Credential Browser Use Cases

detecting stolen credentials of your employees use case “i want to know if the credentials of any of my employees have been leaked in the last 7 days” every week you come to the flare app to see if any new credentials from your employees have been leaked, and therefore your organization might be at risk of being breached how to do it in the tenant feed of the credentials browser date range focus on data from the last 7 days search select the domain of email search type and type in the domain of your organization or filter your domain identifier from the identifier scope dropdown filtering down to the most important leaks use case “i want to filter down to the most important and high risk leaked credentials ” when looking into the credentials of your employees that have been leaked, you want to remove the noise of old and possibly recycled credentials i also only want to see those that are a breach of an employee's device rather than from a 3rd party breach how to do it in the tenant feed of the credentials browser source search for a select stealer logs search select the domain search type and type in the domain of your organization or filter your domain identifier from the identifier scope dropdown investigating a specific compromised employee use case “i know one of my employees has been compromised, and i want to investigate further ” you are aware that one of your employees has been compromised, and you want to better know what has been leaked how to do it in the tenant feed of the credentials browser filter your domain identifier from the identifier scope dropdown search select the email search type and type in the email of the employee of interest or search select the username search type and type in the username of the employee of interest → to understand in more depth what has been breached and the level of risk, you can explore the data in the tenant event feed see more detailed use case here finding passwords that were breached use case “i am responding to an incident, and i want to know if the attacker used passwords that were previously breached ” you have had an incident, and you know which passwords the attacker used, now you want to investigate if these passwords were previously breached and, if so, when and where how to do it in the tenant feed of the credentials browser filter your domain identifier from the identifier scope dropdown search select the password search type and type in the password of interest finding leaked credentials for a specific service or endpoint use case “i want to know if any credentials have been leaked for a specific service or endpoint ” you have certain endpoints and services that are important to you, and if credentials related to them were leaked, you would be at risk, so you want to investigate these first how to do it in the tenant feed of the credentials browser search select the url search type and type in the url of the service or endpoint of interest black box pentesting use case “when i am doing a black box pentest i want to be able to find leaked credentials of an organization i’m trying to penetrate “ how to do it in the global search of the credentials browser search select the domain of email search type and type in the domain of the organization you are investigating triage out non legitimate employee credentials use case i want to find stealer logs that are only for my employees and i know the password policy how to do it filter using the exclude version of the password policy filter, select all options that do not fit your organization's password policy bulk select all the credentials and remediate them this will remove all non legitimate credentials from the browser note if it's a hash of a password this search may not work