Get Alert Compromised Credentials

Get the compromised credentials of a specified alert, as CSV.

The credentials are not part of the alert details. ZeroFox provides them as a separate breach file, which this action returns.

To work with the credentials as JSON, pass the output of this action to the Convert CSV To JSON action.

Note: The request fails with a 404 status code when the alert has no compromised credentials.

External Documentation

To learn more, visit the ZeroFox documentation.

​

Parameters

Parameter	Description
Alert ID	The ID of the alert. You can get alert IDs using the List Alerts action.

​

Example Output

domain,email,username,password,breach_name,impacted_domain,discovered_date,created_date
example.com,[e-mail],[e-mail],password123,"Combolist: 'paste.services.txt' (202,998 Records)",N/A,2024-05-27T00:00:00Z,2024-05-27T23:20:24.288508611Z