Eliminate Noises,
Focus on Cyber Threats!

Yes. The platform is built on a modular architecture. Modules such as Takedown, Dark Web Monitoring, and Brand Protection can be activated or deactivated independently. Each module operates with its own API quota and data pipeline.

Yes. Sub-tenants can be created under a master account. Each sub-tenant manages its own monitoring scope, user pool, and reporting cycle independently. A parent administrator can view all sub-tenants through a consolidated dashboard.

During onboarding, an isolated demo tenant can be provided for integration testing and analyst training. Live threat data flows exclusively into the production tenant, keeping environments cleanly separated.

An in-platform notification and email alert are sent 30 days before expiry. Read-only access to historical data is preserved until renewal is confirmed. Active monitoring and alert delivery resume immediately upon contract renewal.

Brandefense monitors four source categories: Surface Web (search engines, news outlets, domain registries), Deep Web (non-indexed forums, paste sites, private groups), Dark Web (Tor network, I2P-based platforms, closed marketplaces), and Social Media (Twitter/X, Telegram, Discord channels). Each category is processed by independent crawlers.

Paste sites, dark web data dumps, and stealer log feeds are monitored continuously. When credentials matching your email domain are identified, hash comparison is performed. Records containing plaintext passwords trigger high-priority alerts. Data is normalized and deduplicated before surfacing in the platform.

Findings pass through an ML-based classifier followed by a secondary rule engine filter. Analysts can mark findings as invalid directly in the platform; this feedback is incorporated into model retraining cycles. Allowlist definitions are managed from the scope settings.

Yes. Brand names, domains, IP ranges, CIDR blocks, executive email addresses, and custom keywords can all be defined as monitored assets. Regex-based search rules are also supported. Scope changes are propagated to crawlers in real time.

All findings are retained from the monitoring start date. For certain source categories, archive data from before onboarding may be available. Historical records can be queried via the platform's search interface or the REST API.

The REST API uses Bearer Token authentication. Tokens are generated in the platform and can be scoped (read / write / admin) with configurable expiry dates. SAML 2.0 and OIDC-based SSO are supported for enterprise identity providers including Okta, Azure AD, and ADFS.

Brandefense provides ready-made connector templates for Splunk, IBM QRadar, Microsoft Sentinel, and Elastic SIEM. Alerts can be forwarded in CEF or JSON format over Syslog/TCP. Alternatively, the SIEM&'s API poller can query the Brandefense REST endpoint on a scheduled basis.

Target URL, HTTP method (POST), and custom headers are configured in platform settings. Trigger conditions can be filtered — for example, critical-severity alerts only. The webhook payload is JSON-formatted. A retry mechanism handles failed deliveries, and all delivery attempts are logged.

Yes. Ready-to-use playbook templates are available for Palo Alto XSOAR, Splunk SOAR, and Swimlane. Alert ingestion, status updates, and takedown request creation can all be automated via the API. Full API reference documentation is provided for custom playbook development.

The default rate limit is 60 requests per minute, adjustable based on license tier. When the limit is exceeded, the API returns HTTP 429 with a Retry-After header indicating

Takedown coverage includes fake social media accounts and impersonation profiles, phishing domains and landing pages, unauthorized mobile app listings on the App Store and Google Play, brand-impersonating websites, and DMCA-based content removal requests.

Select "Initiate Takedown" from the relevant finding card in the platform. Content category and evidence are pre-populated automatically; analysts can attach additional documentation if needed. Once submitted, the request status is tracked via an in-platform timeline.

An in-platform notification and optional email alert are sent at each status change: submitted, under review, completed, or rejected. The full communication history, including the case reference number, is stored on the request detail page.

The rejection reason is logged in the platform. Requests rejected due to insufficient evidence can be resubmitted with additional documentation. When removal is not feasible, alternative actions are assessed: direct contact with the hosting provider, engagement with the domain registrar, or search engine de-indexing.

Brandefense monitors for re-emergence of previously taken-down content. New domains sharing infrastructure indicators with a prior case — such as IP addresses, nameservers, or page templates — are automatically linked to the original takedown record and trigger a high-priority alert.

Four report types are available: Executive Summary (KPI-focused with visual charts), Threat Detail (full technical context per finding), Module Activity (source, alert, and takedown statistics), and Trend (time-series comparisons). All reports can be exported as PDF or CSV.

Yes. Scheduled report delivery can be configured for daily, weekly, or monthly intervals. Recipients, report type, and format (PDF or CSV) are defined in platform settings. Programmatic report triggering is also available via the API.

Reports can be filtered by date range, module, threat severity (critical / high / medium / low), source category, and monitored asset (brand or domain). Filter combinations can be saved as named views and assigned to scheduled reports.

Yes. Raw data is available in JSON format through the /reports and /findings endpoints. This approach is preferred for feeding data into BI tools such as Power BI, Tableau, or Grafana. Pagination and date range parameters are fully supported.

Role-based access control applies to the reporting layer. SOC analysts can access detailed technical reports while executive users can be restricted to summary-level views. A default report view can be assigned per role.