Investigations API

---

🧨 The Problem

Analysts and investigators increasingly recognize how OSINT and breached data can strengthen threat investigations. Underground forums and malware logs often contain data about the attackers themselves — allowing analysts to de-anonymize those responsible for breaches, fraud, and identity abuse.

SpyCloud collects and operationalizes data from:

• Breaches
• Malware logs
• Criminal communities and forums

This enables organizations to protect users, unmask adversaries, and accelerate critical discovery workflows.

---

🚀 Product Overview

SpyCloud Investigations API helps investigators piece together digital breadcrumbs to reveal adversary identities, understand behavior, and prevent future abuse.

It accelerates investigations into commercial compromise, online fraud, malware infections, and insider threats.

---

⚡ Benefits at a Glance

• Gain Speed & Efficiency
  Return deep results from limited selectors (email, IP, password, domain, etc.)

• Correlate Multiple Data Sources
  Enrich with internal tools or third-party OSINT (VirusTotal, Whois, Passive DNS)

• Discover the Undiscoverable
  Unmask alternate personas, malware infrastructure, and unknown relationships

---

🎯 Use Cases

---

🛠️ How It Works

SpyCloud’s REST-based API integrates seamlessly into link analysis tools like:

• Maltego
• Jupyter Notebooks
• Splunk
• Vertex
• Synapse

Analysts can pivot on any selector — username, password, email, IP — and reveal extensive linked data for graph rendering and deep enrichment.

---

Investigative Capabilities

📈 High-Volume Data Analysis

Run large queries on domains, plaintext passwords, or infection records and return extensive result sets.

🔗 Associating Results

Perform pivots and link related entities to identify patterns, clusters, and anomalies.

🔁 Loop & Batch Queries

Support for iterative searches with looped/batched selectors for automation and refinement.

---

Key Capabilities

🕵️ Attribute Cybercrime

Reveal true identities of adversaries and alternate personas using selector correlation.

📊 Evaluate Threat Actors

Profile accounts, logins, and services tied to malicious actors.

🚨 Assess Risk

Understand internal and external exposure across users, employees, and third parties.

🧬 Understand Attacks

Trace credential stuffing and botnet activity back to source breaches and malware logs.

📡 Investigate Campaigns

Map criminal infrastructure, shared malware, and coordinated attack behaviors.

---

🔌 Integrations