DarkStrata.CredentialCheck.Umbraco.Automate
2.9.1
dotnet add package DarkStrata.CredentialCheck.Umbraco.Automate --version 2.9.1
NuGet\Install-Package DarkStrata.CredentialCheck.Umbraco.Automate -Version 2.9.1
<PackageReference Include="DarkStrata.CredentialCheck.Umbraco.Automate" Version="2.9.1" />
<PackageVersion Include="DarkStrata.CredentialCheck.Umbraco.Automate" Version="2.9.1" />
<PackageReference Include="DarkStrata.CredentialCheck.Umbraco.Automate" />
paket add DarkStrata.CredentialCheck.Umbraco.Automate --version 2.9.1
#r "nuget: DarkStrata.CredentialCheck.Umbraco.Automate, 2.9.1"
#:package DarkStrata.CredentialCheck.Umbraco.Automate@2.9.1
#addin nuget:?package=DarkStrata.CredentialCheck.Umbraco.Automate&version=2.9.1
#tool nuget:?package=DarkStrata.CredentialCheck.Umbraco.Automate&version=2.9.1
DarkStrata Credential Check for Umbraco Automate
Adds a Compromised Credential Detected trigger to Umbraco Automate, so editors can build their own response to a login or password change that uses stolen credentials on the canvas: alert the security team in Slack, open a ticket, call a webhook, without writing a notification handler.
It fires whenever DarkStrata.CredentialCheck.Umbraco
publishes CompromisedCredentialDetectedNotification. Configure that package first.
Requirements
| Version | |
|---|---|
| Umbraco CMS | 17.4 or later (17.x) |
| Umbraco Automate | 17.x |
| .NET | 10 |
Install
dotnet add package DarkStrata.CredentialCheck.Umbraco.Automate
Restart the site. In Automation, add a trigger and pick DarkStrata → Compromised Credential Detected.
Trigger settings
| Setting | Meaning |
|---|---|
| Sources | Comma-separated list of MemberPassword, BackOfficePassword, MemberLogin, BackOfficeLogin. Empty fires for all. |
Trigger output
| Binding | Value |
|---|---|
${ trigger.source } |
Where the hit came from, as above. |
${ trigger.email } |
Email of the member or backoffice user. |
${ trigger.userId } |
Their Umbraco identity id, when known. |
${ trigger.detectedAt } |
UTC time of the hit. |
Automate records trigger output in its run history, so emails and user ids are stored there. Apply the same retention and access rules you use for other personal data.
Bursts
Hits for the same user and source start at most one run per 5-minute clock window (12:00–12:05, 12:05–12:10, ...), so a brute-force attempt against one account does not flood run history or your alert channel. Two hits either side of a window boundary start two runs.
If Automate is unavailable
Automate writes each trigger event to its database during the login. If that write fails or
stalls, DarkStrata.CredentialCheck.Umbraco logs the error and the login result stands; it stops
waiting after NotificationTimeout (default 5 seconds).
| Product | Versions Compatible and additional computed target framework versions. |
|---|---|
| .NET | net10.0 is compatible. net10.0-android was computed. net10.0-browser was computed. net10.0-ios was computed. net10.0-maccatalyst was computed. net10.0-macos was computed. net10.0-tvos was computed. net10.0-windows was computed. |
-
net10.0
- DarkStrata.CredentialCheck.Umbraco (>= 2.9.1)
- Umbraco.Automate.Core (>= 17.0.0 && < 18.0.0)
NuGet packages
This package is not used by any NuGet packages.
GitHub repositories
This package is not used by any popular GitHub repositories.