Provider APIs instead of Tor, hash instead of password, incident instead of list
Three modules complement each other on the question of what is known about the organisation outside its own network: the leak check in ASM queries known breaches, leak site monitoring reads the victim lists of ransomware groups, and dark web monitoring fetches from providers with a data contract, initially Intelligence X and Flare, what they find in forums, Telegram channels, paste services and stealer logs. A hit on your own organisation with a password is a compromised account and thus an incident with reporting deadlines; a stealer log with a session token bypasses multi-factor authentication. For that, isidaten never calls the Tor network and crawls no forum itself.
The personal reference of a hit runs exclusively through the SHA-256 hash of the e-mail address. Passwords, dumps and files are not downloaded, only metadata. Locations named by the provider are kept as text and never rendered as links.
Domains and organisation names enter the watch list from the inventory. Persons enter it only when expressly released, because monitoring named people is a different legal question from monitoring a domain.
Own credentials: incident and reset order. Brand abuse: takedown task. Supplier: task for procurement. On click or, enabled per tenant, automatically via the rule chain.
What circulates about your organisation on the dark web arrives as an incident with a deadline, not as a provider’s PDF.
Schedule a no-obligation demo – we will show you the module with your own use cases.
