Description

DarkStrata is a dark web monitoring and stolen credential detection platform for businesses, MSPs,
MSSPs and SOC teams. It continuously collects and parses infostealer malware logs, breach dumps,
combolists, criminal forum posts and Telegram channel drops, matches them against your domains,
employees and customers, alerts you in real time, and privately tells the affected person exactly what
to do. By focusing on the freshest source of account takeover, stealer logs, DarkStrata helps teams
find and fix stolen accounts before they are exploited.
Why stealer logs: breach dumps tell you about last year, stealer logs tell you about last night. Malware
such as Lumma, StealC, Vidar and RedLine strips a device of saved passwords, live session cookies
(which bypass MFA), autofill data and a device fingerprint, and the log is on sale within 24 to 48 hours.
DarkStrata parses logs from 20+ families and follows the data across Telegram, underground forums,
log marketplaces, leak sites, paste sites and accidental clear-web exposure, alongside a massive
breach directory of billions of records.
Intelligent scoring that alerts only on data that matters. Raw logs and dumps are full of test accounts,
placeholders, disposable and burner addresses, corrupted strings, URL fragments and fabricated or
stale records. DarkStrata's junk scoring engine weighs 80+ signals to filter fake and irrelevant data
before it ever becomes an alert. Genuine records then get a threat score from Info to Critical based on
your organisation's context: password reuse, naming-rule matches, logins to your monitored assets
and membership of synced identity groups. Your SOC sees the critical rows about your staff and your
customers, not billions of noise rows.
Microsoft Entra ID and Google Workspace sync. Identity groups are synchronised continuously from
your directory, so a match against a real employee or a priority/VIP group is scored High or Critical with
certainty, and leavers drop out of scope automatically. Employee (outbound) and customer (inbound)
exposures are scored separately, with customer matches routed to fraud operations.
Private employee remediation with Lens. Affected staff are notified privately, review which credentials
were compromised on a mobile-friendly portal, reset passwords, revoke sessions and complete built-in
security awareness training. Admins see completion metrics, never passwords or services. Supplier
logins only the user can reset are flagged separately from corporate accounts you can force-reset.
Credential Check API. Block breached passwords at sign-up, login and password reset using
k-anonymity: only a 5 or 6 character hash prefix is sent and results are HMAC-scrambled, so
credentials never leave your infrastructure. Official SDKs for Node.js, Python, Rust, Go, C#, Java and
PHP, a Laravel package, an Umbraco package and offline hash files for bulk audits and password
managers.
API-first. Every capability is a documented REST resource: alerts, assets, groups, users, webhooks,
exposures, breaches, naming rules, Lens invites, exports and usage. Webhooks push alerts to your
endpoints, Slack, Teams, ticketing and SIEM, and are created, tested and managed through the API.
Sync is incremental and timestamp-based.
SIEM and CTI integration. Native STIX 2.1, CEF and LEEF export for Splunk, Microsoft Sentinel, IBM
QRadar and ArcSight, plus a Splunk Enterprise Security add-on. Runs alongside Recorded Future,
Searchlight Cyber and ZeroFox as a complementary credential-intelligence feed. No rip-and-replace.