| System | # Accounts Exposed | Criticality |
|--------|-------------------|--------------|
| Corporate LDAP | 12,340 | HIGH |
| AWS Console (IAM users) | 342 | CRITICAL |
| GitHub (private repos) | 1,202 | HIGH |
| Salesforce | 8,440 | MEDIUM |
| Internal Wiki | 18,000 | LOW |
Analysts use parsed data to identify credential reuse trends or to check if corporate credentials appear in third-party breaches (credential stuffing protection).
Many breaches store hashes (MD5, SHA1, bcrypt). A parser identifies the hash type and can optionally queue them for cracking or mark them as “cracked” after the fact.
parser:
input:
formats: ["csv", "sql_insert", "jsonl", "raw_log"]
max_file_size_mb: 5000
processing:
dedup_method: "sha256_fingerprint"
hash_detection: true
plaintext_extraction: true
output:
format: "jsonl"
enrichments: ["geoip", "haveibeenpwned_check"]
alerts:
- if: credential_type == "plaintext" && strength == "weak"
action: "send_to_siem_high_priority"
- if: credential_type == "api_key" && source == "git_log"
action: "slack_alert_security_team"
Bible: Browse OT/NT Books