Part of Defend, in progress — Threat Intel and Security are now part of Defend, not separate products. This area is still being built: some screens, menu names and actions described here may not be available yet, or may still show the older Threat Intel or Security names.
Overview
Defend threat intelligence connects outbound to several external services and pushes threat data to other platform products via the Bus and direct API calls. MSP administrators configure integrations in Settings, and security analysts benefit from them automatically once configured — breach findings open PSA tickets, bus events trigger downstream workflows, and other products query Defend threat intelligence for current threat posture data.
Platform Bus (Internal)
When breach-response automation rules fire, Defend threat intelligence emits events on the platform Bus security channel. Any platform product subscribed to that channel receives these events:
| Event | When It Fires |
|---|---|
threatintel.breach_detected |
A dark web scan finds a new breach for a monitored email or domain |
threatintel.lookalike_registered |
The lookalike scanner detects a new candidate domain (Complete tier) |
threatintel.supply_chain_alert |
A vendor's domain appears in a breach (Complete tier) |
These events allow Defend, RMM, and other subscribed products to react to threat intel without polling.
PSA Integration
Breach-response rules can automatically open a PSA ticket when a scan finds a new breach. To enable this:
- Go to Settings and open the Integrations section.
- Enter your PSA API URL and integration key.
- Go to Breach Response and create or edit a rule.
- Enable the Create PSA Ticket action on the rule.
Ticket content includes the breach name, affected address or domain, data classes exposed, and the breach date. If ticket creation fails (for example, due to an invalid PSA credential), the breach-response rule will not complete. Check PSA credentials in Settings if automation is not firing.
Other Defend features (via Bus and threat summary)
Other platform products can pull a 30-day threat posture rollup from Defend threat intelligence using the integration endpoint. This returns aggregate counts of active findings, open vendor alerts, and lookalike registrations for a tenant. Defend uses this to display current threat context without requiring a user to visit Defend threat intelligence directly.
This is a service-to-service call using integration keys — no user configuration is needed beyond ensuring Defend threat intelligence is active for the tenant.
Defend (Credential Exposure)
Defend's endpoint side can query threat intelligence for per-email credential exposure data directly, using an internal service key. This allows Defend to surface breach context on user identities it manages. No additional configuration is required on the Defend threat intelligence side.
Enzoic (Dark Web / Credential Exposure)
Dark web findings rely on Enzoic's breach-exposure data. Enzoic is configured at
the platform level (via the ENZOIC_API_KEY / ENZOIC_API_SECRET credentials)
— there is no per-tenant key to enter and nothing to configure in Settings. When
the credentials are present, the daily scanner automatically checks the email
addresses of the users each tenant manages. When they are absent the pipeline is
wired but skips scanning until the credentials are added by the platform
administrator.
The check is per-account by email only; there is no domain search or paste-site scanning to configure. (Supply-chain vendor domain breach checks described elsewhere in these docs reflect the retired standalone Threat Intel product (now part of Defend) and are not backed by the current Enzoic integration.)
WhoisXML (Lookalike Scanning, Complete Tier)
Lookalike domain monitoring uses WhoisXML's newly registered domains feed to find candidate domains before they are indexed elsewhere. Without this key, the scanner falls back to DNS-only detection and will find fewer lookalike candidates.
To configure:
- Go to Settings > Integrations.
- Enter your WhoisXML API key.
- Save.
Email Notifications (AWS SES)
User breach notification emails are sent via AWS SES. This is configured at the platform level and does not require per-tenant setup. If breach email notifications are not arriving, check with your platform administrator that SES credentials are current.
FAQ
Breach response automation fired but no PSA ticket was created. Check that your PSA API URL and integration key in Settings are current. A credential failure prevents ticket creation and will not retry automatically. Correct the credentials and re-trigger the rule manually via the triage action on the incident.
Do I need to configure anything for the Bus events to reach Defend? No. Bus event emission happens automatically when a matching rule fires. Whether Defend or another product acts on those events depends on that product's own configuration.
Can I use Defend threat intelligence data in a product not listed here? Any product that can subscribe to the platform Bus security channel will receive breach, lookalike, and supply-chain alert events. Custom integrations using the integration endpoint and a valid service key can also pull the 30-day threat summary.