Direction to sort results. ‘desc’ returns newest records first (recommended for monitoring), while ‘asc’ returns oldest records first.Default:
null.string | null
Filter results from this date/time onward. Applies to the field specified in ‘sort_by’.Default:
null.array[string] | null
Subdomain filters to match against subdomains in the URL field. Maximum 5 items allowed. Cannot be used together with ‘keywords’ or ‘keywords_match’ parameters.Default:
null.array[string] | null
Filter results by credential type. ‘employees’ returns corporate email credentials, ‘users’ returns consumer credentials, and ‘third_parties’ returns credentials from related domains.Default:
null.Search email compromises
Action ID:tools.hudsonrock.search_email_compromises
Search email compromises. Calls POST /json/v3/search-by-login/emails directly.
Reference: https://docs.hudsonrock.com/reference/search-by-login-emails
Secrets
Required secrets:hudsonrock: required valuesHUDSONROCK_API_KEY.
Input fields
array[string]
required
Array of email addresses to search for.
array[string] | null
Optional additional data to include in results: ‘search_data’, ‘installed_software’, ‘employee_session_cookies’, ‘password_strength’, ‘sensitive_applications’, ‘dir_tree’.Default:
null.string | null
Base URL of the HudsonRock API.Default:
null.string | null
Base64 encoded pagination cursor for retrieving the next set of results. Obtained from the ‘nextCursor’ field in the previous response.Default:
null.array[string] | null
List of domains to filter results by. Accepts root domains (example.com) and will match all subdomains. Maximum 50 domains per request.Default:
null.string | null
ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter results up to this date/time.Default:
null.boolean | null
Controls credential filtering in results. When true, returns only credentials matching the search criteria. When false, returns all credentials from matching stealers.Default:
null.array[string] | null
Filter results to URLs containing specified keywords. Useful for finding credentials for specific services. Case-insensitive matching. Maximum 10 keywords per request.Default:
null.string | null
Determines how multiple keywords are matched. ‘any’ returns results matching at least one keyword (broader results), while ‘all’ requires all keywords to match (narrower, more specific results).Default:
null.string | null
Field to sort results by. ‘date_compromised’ sorts by when the infection occurred, while ‘date_uploaded’ sorts by when the data was integrated into our platform.Default:
null.string | null
Direction to sort results. ‘desc’ returns newest records first (recommended for monitoring), while ‘asc’ returns oldest records first (useful for historical analysis).Default:
null.string | null
ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter results from this date/time onward.Default:
null.array[string] | null
Filter results by credential type. ‘employees’ returns corporate email credentials (@company.com), ‘users’ returns consumer credentials, and ‘third_parties’ returns credentials from related domains.Default:
null.Search IP compromises
Action ID:tools.hudsonrock.search_ip_compromises
Search IP compromises. Calls POST /json/v3/search-by-ip directly.
Reference: https://docs.hudsonrock.com/docs/ipcidr-search
Secrets
Required secrets:hudsonrock: required valuesHUDSONROCK_API_KEY.
Input fields
string | null
Base URL of the HudsonRock API.Default:
null.string | null
CIDR range. Valid CIDR 21-32. One of ips or cidr is required.Default:
null.string | null
Base64 encoded pagination cursor for retrieving the next set of results. Obtained from the ‘nextCursor’ field in the previous response.Default:
null.string | null
Filter results before this date.Default:
null.boolean | null
Return only matched credentials.Default:
null.array[string] | null
List of IP addresses. 1-50 IPs, IPv4/IPv6 format. One of ips or cidr is required.Default:
null.string | null
Sort results by ‘date_compromised’ or ‘date_uploaded’.Default:
null.string | null
Sort direction: ‘asc’ or ‘desc’.Default:
null.string | null
Filter results after this date.Default:
null.Search PC compromises
Action ID:tools.hudsonrock.search_pc_compromises
Search PC compromises. Calls POST /json/v3/search-by-pc directly.
Reference: https://docs.hudsonrock.com/reference/searchbypc
Secrets
Required secrets:hudsonrock: required valuesHUDSONROCK_API_KEY.
Input fields
array[string]
required
Array of computer names to search for.
