Exploit Shield

Appearance

Investigation playbook ​

Use this when a report, exposure, or alert arrives.

See Objects and terms for report and ownership.
See Vendors for supply-chain vendor risk.

Every case ​

  1. Open Reports. Find the report. Read ownership, severity, and confidence.
  2. Open the report detail.
  3. Open Exposures. Match repository, file, and secret type.
  4. Choose one status:
    • False positive — the finding is not a valid exposure for your organization.
    • Remediated — you finished the work you own.
    • Leave open — still working.

Set False positive or Remediated to close the row.

First-party ​

Ownership is first-party. This is attributed to your organization.

  1. Confirm the repository and file on Exposures.
  2. Open the repository link if it is present.
  3. If the secret is real, rotate or revoke it in your systems.
  4. When you consider the leak handled, set Remediated on the exposure and the report.
  5. If the finding is not a valid exposure for your organization, set False positive.

Joint ​

Ownership is joint. First-party and third-party both apply.

Follow First-party for what your organization controls.
Follow Third-party for the third-party leak.
Exploit Shield does not send vendor notifications.

Third-party ​

Ownership is third-party. The leak originated with a third party but may affect your organization.

Ground zero is the third party.
A vendor leaked credentials that can reach your environment.

  1. Open the report. Read ownership, severity, and confidence.
  2. Open matching exposures for the secret and repository.
  3. If the secret is real, rotate or revoke it in your systems.
  4. Set Remediated when you finished that work.
  5. Set False positive when the finding is not a valid exposure for your organization.

Exploit Shield does not send vendor notifications.

When an alert arrives ​

Alerts fire on attribution reports that meet your rule.
Default new rule: High severity and 80% confidence.

The webhook includes rule name, severity, confidence, title, repository link, and report id.
It omits the secret value.

  1. Open Reports. Find report_id.
  2. Follow the ownership playbook above.
  3. If you expected an alert and it is missing, see Troubleshooting.

When is it remediated? ​

Set Remediated when you finished the work you own.
Rotate or revoke the secret in your systems, or accept the residual risk in your process.

Exploit Shield does not send vendor notifications.

The mark hides the row by default so you can focus on open work.