BreachWatch (Dark Web)

Overview

BreachWatch provides organizations oversight of the vulnerabilities of user's passwords through active monitoring of dark web breach data. Users and administrators are notified if any of their passwords in a record have been used in publicly known breach that could leave your organization vulnerable to a credential stuffing attack or an account takeover.

Watch the video below to learn more about dark web monitoring with BreachWatch

End-User Experience

BreachWatch will prompt the user on their client device to Resolve the breached password by either changing the password or ignoring it. If a password alert is ignored, then that record will be skipped on future scans until the password is reset. The user may also do nothing (deferring a response) and leave the risky password unchanged and thus still "at risk".

Admin Console Experience

BreachWatch provides Admins a dashboard overview and a summary table in the Admin Console detailing how users have dealt with their BreachWatch notifications.

If users have "At Risk" or "Ignored" passwords, the Keeper Administrator can reach out to the user in order to take action. If a record does not contain a password, it will not be shown in the count. The report includes both "owned" and "shared" records.

Reporting & Alerts

If the Advanced Reporting & Alerts module is activated on the Enterprise license, then BreachWatch specific events can be sent from the devices/clients and used to report activity with a variety of filters, and/or generate an alert.

Activate BreachWatch Event Reporting

By default, Keeper does not send BreachWatch event data from the user's device to connected SIEM and Advanced Reporting & Alerts reporting tools. The Keeper Admin must explicitly enable this feature. After it's enabled, the event data will begin to flow through to the Advanced Reporting engine and connected SIEM systems such as Splunk.

Note that this is not retroactive. Events will only flow through Advanced Reporting & Alerts after this feature is activated.

BreachWatch Reports

After BreachWatch events are flowing into the reporting module, visit the "Reporting & Alerts" screen to generate a report.

Click on Add Custom Report then select the BreachWatch events.

Alerts can also be created with custom event tracking.

Webhooks can receive alerts, so that you can perform any custom logic such as Slack channel alerts, Microsoft Teams, etc.

To enable webhook alerts:

1. Click on the event name.

2. Click the Recipients tab.

3. Add or click on an existing Recipient.

4. Click the Add Webhook button.

5. Configure the URL, HTTP Body, and an optional token.

6. Click Save.

Events can also be streamed to 3rd party SIEM solutions.

Deployment & Reporting Enablement

• The BreachWatch capability can be deployed selectively to your organization via Role Enforcements. The Pause BreachWatch on client devices toggle controls whether devices send events for reporting purposes, and whether to pause the service so it will not appear on the user's devices at all. Note that enabling events to the reporting module will send record event metadata (User Email, Record UID, IP Address and Device Type) from Keeper’s backend to any connected SIEM product.

• If you do not want to deploy BreachWatch to your entire organization at once, you can control the deployment using the Pause BreachWatch on client devices toggle. Users in this node will not have BreachWatch enabled on their client devices.

Security

BreachWatch is a Zero Knowledge architecture that uses a number of layered techniques to protect our customer’s information. For detailed technical information regarding the security and encryption model of BreachWatch, please visit the BreachWatch section on the Keeper Encryption Model documentation by clicking This Link.

CLI Commands

BreachWatch can be managed and used through the Keeper Commander CLI. See the below related commands:

• breachwatch