array[string] | null
Optional additional data to include in results: ‘search_data’, ‘installed_software’, ‘employee_session_cookies’, ‘password_strength’, ‘sensitive_applications’, ‘dir_tree’.Default:
null.string | null
Base URL of the HudsonRock API.Default:
null.string | null
Base64 encoded pagination cursor for retrieving the next set of results. Obtained from the ‘nextCursor’ field in the previous response. Provides more reliable pagination than offset-based approaches.Default:
null.array[string] | null
List of domains to filter results by. Accepts root domains (example.com) and will match all subdomains. Maximum 50 domains per request. Required for ‘third_parties’ type filtering.Default:
null.string | null
ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter results up to this date/time. Applies to the field specified in ‘sort_by’.Default:
null.boolean | null
Controls credential filtering in results. When true, returns only credentials matching the search criteria. When false, returns all credentials from matching stealers, which may include credentials for unrelated domains/services.Default:
null.array[string] | null
Filter results to URLs containing specified keywords. Useful for finding credentials for specific services (e.g., [‘vpn’, ‘admin’, ‘portal’]). Case-insensitive matching. Maximum 10 keywords per request.Default:
null.string | null
Determines how multiple keywords are matched. ‘any’ returns results matching at least one keyword (broader results), while ‘all’ requires all keywords to match (narrower, more specific results).Default:
null.string | null
Field to sort results by. ‘date_compromised’ sorts by when the infection occurred, while ‘date_uploaded’ sorts by when the data was integrated into our platform.Default:
null.string | null
Direction to sort results. ‘desc’ returns newest records first (recommended for monitoring), while ‘asc’ returns oldest records first (useful for historical analysis).Default:
null.string | null
ISO 8601 formatted timestamp (YYYY-MM-DDThh:mm:ssZ) to filter results from this date/time onward. Applies to the field specified in ‘sort_by’.Default:
null.array[string] | null
Filter results by credential type. ‘employees’ returns corporate email credentials (@company.com), ‘users’ returns consumer credentials, and ‘third_parties’ returns credentials from related domains (only available when ‘domains’ parameter is provided).Default:
null.Search stealer compromises
Action ID:tools.hudsonrock.search_stealer_compromises
Search stealer compromises. Calls POST /json/v3/search-by-stealer directly.
Reference: https://docs.hudsonrock.com/reference/search-by-stealer
Secrets
Required secrets:hudsonrock: required valuesHUDSONROCK_API_KEY.
Input fields
array[string]
required
Array of stealer IDs to search for.
array[string] | null
Optional additional data to include in results: ‘search_data’, ‘installed_software’, ‘employee_session_cookies’, ‘password_strength’, ‘sensitive_applications’, ‘dir_tree’.Default:
null.string | null
Base URL of the HudsonRock API.Default:
null.string | null
Base64 encoded pagination cursor for retrieving the next set of results. Obtained from the ‘nextCursor’ field in the previous response.Default:
null.array[string] | null
List of domains to filter results by. Accepts root domains (example.com) and will match all subdomains. Maximum 50 domains per request.Default:
null.string | null
ISO 8601 formatted timestamp to filter results up to this date/time. Applies to the field specified in ‘sort_by’.Default:
null.boolean | null
Controls credential filtering in results. When true, returns only credentials matching the search criteria. When false, returns all credentials from matching stealers.Default:
null.array[string] | null
Filter results to URLs containing specified keywords. Useful for finding credentials for specific services. Case-insensitive matching. Maximum 10 keywords per request.Default:
null.string | null
‘any’ returns results matching at least one keyword (broader results), while ‘all’ requires all keywords to match (narrower, more specific results).Default:
null.string | null
Field to sort results by. ‘date_compromised’ sorts by when the infection occurred, while ‘date_uploaded’ sorts by when the data was integrated into our platform.Default:
null.string | null
Direction to sort results. ‘desc’ returns newest records first (recommended for monitoring), while ‘asc’ returns oldest records first.Default:
null.string | null
ISO 8601 formatted timestamp to filter results from this date/time onward. Applies to the field specified in ‘sort_by’.Default:
null.array[string] | null
Filter results by credential type. ‘employees’ returns corporate email credentials, ‘users’ returns consumer credentials, and ‘third_parties’ returns credentials from related domains.Default:
null.Search username compromises
Action ID:tools.hudsonrock.search_username_compromises
Search username compromises. Calls POST /json/v3/search-by-login/usernames directly.
Reference: https://docs.hudsonrock.com/reference/search-by-login-usernames
Secrets
Required secrets:hudsonrock: required valuesHUDSONROCK_API_KEY.
Input fields
array[string]
required
Array of usernames to search for.
array[string] | null
Optional additional data to include in results: ‘search_data’, ‘installed_software’, ‘employee_session_cookies’, ‘password_strength’, ‘sensitive_applications’, ‘dir_tree’.Default:
null.string | null
Base URL of the HudsonRock API.Default:
null.string | null
Base64 encoded pagination cursor for retrieving the next set of results. Obtained from the ‘nextCursor’ field in the previous response.Default:
null.array[string] | null
List of domains to filter results by. Accepts root domains (example.com) and will match all subdomains. Maximum 50 domains per request.Default:
null.string | null
ISO 8601 formatted timestamp to filter results up to this date/time.Default:
null.boolean | null
Controls credential filtering in results. When true, returns only credentials matching the search criteria. When false, returns all credentials from matching stealers.Default:
null.array[string] | null
Filter results to URLs containing specified keywords. Useful for finding credentials for specific services (e.g., [‘vpn’, ‘admin’, ‘portal’]). Maximum 10 keywords.Default:
null.string | null
Determines how multiple keywords are matched. ‘any’ returns results matching at least one keyword, while ‘all’ requires all keywords to match.Default:
null.string | null
Field to sort results by. ‘date_compromised’ sorts by when the infection occurred, while ‘date_uploaded’ sorts by when the data was integrated into our platform.Default:
null.string | null
Direction to sort results. ‘desc’ returns newest records first (recommended for monitoring), while ‘asc’ returns oldest records first.Default:
null.string | null
ISO 8601 formatted timestamp to filter results from this date/time onward.Default:
null.array[string] | null
Filter results by credential type. ‘employees’ returns corporate email credentials (@company.com), ‘users’ returns consumer credentials, and ‘third_parties’ returns credentials from related domains.Default:
null.