Use Cases

detecting stolen credentials of your employees use case “i want to know if the credentials of any of my employees have been leaked in the last 7 days” every week you come to the flare app to see if any new credentials from your employees have been leaked, and therefore your organization might be at risk of being breached how to do it in the tenant feed of the credentials browser date range focus on data from the last 7 days search select the domain of email search type and type in the domain of your organization or filter your domain identifier from the identifier scope dropdown filtering down to the most important leaks use case “i want to filter down to the most important and high risk leaked credentials ” when looking into the credentials of your employees that have been leaked, you want to remove the noise of old and possibly recycled credentials i also only want to see those that are a breach of an employee's device rather than from a 3rd party breach how to do it in the tenant feed of the credentials browser source search for a select stealer logs search select the domain search type and type in the domain of your organization or filter your domain identifier from the identifier scope dropdown investigating a specific compromised employee use case “i know one of my employees has been compromised, and i want to investigate further ” you are aware that one of your employees has been compromised, and you want to better know what has been leaked how to do it in the tenant feed of the credentials browser filter your domain identifier from the identifier scope dropdown search select the email search type and type in the email of the employee of interest or search select the username search type and type in the username of the employee of interest → to understand in more depth what has been breached and the level of risk, you can explore the data in the tenant event feed see more detailed use case here https //docs flare io/queries#zqpoy finding passwords that were breached use case “i am responding to an incident, and i want to know if the attacker used passwords that were previously breached ” you have had an incident, and you know which passwords the attacker used, now you want to investigate if these passwords were previously breached and, if so, when and where how to do it in the tenant feed of the credentials browser filter your domain identifier from the identifier scope dropdown search select the password search type and type in the password of interest finding leaked credentials for a specific service or endpoint use case “i want to know if any credentials have been leaked for a specific service or endpoint ” you have certain endpoints and services that are important to you, and if credentials related to them were leaked, you would be at risk, so you want to investigate these first how to do it in the tenant feed of the credentials browser search select the url search type and type in the url of the service or endpoint of interest filter events using password attributes use case "i want to focus on leaked credentials whose passwords would not have met our password policy " many leaked passwords are weak or reused, and the ones that fall short of your organization's password requirements are often the most likely to be low effort, high risk credentials filtering by password composition lets you narrow in on these first, or conversely filter them out to focus on stronger passwords that still represent a real exposure how to do it when searching for events in the events feed or global search, filter on one or more password attributes to describe the passwords you want to find looking for search passwords shorter than 10 characters password attributes password length <10 passwords with no lowercase letters password attributes password lowercase count 0 passwords with no uppercase letters password attributes password uppercase count 0 passwords with no numbers password attributes password number count 0 passwords with no special characters password attributes password special count 0 passwords meeting a full policy (10+ characters, 1+ number, 1+ special) password attributes password length >=10 and password attributes password number count >=1 and password attributes password special count >=1 black box pentesting use case “when i am doing a black box pentest i want to be able to find leaked credentials of an organization i’m trying to penetrate “ how to do it in the global search of the credentials browser search select the domain of email search type and type in the domain of the organization you are investigating triage out non legitimate employee credentials use case i want to find stealer logs that are only for my employees and i know the password policy how to do it filter using the exclude version of the password policy filter, select all options that do not fit your organization's password policy bulk select all the credentials and remediate them this will remove all non legitimate credentials from the browser note if it's a hash of a password this search may not work