Provider APIs instead of Tor, hash instead of password, incident instead of list
Three modules complement each other on the question of what is known about the organisation outside its own network: the leak check in ASM queries known breaches, leak site monitoring reads the victim lists of ransomware groups, and dark web monitoring fetches from providers with a data contract, initially Intelligence X and Flare, what they find in forums, Telegram channels, paste services and stealer logs. A hit on your own organisation with a password is a compromised account and thus an incident with reporting deadlines; a stealer log with a session token bypasses multi-factor authentication. For that, isidaten never calls the Tor network and crawls no forum itself.
A hit is matched to people exclusively through the SHA-256 hash of the e-mail address; the address itself is not stored. Passwords, dumps and files are not downloaded; what is stored is metadata and the description from the provider, cut to 2,000 characters. Locations named by the provider are kept as text and never rendered as links.
Domains and organisation names enter the watch list from the inventory. Persons enter it only when expressly released, because monitoring named people is a different legal question from monitoring a domain.
Own credentials: incident and reset task. Brand abuse: takedown task. Supplier: task for procurement. On click or, enabled per tenant and response, automatically; every automation is off by default, and a risk is never created automatically.
What circulates about your organisation on the dark web arrives as an incident with a deadline, not as a provider’s PDF.
Schedule a no-obligation demo – we will show you the module with your own use cases.
