Skip to main content

Defend threat intelligence user guide

Updated

Part of Defend, in progress — Threat Intel and Security are now part of Defend, not separate products. This area is still being built: some screens, menu names and actions described here may not be available yet, or may still show the older Threat Intel or Security names.

Overview

Threat intelligence is the external-threat part of Defend. It watches what is happening outside the organization's perimeter — the dark web, credential dumps, lookalike domains being registered, and supply-chain vendors showing up in breaches — and tells you the moment something matters to one of your clients.

Use Defend threat intelligence when you want to know whether your client's email addresses, domains, or vendors have been exposed before the attackers try to use the exposure against them.

Data-source / capability note: the live dark-web / credential-exposure monitoring is powered by Enzoic and is per-account by email — it checks the addresses of the users you manage automatically, and does not support manual email/domain/keyword monitors or paste-site scanning. Several "How To" and FAQ items below describe the manual-monitor, domain-monitor, keyword, paste-site, lookalike-domain, and supply-chain-domain mechanics of the retired standalone Threat Intel product (now part of Defend) (which used a HIBP enterprise feed). Those are retained here as legacy context and are not guaranteed to be backed by the current live integration — see Dark Web Monitoring for the accurate, current behavior.

Key Features

  • Dark web monitoring — checks the email addresses of the users you manage against Enzoic's breach-exposure data (per-account by email; no domain, keyword, or paste-site scanning).
  • Credential exposure reports — per-email roll-up across every breach a managed address has appeared in.
  • Breach response automation — rules that automatically open a PSA ticket, send a user email, and emit a bus event when a new breach is detected.
  • Threat narrative (Complete tier) — THEO-generated quarterly executive briefing in HTML ready to deliver at a QBR.
  • Lookalike domain monitoring (Complete tier) — brand impersonation detection using WhoisXML and DNS.
  • Supply-chain risk (Complete tier) — vendor registry with automatic breach cross-checks on each vendor's domain.
  • Priority alerting (Complete tier) — elevated alerting surface for executives.
  • Remediation plans — per-breach recommended actions you can share with affected users.
  • MSP-wide dashboard — aggregate view across every client tenant.

Pricing: there is no separate per-user price for Defend threat intelligence — it is part of the all-inclusive platform plan, and no Defend threat intelligence line is billed per user. The Essentials and Complete names used on this page describe which capabilities are available to you, not what they cost.

Pricing note (2026-09-23): this page previously carried per-user figures against the Essentials and Complete levels. No source for those figures exists in the platform's product catalogue, rate card or billing configuration, so they have been removed. ⛔ Do not restate a per-user number here unless it names a source.

How To: Add an Email to Dark Web Monitoring

  1. Open Defend threat intelligence (older menus: Defend threat intelligence) and go to Dark Web.
  2. Click New Monitor. Choose Email.
  3. Enter the email address and pick who should be notified on a hit.
  4. Save. The background scanner runs twice a day and adds the address to its queue.
  5. Past breaches involving this address appear in the findings list within the first scan.

How To: Monitor a Domain

  1. Go to Dark Web.
  2. Click New Monitor. Choose Domain.
  3. Enter the domain. Every breach that mentions an address at the domain will appear in findings.
  4. Configure notify recipients — typically client stakeholders and your security analysts.

How To: Check Credential Exposure for a Single User

  1. Go to Credential Exposure.
  2. Enter an email address.
  3. The report shows every known breach the address has been in, the exposed data class (password, hash, phone, address, etc.), and the breach date.
  4. Click Remediation Plan for a step-by-step list tailored to the exposure — rotate specific passwords, enable MFA, check forwarding rules, and so on.

How To: Configure Breach Response Automation

  1. Go to Breach Response.
  2. Click New Rule.
  3. Pick the trigger (new breach for monitored email, new breach for monitored domain, supply-chain vendor breach).
  4. Pick the actions: create PSA ticket, email the affected user, emit a bus event.
  5. Save. When the next scan turns up a matching finding, the automation runs and creates an incident record.

