See Brandefense in Action:
Threat Intelligence, Dark Web Monitoring, Attack Surface

Yes. The platform is built on a modular architecture. Modules such as Takedown, Dark Web Monitoring, and Brand Protection can be activated or deactivated independently. Each module operates with its own API quota and data pipeline.

Yes. Sub-tenants can be created under a master account. Each sub-tenant manages its own monitoring scope, user pool, and reporting cycle independently. A parent administrator can view all sub-tenants through a consolidated dashboard.

During onboarding, an isolated demo tenant can be provided for integration testing and analyst training. Live threat data flows exclusively into the production tenant, keeping environments cleanly separated.

An in-platform notification and email alert are sent 30 days before expiry. Read-only access to historical data is preserved until renewal is confirmed. Active monitoring and alert delivery resume immediately upon contract renewal.

Brandefense monitors four source categories: Surface Web (search engines, news outlets, domain registries), Deep Web (non-indexed forums, paste sites, private groups), Dark Web (Tor network, I2P-based platforms, closed marketplaces), and Social Media (Twitter/X, Telegram, Discord channels). Each category is processed by independent crawlers.

Paste sites, dark web data dumps, and stealer log feeds are monitored continuously. When credentials matching your email domain are identified, hash comparison is performed. Records containing plaintext passwords trigger high-priority alerts. Data is normalized and deduplicated before surfacing in the platform.

Findings pass through an ML-based classifier followed by a secondary rule engine filter. Analysts can mark findings as invalid directly in the platform; this feedback is incorporated into model retraining cycles. Allowlist definitions are managed from the scope settings.

Yes. Brand names, domains, IP ranges, executive email addresses, and custom keywords can all be defined as monitored assets.

Brandefense provides ready-made connector templates for Splunk, IBM QRadar, Microsoft Sentinel, Arcsight and Logryhtm.

Yes. Ready-to-use playbook templates are available for Cortex XSOAR.

Takedown coverage includes fake social media accounts and impersonation profiles, phishing domains and landing pages, unauthorized mobile app listings on the App Store and Google Play, brand-impersonating websites, and DMCA-based content removal requests.

Select "Initiate Takedown" from the relevant finding card in the platform. Content category and evidence are pre-populated automatically; analysts can attach additional documentation if needed. Once submitted, the request status is tracked via an in-platform timeline.

An in-platform notification and optional email alert are sent at each status change: submitted, under review, completed, or rejected. The full communication history, including the case reference number, is stored on the request detail page.

The rejection reason is logged in the platform. Requests rejected due to insufficient evidence can be resubmitted with additional documentation. When removal is not feasible, alternative actions are assessed: direct contact with the hosting provider, engagement with the domain registrar, or search engine de-indexing.

Brandefense monitors for re-emergence of previously taken-down content. New domains sharing infrastructure indicators with a prior case — such as IP addresses, nameservers, or page templates are automatically linked to the original takedown record and trigger a high-priority alert.

Yes. Scheduled report delivery can be configured for daily, weekly, or monthly intervals. Recipients, report type, and format (PDF or CSV) are defined in platform settings. Programmatic report triggering is also available via the API.