Role Availability | ✔️ Read-Only ✔️ Investigator ✔️ Analyst ✔️ Manager The BlueApp for SpyCloud Dark Web Monitoring monitors reports that breach records of compromised emails from that domain or assetsassociated with it. You can use this information to identify employees and consumers that have malware infections and protect yourself from potential fraud. Malware often captures user credential information, such as usernames and passwords, along with other information and stores the stolen information on command and control (C2) servers. In cases where SpyCloud has recovered C2 data, it will analyze the records and classify them as either infected employee records or infected customer records. For example, if one of the monitored domains is “example.com,” then emails addressed from “[name]@example.com” that indicate a breach would be classified as an “employee” record. If the malware came from an unmonitored external domain, it is then classified as a “customer” record. See the guide on infected users for more information. The following table lists the fields available for SpyCloud events. Examples of SpyCloud Events
FieldDescription
Source DNS DomainDomain name associated with the breach record.
Event Ref DateThe date on which the record entered the SpyCloud systems, in ISO 8601 date-time format.
Source UsernameUsername associated with the breach record.
Source User EmailThe email address associated with the breach record.
Public BreachA true/false flag that indicates if the breach has been disclosed to the public.
Infected UserA true/false flag that indicates if the credentials were obtained by a keylogger.
Source IDSpyCloud-generated numerical identifier for the breach in which the credentials were found.
Password TypeThe password type identified in the breach record.
IP AddressesList of one or more IP addresses in alphanumeric format (both IPV4 and IPv6 addresses are supported).
Sighting(SpyCloud subscriptions only) An integer that indicates the occurrence of a breached credential across the entire SpyCloud breach catalog

A value of “3” would indicate that this breach record is the third occurrence of the credential in the catalog.
The BlueApp for SpyCloud Dark Web Monitoring leverages the SpyCloud APIs to retrieve breach records. See the SpyCloud API documentation for more information about the attributes (data fields) it stores in these breach records.
USM Anywhere generates an alarm from one or more of these events using built-in correlation rules, which analyze the events for patterns that indicate a new breach that requires attention and investigation. It generates the alarm as a Security Critical Event with the following assessed breach method:
  • Credentials Stolen — Public Breach
  • Credentials Stolen — Private Breach
  • Credentials Stolen — Infected User
Additional parameters of a generated alarm are determined by the information in the associated events. For example, an alarm will provide different guidance if an event indicates that the compromised credential is from an infected user, because a simple password reset would be an ineffective response in that situation.