How To: Generate a Threat Narrative (Complete Tier)

  1. Go to Threat Narrative.
  2. Click Generate. Pick the client and the reporting period (typically a quarter).
  3. THEO pulls threat data from the reporting window — dark-web findings, lookalike detections, vendor alerts, breach trends — and composes an executive-ready HTML briefing.
  4. Preview the narrative. Click Export to download the HTML you can drop into a QBR deck.

How To: Watch for Lookalike Domains (Complete Tier)

  1. Go to Lookalike Monitoring.
  2. Click Add Monitor. Enter the brand domain to protect.
  3. The scanner runs each day, pulling newly registered domains from WhoisXML, then running DNS resolution to see if they are live.
  4. Candidates appear with a similarity score. Review each and mark monitor, report, or ignore.

How To: Register a Supply-Chain Vendor (Complete Tier)

  1. Go to Supply Chain.
  2. Click Add Vendor. Enter the vendor name and domain.
  3. Save. The scanner runs three times a day and cross-checks the vendor's domain against HaveIBeenPwned breach data.
  4. A vendor alert opens if a breach is detected. Click Risk Analysis for a tailored assessment.

How To: Share a Breach Finding With a Client

  1. Open the finding.
  2. Click Generate Remediation Plan.
  3. Review the tailored steps.
  4. Click Send to Client. The system emails the affected user (or your designated client contact) with the remediation plan.
  5. The PSA ticket, if configured, is already open for tracking.

How To: Build a Weekly Review

  1. Go to Dashboard.
  2. Review the rollup — new findings this week, unresolved breaches, open vendor alerts, lookalike registrations.
  3. Click Intel Briefing for the tenant-scoped summary.
  4. Export or share with your SOC lead.

Frequently Asked Questions

Where does the data come from? Dark-web / credential-exposure data comes from Enzoic (per managed-user email address). WhoisXML for newly registered domains; DNS resolution for lookalike activity (legacy/Complete-tier surfaces — see the capability note at the top).

How often is the dark web scanned? Email monitors are scanned twice a day. Supply-chain vendors three times a day. Lookalike registrations daily.

Will I see historical breaches as soon as I add an email? Yes. The first scan after adding a monitor returns every known breach the address has been in.

Can I export remediation plans to PDF? Yes, via the browser print-to-PDF on the remediation plan page.

What is in Complete that is not in Essentials? Threat narrative (AI QBR reports), lookalike domain monitoring, supply-chain risk, and priority alerting. Essentials has dark web monitoring, credential exposure, and basic breach response.

Does Defend threat intelligence monitor the actual dark web (Tor)? It uses curated breach-exposure data from Enzoic, which does the dark-web collection. Defend threat intelligence queries that data for the addresses of the users you manage.

How do I know a breach is recent? Each finding has a breach date and the date it was added to the feed. Recent additions are flagged on the dashboard.

Will monitoring one domain cover every user at that domain? Yes. Domain monitors match any address at the domain.

Troubleshooting

Dark web scan returned nothing for a user I know was breached. Confirm the platform's Enzoic credentials are configured and that the user is enrolled (present in your phishing/training roster) so their address is in the scanned set. Enzoic's corpus may also simply not contain that particular exposure.

Breach response automation did not fire. Confirm the rule is Enabled and that its trigger matches the finding's category. Also check PSA integration credentials; a ticket-creation failure can cascade.

Lookalike monitor is empty. Confirm the WhoisXML key is configured; without it the scanner falls back to DNS-only and will detect fewer domains.

Supply-chain vendor alert says "domain not monitored." Ensure you added the vendor's domain, not just the vendor name. Without a domain the HIBP breach check cannot run.

Threat narrative generation took a long time or partially failed. THEO has a timeout. Retry the generation. If it repeatedly fails, check the reporting window — very large windows can overload the summarizer.

Client is asking why they got an email they did not expect. Review the Breach Response rule that fired and confirm the recipient list. You can also switch from automatic email to PSA-ticket only while you tune the rules.

Credential exposure report shows addresses that do not belong to my client. Remove the monitor that is matching them and replace it with a domain monitor scoped to the client's domain.