Monitor an organization's assets

A search answers a question once. A monitor keeps asking it. You give it one data source and one asset, such as acme.com or a brand term. It searches that source on a schedule, records anything new as a match, and sends the match to your email recipients or a webhook. In the dashboard these are Monitoring → Monitored Assets. Matches are under Monitoring → Incidents, and delivery settings under Monitoring → Delivery settings. The API calls a monitor an alert rule, and its endpoints sit under the Alert System tag in the API reference. A match is an incident in the dashboard. Your plan counts monitors as Monitored Assets: one monitor is one monitored asset, and so is each domain you scan for look-alikes.

​

How a monitor works

1. A monitor binds one data source to one asset. The source is the service: leaked credentials, Telegram, Discord, phishing references, SSL certificates, new domain registrations, data broker listings, paste sites, ransomware publications, open cloud storage, URL shorteners, app stores or card data. The asset is the monitor’s args, for example {"domain": "acme.com"}.
2. It runs once when you create it, then on its schedule. The schedule runs from daily to monthly. Every hour the platform starts the monitors that are due.
3. Each run looks only at what is new. A run covers the time since the previous run. The first run starts at the moment you create the monitor, so a monitor reports new data and never backfills history. Use a search for history.
4. A run that finds something records a match. Results that hit the monitor’s exclusion list are kept but marked excluded.
5. A match with at least one result that is not excluded is delivered. It goes to the monitor’s email recipients, its webhook, or both. The match is stored and readable through the API whether delivery succeeds or not.

​

Availability and cost

Availability: every plan with a license in force, up to the plan’s Monitored Assets. Ten data sources need a plan feature of their own, listed in Data sources. Webhooks need the Webhooks feature. Your own mail server and email templates need Custom Email Server. Cost: no metered allowance. Each monitor holds one Monitored Assets slot from the moment you create it until you delete it. Deleting a monitor frees its slot at once. Domain monitoring scans draw on the same slots: each scanned domain holds one. Calls made with your API key count toward the API Calls allowance and the per-second rate limit described in Rate limits. Monitoring endpoints refuse a call in three ways: Monitoring has no metered allowance, so it never returns the allowance 429 with resource and period. A 429 from these endpoints is the rate limit or the API Calls allowance. Plans and quotas explains how plan features and capacity work, and Errors lists every error body. An API key acts only as its own organization. To monitor a client’s assets, register them in your own organization and create monitors for them with your key; they use your Monitored Assets slots. A client workspace that the client signs in to has its own keys. See Client organizations.

​

Set it up

​

Endpoints

Every monitoring endpoint is listed under the Alert System tag. These are the ones each step starts from.