Matching Policies for Account and Session Takeover Prevention

account and session takeover prevention (astp) helps large consumer web applications protect their users from account compromise and fraud it enables security and fraud teams to detect when user accounts or active login sessions have been stolen and take action before attackers cause harm this feature required an add on contact our support team if you would like to add astp coverage to your plan details on connecting to this data can be found in our api documentation https //api docs flare io/api reference/tokens/endpoints/generate this solution is built for consumer facing digital platforms that manage large volumes of user accounts including, e commerce platforms, financial services and fintech companies, social media and online communities, streaming and entertainment services, gaming platforms, cloud and ai service providers these organizations face constant risk from fraud, account abuse, and reputational damage when attackers gain unauthorized access to user accounts astp policies and how they work flare continuously collects and analyzes data from sources where stolen credentials and session data are traded this intelligence is made available to customers through apis, allowing them to check whether user credentials or sessions have been compromised identify high risk or actively abused sessions trigger security actions such as session revocation or additional verification all detection and response happens within the customer’s existing security workflows there are two astp policies available the cookie monitoring policy defines how flare monitors cookies associated with a domain identifier it is available to customers who have subscribed to the account and session takeover prevention (astp) solution how it works when a cookie monitoring policy is assigned to a domain identifier, flare scans incoming stealer logs for cookies matching the monitored domain matched cookies are securely stored and made accessible only to the tenant they belong to each policy can be assigned to any number of domain identifiers configuration each cookie monitoring policy defines two things cookie names the specific cookie names to monitor subdomain monitoring whether cookies from subdomains of the monitored domain should also be included for subdomain monitoring to work correctly, an active identifier must exist for each subdomain for example, if subdomain monitoring is enabled for flare io, cookies from api flare io will only be ingested if an identifier exists for api flare io for more information on automatic subdomain discovery, see discovery policies docid\ bmzupnrd3txznwn0veun2 the domain matching policy monitors for compromised credentials that match your domain it is available to customers who have subscribed to the account and session takeover prevention (astp) solution how it works flare surfaces credentials using two match modes email domain this is the domain used in the user's email address and identifies credentials belonging to employees in your organization authentication domain this is the domain of the platform the user was accessing at the time of compromise and identifies credentials that can potentially grant access to your platform, regardless of the email address used to sign in coverage extends to all sub domains automatically this is useful for organizations where sub domains list are expansive, dynamic, or difficult to accurately document configuration select the domain match mode that aligns with the population you need visibility into match on email domain only surfaces detections where the compromised credential includes an email address at your organization's domain best suited for platforms where your own users or employees are the primary risk population match on authentication domain only surfaces detections where stolen credentials can potentially grant access to your platform this includes any user who authenticates on your domain, regardless of where their email is hosted best suited for consumer facing platforms where end users sign in with personal or third party email addresses rather than an organization owned domain match on email and authentication domain surfaces detections matching either match mode recommended when your platform serves both internal users and external customers up to 10 matching policies can be assigned to an identifier domain authentication policies can be applied to past events as well creating an astp policy key features and benefits this solution is designed for organizations operating at internet scale, where millions of users and active sessions make traditional account takeover defenses difficult to manage it provides organizations visibility into one of the most difficult to detect account takeover methods stolen active sessions by combining leaked credential intelligence with session level risk detection, flare helps teams proactively protect users, reduce fraud, and maintain trust at scale leaked credentials intelligence identify user accounts exposed through large scale credential leaks stolen session detection detect active login sessions that attackers can use to bypass authentication api first integration easily integrate flare intelligence into fraud, security, or identity systems continuously updated threat data intelligence is refreshed as new threats and stolen data emerge reduce fraud and abuse stop fraudulent transactions, bot activity, and account misuse earlier protect customer trust prevent unauthorized access that leads to customer frustration or churn lower operational burden avoid building and maintaining complex in house monitoring for stolen sessions improve security without excessive friction target only high risk sessions instead of applying blanket security measures to all users the use case preventing account and session takeovers attackers increasingly bypass passwords and multi factor authentication by stealing active login sessions from infected user devices once an attacker has a stolen session, they can access an account as if they were the legitimate user flare helps organizations identify accounts exposed through leaked credentials detect active sessions that have been stolen and are at risk take action to revoke or reset compromised sessions this allows teams to stop account takeovers earlier, before fraud, abuse, or customer impact occurs