--- title: Matching Policies for Account and Session Takeover Prevention slug: matching-policies-for-account-and-session-takeover-prevention docTags: createdAt: 2025-12-22T15:41:23.535Z --- Account and Session Takeover Prevention (ASTP) helps large consumer web applications protect their users from account compromise and fraud. It enables security and fraud teams to detect when user accounts or active login sessions have been stolen and take action before attackers cause harm. :::hint{type="info"} - Access to this feature requires an add-on. Please reach out to your CSM for more information. - Details on connecting to this data can be found in our [API documentation](https://api.docs.flare.io/api-reference/tokens/endpoints/generate). ::: This solution is built for consumer-facing digital platforms that manage large volumes of user accounts including, e-commerce platforms, financial services and fintech companies, social media and online communities, streaming and entertainment services, gaming platforms, cloud and AI service providers These organizations face constant risk from fraud, account abuse, and reputational damage when attackers gain unauthorized access to user accounts. *** # ASTP Policies and How They Work Flare continuously collects and analyzes data from sources where stolen credentials and session data are traded. This intelligence is continuously evaluated to: 1. Check whether user credentials or sessions have been compromised 2. Identify high-risk or actively abused sessions 3. Trigger security actions such as session revocation or additional verification This data can be leveraged through the following ASTP Matching Policies: :::::Tabs ::::Tab{title="Cookie Monitoring"} The Cookie Monitoring policy defines how Flare monitors cookies associated with a domain Identifier. It is available to customers who have subscribed to the Account and Session Takeover Prevention (ASTP) solution. **How it works: **When a Cookie Monitoring policy is assigned to a domain Identifier, Flare scans incoming stealer logs for cookies matching the monitored domain. Matched cookies are securely stored and made accessible only to the tenant they belong to. Each policy can be assigned to any number of domain Identifiers. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/v3CjcyPp2e7vMFFeWQH3u_image.png" size="90" isUploading="false" width="1272" height="1118" darkWidth="1272" darkHeight="1118" position="flex-start" showCaption="false"} **Configuration: **Each Cookie Monitoring policy has the following configuration: - **Cookie Names:** Enter the specific cookie names to monitor. - **Subdomain Monitoring: **Select the **Extend Monitoring to all subdomains linked to your domain**, to include cookies from all subdomains. - **Identifier Scope:** Select one or more Identifiers, or leave blank to apply to the whole Tenant. :::hint{type="info"} For subdomain monitoring to work correctly, an active Identifier must exist for each subdomain. For example, if subdomain monitoring is enabled for flare.io, cookies from api.flare.io will only be ingested if an Identifier exists for api.flare.io. For more information on automatic subdomain discovery, see [Discovery Policies](docId\:bmzupnRd3txZNwn0VeUn2). ::: :::: :::Tab{title="Domain Matching"} The Domain Matching policy monitors for compromised credentials that match your domain. It is available to customers who have subscribed to the Account and Session Takeover Prevention (ASTP) solution. **How it works:** Flare surfaces credentials using two match modes: 1. **Email domain**: This is the domain used in the user's email address and identifies credentials belonging to employees in your organization. 2. **Authentication domain**: This is the domain of the platform the user was accessing at the time of compromise and identifies credentials that can potentially grant access to your platform, regardless of the email address used to sign in. Coverage extends to all sub-domains automatically. This is useful for organizations where sub-domains list are expansive, dynamic, or difficult to accurately document. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/ygO-vwFXrDHHCED_H85KY_image.png" size="90" isUploading="false" width="1210" height="1118" darkWidth="1210" darkHeight="1118" position="flex-start" showCaption="false"} **Configuration:** Select the Domain Match Mode that aligns with the population you need visibility into: - **Match on email domain only:** Surfaces detections where the compromised credential includes an email address at your organization's domain. Best suited for platforms where your own users or employees are the primary risk population. - **Match on authentication domain only:** Surfaces detections where stolen credentials can potentially grant access to your platform. This includes any user who authenticates on your domain, regardless of where their email is hosted. Best suited for consumer-facing platforms where end users sign in with personal or third-party email addresses rather than an organization-owned domain. - **Match on email and authentication domain:** Surfaces detections matching either match mode. Recommended when your platform serves both internal users and external customers. - **Identifier Scope:** Select one or more Identifiers, or leave blank to apply to the whole Tenant. - **Past Events: **Select **Apply to selected identifier's past events**, to extend the policy to past events as well. ::: ::::: ### Creating an ASTP Policy Follow the steps in this product tour to create an ASTP Matching Policy: :::Iframe{iframeHeight="0" code="
"} ::: :::hint{type="info"} - Up to 10 Matching Policies can be assigned to an Identifier. ::: *** # Key Features and Benefits This solution is designed for organizations operating at internet scale, where millions of users and active sessions make traditional account takeover defenses difficult to manage. It provides organizations visibility into one of the most difficult-to-detect account takeover methods: stolen active sessions. By combining leaked credential intelligence with session-level risk detection, Flare helps teams proactively protect users, reduce fraud, and maintain trust at scale. - **Leaked Credentials Intelligence: **Identify user accounts exposed through large-scale credential leaks. - **Stolen Session Detection: **Detect active login sessions that attackers can use to bypass authentication. - **API-First Integration: **Easily integrate Flare intelligence into fraud, security, or identity systems. - **Continuously Updated Threat Data: **Intelligence is refreshed as new threats and stolen data emerge. - **Reduce Fraud and Abuse: **Stop fraudulent transactions, bot activity, and account misuse earlier. - **Protect Customer Trust: **Prevent unauthorized access that leads to customer frustration or churn. - **Lower Operational Burden: **Avoid building and maintaining complex in-house monitoring for stolen sessions. - **Improve Security Without Excessive Friction: **Target only high-risk sessions instead of applying blanket security measures to all users. *** ### The Use Case: Preventing Account and Session Takeovers Attackers increasingly bypass passwords and multi-factor authentication by stealing active login sessions from infected user devices. Once an attacker has a stolen session, they can access an account as if they were the legitimate user. Flare helps organizations: - Identify accounts exposed through leaked credentials - Detect active sessions that have been stolen and are at risk - Take action to revoke or reset compromised sessions This allows teams to stop account takeovers earlier, before fraud, abuse, or customer impact occurs.