DARKMON One - 10 modules
Three solutions. Ten modules. One platform
Cyber Threat Intelligence, Digital Risk Protection and Threat Exposure Management: every module runs in DARKMON One on one shared asset inventory. License one, or all of them.
- Solutions
- Three
- Modules
- Ten
- Asset inventory
- One, shared by every module
- Portal
- One
Products by solution
Choose the product for your need
Start where the pain is. Every module is licensed on its own, with its own limits, on one shared asset inventory nothing is bundled by force.
- Cyber Threat Intelligence
Foresyn
Threat IntelligenceAnalyst-verified threat intelligence on actors, ransomware, vulnerabilities, indicators and DDoS activity.
IOCs, threat actors, malware, ransomware tracking across leak sites, victims and groups, vulnerability and DDoS intelligence, and the generic news and forum feeds into your SIEM and SOAR over STIX/TAXII.
What's in the feed
- Indicators of compromiseproxy and VPN IPs, Tor nodes, C2, phishing URLs, newly registered domains, brute-force sources, blocklists
- Threat actor profiles & ransomware tracking3,000+ threat actors, leak sites refreshed daily, MITRE ATT&CK mapped
- Vulnerability intelligenceCVEs, exploits, zero-days, real-world exploitability
- DDoS intelligence
- Pre-classified intel and threat-landscape news
How it works
- Clear web, deep web, dark web, paste sites, forums, Telegram channels
- Generic by designno assets to enroll, nothing matched to your company
- Licensed by API calls5,000 a day; the web interface is never counted
Integrations & API
- TAXII 2.1 serverSTIX 2.1 indicators, attack patterns, intrusion sets, threat actors and vulnerabilities
- Cortex XSOAR content packenrichment commands and 20 playbooks
- DARKMON feeds for OpenCTIready-made, nothing to install
- SIEM, SOAR, MISP and other threat intelligence platformsthrough the REST API or TAXII
- Cyber Threat Intelligence
Tracer
Threat Hunting PlatformOne search across your own assets' data and all of DARKMON's collected intelligence, drawn as one link graph.
Hunt across everything DARKMON collects and follow the links in the graph. Credentials show only on records related to your own assets.
What you can hunt
- One searchover all of DARKMON's collected intelligence
- The graphinvestigate and pivot between related records
- Casesinvestigations kept on the server
What you see
- Credentials on your own assets onlyverified domains and IP addresses on Nyxel, BINs on Tresura, Davos identities
- Every other credential hidden
- Works on its ownwithout Nyxel, Tresura or Davos every credential stays hidden
How it is licensed
- 10,000 searches a yearshared across all users
- Takedowns from hunt resultsleaked data opens an Eradix takedown case
- Cyber Threat Intelligence
Threat Advisory Suite
DARKMON TIRU ReportsThe analyst-written layer of DARKMON One: the advisory library, flash advisories and twelve tailored reports a year.
Analyst-written intelligence on the actors, campaigns and sectors that matter to you requested from the platform, within the reports you bought.
What you get
- DARKMON TIRU reports library
- Flash advisories
- TLP distribution
- Tailored threat advisory reportswritten for your company on request
How it is licensed
- 12 tailored reports a yearplus report packs and single reports
- Unused tailored reports carry forward onceinto the renewal term
- Requested from the platformthe count is reserved when you ask and released if the request is rejected
- Digital Risk Protection
Tellmark
Brand ProtectionLook-alike domains, phishing sites, rogue certificates and impostor accounts, found with evidence ready for takedown.
Detect typosquats, fake social accounts and rogue certificates the moment they appear, with the evidence packaged for takedown.
What Tellmark hunts
- Typosquatting & look-alike domainsseverity scoring, screenshot evidence
- Social media impersonation
- Certificate Transparency monitoringreal-time alerts
- Brand mentionsyour matched Telegram, forum, news and ransomware posts
- Website defacementon the domains you enroll
- Logo impersonationdetection from Q1 2027
What you enroll
- Domains
- Brand identifiersbrand names, social handles, scam keywords, slogans and executive names
- Logos
- Keywords
From finding to takedown
- Eligible findings open an Eradix takedown caseself-service or assisted
- Evidence: severity, screenshots, WHOIS / hosting context
- Alerting to email, Slack, SIEM - feeds phishing infrastructure to your gateway via the open API
- Works with Davos, Foresyn, Eradix
- Digital Risk Protection
Davos
Executive ProtectionWatches what others publish about your leaders: impersonation, exposed personal data and hostility.
Named-individual protection for your leadership impersonation, doxxing, threats and credential exposure, watched continuously and handled with board-grade confidentiality.
What Davos hunts
- Executive and board impersonationsocial, email, domains
- Doxxing and personal-data exposure
- Direct threats and targeting chatter
- Credentials and devices of named individualscross-matched across breaches, combo lists and stealer dumps
What you enroll
- Identitiesone per named executive, VIP or board member
- Email addressesconfirmed by the named person before review
- Restricted visibility - need-to-know reporting
- Executive-office briefing format
From finding to takedown
- Confirmed impersonation opens an Eradix takedown case
- Rides the same takedown workflow as Tellmark and Nyxel
- Works with Tellmark, Nyxel, Threat Advisory Suite tailored reports
- Digital Risk Protection
Eradix
Takedown RequestsTakedown requests in two modes: unlimited self-service, or assisted cases pursued by DARKMON analysts.
