Skip to main content

Breach alerts in Defend

Updated

Part of Defend, in progress — Threat Intel and Security are now part of Defend, not separate products. This area is still being built: some screens, menu names and actions described here may not be available yet, or may still show the older Threat Intel or Security names.

Overview

Breach alerts notify your team when a dark web scan finds that a managed email address has appeared in a known breach. This is an Essentials-tier feature.

Capability note: the live dark-web scanner (Enzoic, per managed-user email) records findings and emits a platform bus event (cypher.dark_web.finding_detected) for genuinely new findings. The monitored-address/monitored-domain triggers, the configurable breach-response rule engine (per-rule email + PSA-ticket + bus-event actions), incident records, and the threatintel.breach_detected event described below reflect the retired standalone Threat Intel product (now part of Defend) and are not guaranteed to be backed by the current live integration. Treat them as legacy context.

What a Breach Alert Contains

Each breach finding includes:

  • The breach name (for example, the compromised service or site)
  • The breach date — when the breach originally occurred
  • The date the breach was added to the upstream feed — useful for assessing how recently it became actionable
  • The data classes exposed: passwords, password hashes, phone numbers, physical addresses, and other personal data depending on the breach

When you open a finding, you can generate a remediation plan that provides step-by-step recommended actions tailored to what was exposed.

Receiving Alerts

Alerts reach your team in up to three ways, depending on your breach-response rules:

  • Email — sent via AWS SES to the affected user and any notify recipients set on the monitor.
  • PSA ticket — automatically opened in your connected PSA with the breach details attached.
  • Bus event — threatintel.breach_detected is emitted on the platform security channel, which can trigger workflows in other products.

All three methods can be enabled simultaneously on a single rule, or you can enable only the channels you need.

Setting Up Breach Response Automation

  1. Go to Breach Response.
  2. Click New Rule.
  3. Choose the trigger: new breach for a monitored email, new breach for a monitored domain, or a supply-chain vendor breach.
  4. Choose the actions to run: create a PSA ticket, email the affected user, and/or emit a bus event.
  5. Click Save. The rule is active on the next scan.

When a scan match triggers the rule, Defend threat intelligence creates a breach response incident record. You can view all triggered incidents in the Breach Response section.

Triaging an Incident

  1. Open the incident from the Breach Response list.
  2. Review the finding details and which rule fired.
  3. Click Triage to manually update the incident status.
  4. If you need to share remediation steps with the client:
    • Click Generate Remediation Plan.
    • Review the steps.
    • Click Send to Client to email the affected user or client contact with the plan.

FAQ

A client said they got an unexpected breach email. How do I find out why? Go to Breach Response and review the incident record that triggered the email. The record shows which rule fired and which finding matched. Check the rule's recipient list — you may need to narrow it or switch from automatic email to PSA-ticket only while you tune the rule.

Breach response automation did not fire when I expected it to. Confirm the rule is set to Enabled. Check that the trigger type on the rule matches the category of the finding (for example, a domain-breach trigger will not fire on a keyword finding). Also verify that your PSA integration credentials in Settings are valid — a ticket-creation failure can prevent the rule from completing.

Can I manually triage an incident without email going out? Yes. The triage action updates the incident status and does not resend emails. If you want to stop automated emails entirely for a rule, edit the rule and disable the email action while keeping PSA ticketing active.

Related