Configuring requirements

Use this page alongside Configuration when you are deciding what to monitor. For each of ThreatHarvest’s eleven requirements you will find the same tagline shown in the product, which attribute types to add, and Do-not notes for common mistakes.

This is configuration help, not a full education on every requirement. For deeper context on what each requirement covers and why it matters, visit Coverage.

For how to add attributes and follow guidance in the app, see Configuration: requirements and attributes.

Account Compromise

Find credential exposure. Attribute type: Exact Domain (corporate email domains you own — for example example.com).

Do not attempt to add domains you do not own, such as those from shared or free email services.

Emerging Vulnerabilities

Monitor disclosed vulnerabilities. Attribute type: Keyphrase (specific software, platforms, and technologies you use — for example a product name, not a broad industry word).

Do not enter broad company names or generic technologies that do not map to products you use.

Brand Impersonation

Uncover brand identity misuse. Attribute type: Handle Keyword (usernames, handles, and public-facing brand identifiers).

Do not enter general industry terms that are too broad to uniquely identify your organization.

Breach Indicators

Detect evidence of an attack. Attribute type: External IP Address (static public IPs — illustrative placeholder 192.0.2.10).

Do not enter internal or private IP addresses or temporary home/guest dynamic IPs.

Supply Chain Incidents

Identify third-party security risk. Attribute type: Keyphrase (vendors, platforms, and services you rely on).

Do not list generic vendor names or tools your organization does not actually use.

Supply Chain Mentions

Uncover underground activity. Attribute type: Exact Domain (primary domains of key third-party vendors — for example vendor.example).

Follow Configuration Guidance: Do not enter your own organization’s domains here — enter supplier and service-provider domains instead.

Domain Spoofing

Locate fraudulent sites. Attribute type: Exact Domain (domains you own or use).

Do not enter domains you do not control.

Certificate Issuance

Ensure certificate authenticity. Attribute types: Base Domain and Exact Domain.

External Attack Surface

Discover points of access. Attribute types: External IP Range (CIDR — for example 192.0.2.0/30) and External IP Address.

Do not enter internal/private IPs or IPs on temporary home, guest, or dynamically assigned networks.

Underground Mentions

Monitor threat actor posts. Attribute type: Exact Domain (primary domains your organization owns).

Do not enter domains belonging to third-party vendors or supply chain partners here (those belong under Supply Chain Mentions).

Illicit Messaging Activity

Track threat actor communication. Attribute types: Exact Domain and External IP Address.

Do not enter personal, residential, dynamically assigned, or internal/private IPs.