Rapid7 Threat Command

What is Rapid7 Threat Command?

Rapid7 Threat Command is a Digital Risk Protection (DRP) platform that monitors external threats to organizations - from dark web, through data leaks, to fake sites and profiles.

Key differentiators:

• Dark web intelligence - dark web monitoring
• External attack surface - visibility from attacker’s perspective
• Automated takedowns - threat removal
• Actionable alerts - alerts with context and recommendations

Monitoring Scope

graph TB
    subgraph "External Threat Landscape"
        A[Dark Web] --> E[Threat Command]
        B[Deep Web] --> E
        C[Social Media] --> E
        D[Paste Sites] --> E
        F[Forums] --> E
        G[Marketplaces] --> E
    end

    subgraph "Detection Categories"
        E --> H[Leaked Credentials]
        E --> I[Brand Abuse]
        E --> J[Data Leaks]
        E --> K[Threat Actors]
        E --> L[Attack Planning]
    end

Digital Risk Protection

Credential Monitoring

Credential leak detection:

• Email addresses - leaked email address detection
• Passwords - passwords in breach databases
• API keys - leaked API keys
• Certificates - certificates and private keys

Sources:

• Breach databases
• Paste sites (Pastebin, etc.)
• Dark web marketplaces
• Hacker forums

Brand Protection

Brand and reputation protection:

• Phishing domains - phishing domains
• Fake social profiles - fake social media profiles
• Impersonation - company impersonation
• Counterfeit products - counterfeit products
• Mobile apps - fake mobile apps

Data Leak Detection

Data leak detection:

• Documents - company documents
• Source code - source code
• Customer data - customer data
• Financial data - financial data
• PII - personal data

Threat Intelligence

Threat Actor Tracking

Criminal group tracking:

• APT groups - state-sponsored groups
• Ransomware gangs - ransomware groups
• Hacktivists - hacktivists
• Cybercriminals - cybercriminals

Attack Planning Detection

Planned attack detection:

• Mentions - organization mentions
• Target lists - target lists
• Vulnerability discussions - vulnerability discussions
• Exploit trading - exploit trading

Threat Feeds

• IOC feeds - Indicators of Compromise
• STIX/TAXII - standard formats
• API access - programmatic access
• SIEM integration - SIEM integration

External Attack Surface

View from attacker’s perspective:

Discovery

• Subdomains - subdomain discovery
• IP ranges - IP ranges
• Cloud assets - cloud resources
• Certificates - SSL certificates
• Technologies - technologies used

Risk Assessment

• Exposed services - open services
• Misconfigurations - misconfigurations
• Vulnerable software - vulnerable software
• Expired certificates - expired certificates

Takedown Services

Threat removal:

[Threat Detected] --> [Validation] --> [Takedown Request] --> [Removed]
                                              |
                                    [Escalation if needed]

Takedown types:

• Phishing sites
• Fake social profiles
• Counterfeit marketplaces
• Malicious domains
• Fake mobile apps

SLA:

• Phishing sites: 24-48h
• Social profiles: 48-72h
• Marketplaces: varies

Alerting & Reporting

Alert Categories

• Critical - immediate action required
• High - urgent
• Medium - requires attention
• Low - informational

Context & Recommendations

Each alert contains:

• Threat details
• Business context
• Recommended actions
• Evidence (screenshots, raw data)

Reporting

• Executive dashboards
• Trend analysis
• Threat landscape reports
• Custom reports

Integrations

SIEM/SOAR

• Splunk
• IBM QRadar
• Cortex XSOAR
• ServiceNow SecOps

Ticketing

• Jira
• ServiceNow
• PagerDuty

Communication

• Slack
• Microsoft Teams
• Email

Who is it for?

Rapid7 Threat Command is for organizations that:

• Want to monitor dark web for threats
• Need brand protection against phishing
• Require visibility of external attack surface
• Seek a proactive security approach

Deployment with nFlo

1. Asset Definition - monitored asset definition
2. Keyword Setup - keyword configuration
3. Integration - SIEM/ticketing integration
4. Alert Tuning - alert tuning
5. Takedown Process - threat removal process
6. Training - team training
7. Ongoing Monitoring - continuous monitoring