Threat Intelligence
Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.
The open web, underground forums, dark web markets, messaging channels, ransomware leak sites and threat indicator sources are monitored regularly. Impersonating domains, pages and accounts are monitored separately; your verified domains are scanned with your approval.
- Appears in scenarios
Infostealer Detection
Monitor the accounts of your employees that appear in leak records, by your domain. See the malware family and leak date on every finding.
Explore Infostealer DetectionExecutive Protection
Monitor your executives’ email addresses and usernames person by person. See each executive’s open leaks separately.
Explore Executive ProtectionThird-Party Risk
Monitor leaks seen on your suppliers' domains. See each supplier's score and open findings, and notify the supplier of a finding.
Explore Third-Party RiskPhishing & Brand Protection
Monitor lookalike domains, phishing pages, ads and listings. Open a takedown request from the panel and follow it through.
Explore Phishing & Brand ProtectionAttack Surface Management
Monitor the services, IP addresses, running technologies and known vulnerabilities linked to your verified domains.
Explore Attack Surface Management
Intelligence packages
The threat intelligence dashboard is included in every package. Findings that match your assets are in the Intelligence 360 package.
Free
To see your leak status
$0/ mo
Threat intelligence dashboard
Essential
Monitor employee and third-party leaks.
$400/ mo
Billed $4,800 yearly.
Threat intelligence dashboard
Professional
Manage leak and brand risks.
$1,000/ mo
Billed $12,000 yearly.
Threat intelligence dashboard
Intelligence 360
Also monitor executive, supplier and threat intelligence matches.
$1,500/ mo
Billed $18,000 yearly.
Dashboard and matches with your assets
Frequently asked questions
From victim listings on ransomware groups' leak sites, threat indicators in open threat intelligence feeds and infostealer records collected by Dark Radar. You can review records by country, sector and malware family.
An IOC (indicator of compromise) is an IP address, domain, URL or file hash (MD5, SHA-1, SHA-256) associated with an attack. Each indicator is shown with its source, related malware family, threat type and last seen date.
In the Intelligence 360 package, notifications are sent for threat indicators and ransomware posts that match your assets. You can also route notifications to the systems your team uses, such as Slack, Microsoft Teams and Jira.
Yes. Each record shows its source and last seen date. If the source provides a confidence score, it is shown as well.
Yes. Events related to your organisation can be sent to SIEM and SOAR systems, a data lake and STIX 2.1 / TAXII 2.1 compatible threat intelligence platforms.
Records come with context. Threat indicators are shown with their related malware family and threat type, and ransomware posts with the victim's sector, country and an analysis of the leaked content.
You can use threat indicators in incident investigations for verification and blocking decisions. By monitoring ransomware groups targeting your sector and country, you can set your defense priorities.