Watchlists
Combine threat category, threat actor, country, industry, organisation and domain. Criteria within a group are alternatives; groups must all match, so a watchlist can be as broad or as narrow as you need.
AdverseMonitorExternal threat intelligence
Know when a leak claim names your business.
AdverseMonitor collects publicly posted ransomware and data-leak claims, matches them against your watchlists and gives your team the source evidence in a dashboard and an API.
For teams that need to know what is being claimed about them
Security and risk teams at growing businesses that want to know when a claim mentions their company, domain, sector or country. It is designed so a team can work with it without a dedicated threat-intelligence analyst.
The problem
Ransomware groups and leak sites post new claims every day. If one names your organisation, you want your own monitoring to tell you before a customer or a journalist does. Doing that by hand means watching many sources, reading noisy posts and keeping the evidence together.
Capabilities
Fast matching
New records are checked against every active watchlist every 30 seconds after collection, and each match is kept in your match history.
AI risk assessment
Each record carries a structured assessment with a severity level, affected industries and recommended actions.
Search with evidence
Search the collection by actor, country, industry, organisation, tag, domain or URL and open the source record behind each result.
REST API
Pull records with cursor pagination, run searches, and read threat-actor and country statistics using Bearer-key authentication.
Threat reports
Weekly and monthly reports with an executive summary, trends and actor profiles are generated automatically and are available through the API.
How it works
- 01
Collect
Publicly posted claims from leak sites and breach listings are collected through an upstream feed.
- 02
Normalise
Records are cleaned up and given a stable public identifier.
- 03
Match
Each new record is compared with your watchlists, and matches are recorded.
- 04
Assess
Records receive an AI risk assessment, and statistics are refreshed.
- 05
Review
Your team reviews matches and evidence in the dashboard or pulls them by API.
Use cases
Brand and domain watch
Track claims that name your organisation or domains, with the source record ready for review.
Sector and region monitoring
Follow combinations such as ransomware claims in healthcare in a given country.
Feeding your SIEM
Pull new records incrementally through the API and attach the AI risk level to your own workflows.
Management briefings
Use the weekly and monthly reports as a starting point for leadership updates.
A first look
Run the free domain or company lookup on adversemonitor.com to see whether records mention you.
Questions
Does a match mean we have been breached?
No. A claim is an investigation lead. AdverseMonitor shows you what was posted and where, so you can check it against your own systems before drawing conclusions.
Where do the records come from?
From publicly posted claims, including ransomware leak sites and breach listings, collected through an upstream data feed. The free lookup does not contact threat-actor sites.
How precise are watchlist matches?
Matching is case-insensitive text matching, so short terms can match more than you intend. Specific organisation names and domains give cleaner results.
Can we use it through an API?
Yes. The REST API supports record retrieval with pagination, search, threat-actor and country statistics, and reports, using API keys with plan-based limits.
How do we get started?
Try the free lookup on adversemonitor.com, or send us an enquiry and we will talk through your watchlists.
Talk to us about AdverseMonitor
Tell us a little about your organisation and what you need. We’ll reply by email.