{"inputs":["email","username","phone","domain","ip","url","name","image","crypto_address","hash","company","string","integer","boolean","enum"],"outputs":["account","email","username","phone","domain","subdomain","ip","url","person","organization","location","breach","certificate","dns_record","image","document","crypto_address","transaction","other"],"categories":["email","username","phone","domain-dns","ip-network","social-media","people","company","images-geo","crypto","breach-data","web-archive","documents-metadata","utilities"],"pivots":{"account":[{"input":"username","attr":"username"},{"input":"url","attr":"url"}],"email":[{"input":"email"},{"input":"domain","transform":"email_domain"}],"username":[{"input":"username"}],"phone":[{"input":"phone"}],"domain":[{"input":"domain"}],"subdomain":[{"input":"domain"}],"ip":[{"input":"ip"}],"url":[{"input":"url"},{"input":"domain","transform":"host"}],"person":[{"input":"name"}],"organization":[{"input":"company"}],"certificate":[{"input":"domain","attr":"domain"}],"dns_record":[{"input":"ip","attr":"ip"},{"input":"domain","attr":"domain"}],"image":[{"input":"image"}],"crypto_address":[{"input":"crypto_address"}],"location":[],"breach":[],"document":[],"transaction":[],"other":[]},"descriptions":{"inputs":{"email":"An email address, such as jane@example.com","username":"A handle or account name on a website, without the @","phone":"A phone number, best in international form such as +14155550100","domain":"A domain or host name, such as example.com or mail.example.com","ip":"An IPv4 or IPv6 address","url":"A full web address, including https://","name":"A person's full name","image":"An image: a URL to one, or a path to a file","crypto_address":"A cryptocurrency wallet address (Bitcoin, Ethereum and others)","hash":"A file or password hash (MD5, SHA-1, SHA-256 and others)","company":"A company or organisation name","string":"Free text, as the tool describes","integer":"A whole number, such as a limit or a timeout","boolean":"true or false","enum":"One of a fixed list of values, given by the tool"},"outputs":{"account":"An account on a website or service, usually with its site, username and URL","email":"An email address","username":"A handle or account name","phone":"A phone number","domain":"A registered domain name","subdomain":"A host name under a domain, such as mail.example.com","ip":"An IP address","url":"A web address","person":"A person, by name or profile","organization":"A company, group or other organisation","location":"A place: an address, a city, or coordinates","breach":"A data breach the target appears in","certificate":"A TLS certificate and what it covers","dns_record":"A DNS record, such as an A, MX or TXT record","image":"An image, or a link to one","document":"A document or file, and its metadata","crypto_address":"A cryptocurrency wallet address","transaction":"A cryptocurrency transaction","other":"Anything else a tool reports, described in its attributes"},"categories":{"email":"Investigating email addresses","username":"Finding accounts by username","phone":"Investigating phone numbers","domain-dns":"Domains, DNS records and subdomains","ip-network":"IP addresses, networks and hosting","social-media":"Social media profiles and posts","people":"Finding information about people","company":"Companies and organisations","images-geo":"Images, reverse image search and geolocation","crypto":"Cryptocurrency addresses and transactions","breach-data":"Data breaches and exposed credentials","web-archive":"Archived web pages and URL history","documents-metadata":"Documents and the metadata in files","utilities":"Helpers: parsing, converting and generating values"}}}