Phishing sites, impostor accounts, fraudulent listings and leaked data pursued to removal. Self-service requests are unlimited; assisted cases are handed to DARKMON analysts.
What Eradix removes
- Phishing and fake sites posing as your brand
- Look-alike domains
- Impostor accountsfake social profiles, pages and executive identities
- Cloned logos, copied content and fake or cloned apps
- Leaked data and pastesdocuments, credentials, code repositories and packages
- Card shops and fraudulent listings
- Rogue certificatesrevocation requests
Two modes
- Self-servicethe platform builds the evidence bundle, pre-fills the complaint and finds the abuse channel; you send it
- AssistedDARKMON analysts submit, follow up, escalate and re-route to a final outcome
- Removed, refused, unreachable or withdrawnevery outcome written back to the finding
Where cases come from
- Tellmark, Davos, Nyxel, Tresura and Tracer findings
- A target submitted directlyEradix works on its own
- Unlimited self-service requestsassisted cases counted per year
- Digital Risk Protection
Nyxel
Leak IntelligenceFinds your credentials, code, secrets and documents wherever they land, and traces each to the infected machine.
Find your leaked credentials, code and data the moment they hit a paste site, a repo or a dark-web market, mapped to the exact machine and account.
What Nyxel hunts
- Credential leaksstealer logs (50+ families), combo lists, public breaches, pastebin dumps, matched to your domains
- Compromised machineshost / OS / IP / geo context, per-machine timeline
- Code leaksproduct names, source fingerprints, package names, API base URLs, internal file paths, secrets
- Paste leaks and dark-web market monitoring - leaks matched to external IPs and domain controllers
- Dark Bookleaked phone-contact books, matched to your phone numbers
What you enroll
- Domainsemail and credential matching comes with every domain
- Domain controllers
- IP addresses
- Phone numbers
- Source-code identifiers
Dark Market Recovery
- Verified recovery of leaked logs and data with seller history and chain-of-custody export
- RequestVerify Recover Export
- Instant leak notification to email / Slack / SIEM - leaked data opens an Eradix takedown case
- Works with Tresura, Cresta, DarkOps
- Digital Risk Protection
Tresura
Compromised Card IntelligenceCompromised cards and BINs, including cards offered for sale on black markets, matched to your BINs.
Compromised cards and BINs spotted across the underground markets before they are monetized.
What Tresura hunts
- Compromised payment cards across 200+ marketsenriched with BIN, expiry, country and seller history
- Cards offered for sale on black marketsmatched to your BINs
What you enroll
- Card BINs
- Licensed on its ownno other module needed
Recovery & who it's for
- Dark Market Recovery for verified card data with chain-of-custody
- Card issuers, acquirers, fintech, e-commerce, telecom billing teams
- Intel into fraud and SOC systems via the open API
- Threat Exposure Management
Cresta
Attack Surface ManagementDiscovery and continuous monitoring from the domains and IP addresses you enroll; discovery beneath each is unlimited.
Continuous discovery, analysis, prioritization, remediation and monitoring of vulnerabilities and attack vectors, correlated against Foresyn.
Unlimited discovery
- Enroll only root assets: domains and IP addresses
- Every sub-asset mapped: subdomains, hosts, ports, services, web applications, technologies
- Inventory always complete - never metered per discovery
Continuous monitoring
- Prioritized by exposure - scope adjustable as the estate grows
- Vulnerability & misconfiguration detection
- Every finding enriched with exploit, zero-day and real-world exploitability intelligence
- Coverage: subdomains, IPs, certificates, cloud buckets, exposed APIs - leaked credentials cross-matched when you also hold Nyxel
Integrations & shared assets
- NGFW, IPS & NDR - SIEM, SOAR & EDR
- ITSM & patch management - cloud security platforms
- The same domains can also be enrolled on Nyxel and Tellmark - third parties are watched by Third Party Exposure
- Threat Exposure Management
Third Party Exposure
Vendor & Supplier ExposureExposure notifications on an unlimited list of third parties, and analyst-reviewed reports, one hundred a year.
List a vendor by name and domain. When either appears on a ransomware leak site or blog, in a Telegram channel, a forum or landscape news, you are notified.
Exposure notifications
- Ransomware leak sites and blogs
- Telegram channels and forums
- Landscape news
- No count, and no limit on the listset in Company Settings
Detailed reports
- Named vendors and supplierswritten by DARKMON TIRU analysts
- 100 reports a yearplus report packs and single reports
- Requested from the platformthe count is reserved and released if the request is rejected
Which product do I need?
Start with the threat. We’ll point to the product
One platform, one shared asset inventory, a license per module. Take one module today and add the rest when you are ready or take all ten in one shot.
Threat product
- Leaked credentialsNyxel
- A fake domain or cloned siteTellmark
- An exposed server or serviceCresta
- A breached vendor or supplierThird Party Exposure
- Executive impersonationDavos
- Compromised cards or BINsTresura
- Take it downEradix
- Know your adversaryForesyn
- An investigation to runTracer
- A tailored threat reportThreat Advisory Suite
DARKMON One
All ten in one shot the three solutions, every module.
- One platform, one sign-in, one shared asset inventory
- Unlimited users and integrations no per-seat pricing
- The à-la-carte path is always open: start with one, add the rest
Get in touch
Let's secure your future
Speak with our security experts to map your real exposure across the Dark, Deep & Surface web in a 30-minute session.