Digital Risk Protection

Overview

Digital Risk Protection (DRP) extends ThreatOps beyond the perimeter. While the core SOC platform monitors internal telemetry from SIEMs, DRP continuously scans the external threat surface: lookalike domains registering against brand names, dark web forums selling customer data, credential combo lists containing employee emails, and social media accounts impersonating executives.

For SOCaaS customers, especially those in regulated industries, external risk is just as consequential as internal. A phishing kit mimicking your customer portal can exfiltrate credentials before a single SIEM alert fires. Credential leaks in third-party breaches expose employee accounts that are later used in targeted intrusions. This module provides a unified dashboard covering all four external risk categories, a composite risk score, and workflow actions (status updates, takedown requests, password resets) that analysts can execute directly from the UI.

What Was Proposed

• Brand monitoring covering domain impersonation (lookalike domains, typosquats), phishing kit detection, logo abuse, and social media impersonation
• Dark web intelligence monitoring across paste sites, forums, dark web marketplaces, Telegram channels, and onion sites for mentions of brand keywords
• Credential leak detection identifying company email domains appearing in breach databases, combo lists, stealer log exports, and paste sites
• Executive threat monitoring for impersonation, doxxing, spear-phishing, and voice/deepfake social engineering campaigns targeting named executives
• A composite digital risk score (0-100) with component breakdown across all four categories
• Analyst workflow actions: status transitions, takedown request initiation, password reset triggering for affected accounts
• Cross-category search to quickly find all mentions of a keyword across brand alerts, dark web, credentials, and executive threats
• Dashboard statistics surfacing counts, critical-severity items, and active remediations at a glance

What's Built

Architecture

Service Layer

File: platform/api/app/services/digital_risk.py

The DigitalRiskService class owns all business logic. It is instantiated as a module-level singleton and injected into the router via direct import. Four in-memory dictionaries keyed by entity ID back each protection category:

_brand_alerts:      Dict[str, BrandAlert]
_dark_web_mentions: Dict[str, DarkWebMention]
_credential_leaks:  Dict[str, CredentialLeak]
_executive_threats: Dict[str, ExecutiveThreat]

All four are populated by _init_mock_data() called from __init__. The service logs initialization counts at INFO level. Each public method on the service is a synchronous Python function (no async needed since there are no I/O operations against external systems in the current build).

API Router

File: platform/api/app/routers/digital_risk.py
Router prefix: /api/v1/digital-risk — FastAPI tag: digital-risk-protection

The router imports digital_risk_service from the service module and delegates all logic to it. Route handlers are thin: they call the service, check for None returns (indicating not-found), and wrap responses in dicts with a top-level key naming the collection (e.g. {"brand_alerts": [...], "total": N}).

Pydantic request models defined in the router file handle mutation payloads:

Frontend

File: platform/frontend/src/app/digital-risk/page.tsx

A single large "use client" page component using useState and useEffect. On mount it fires four parallel API calls (stats, brand alerts, dark web, credentials, executive threats) and falls back to inline mock data if any call fails. The page renders a tabbed navigation across the four protection categories plus an overview tab with the risk score meter and stats grid.

Four Protection Pillars

API Endpoints

Brand Alerts

Dark Web Mentions

Credential Leaks

Executive Threats

Statistics, Risk Score, and Search

Example: Get Risk Score

GET /api/v1/digital-risk/risk-score

# Response (200):
{
  "score": 78,
  "level": "critical",
  "components": {
    "brand_risk": 25,
    "dark_web_risk": 28,
    "credential_risk": 15,
    "executive_risk": 10
  }
}

Example: Initiate Takedown

POST /api/v1/digital-risk/brand-alerts/ba-001/takedown

# Response (200):
{
  "alert_id": "ba-001",
  "takedown_status": "requested",
  "message": "Takedown request submitted for threatops-secure.com",
  "estimated_completion": "24-72 hours"
}

Example: Cross-Category Search

POST /api/v1/digital-risk/search
Content-Type: application/json
{"query": "threatops"}

# Response (200):
{
  "query": "threatops",
  "total_results": 12,
  "results": {
    "brand_alerts": [ {...}, {...} ],
    "dark_web_mentions": [ {...}, {...} ],
    "credential_leaks": [ {...} ],
    "executive_threats": [ {...} ]
  }
}

Frontend Routes

Data Models

All four entity types are Python dataclasses defined in platform/api/app/services/digital_risk.py. Each implements a to_dict() method using dataclasses.asdict() for JSON serialization.

BrandAlert

DarkWebMention

CredentialLeak

ExecutiveThreat

Risk Score Engine

The get_risk_score() method in DigitalRiskService computes a composite digital risk score from 0 to 100 using a weighted multi-component model:

Component Weight Visualization

Max contribution of each component to the 100-point total:

Prerequisites

• FastAPI — APIRouter, HTTPException, Query. Already present in platform requirements.
• Pydantic v2 — BaseModel, Field for request schema validation in the router.
• Python stdlib — dataclasses (dataclass, field, asdict), datetime, logging, typing, uuid. No third-party packages beyond FastAPI/Pydantic.
• No database — In-memory dataclass collections. No ORM models, no migrations, no database connection required.
• No external OSINT APIs — Current build uses seeded mock data. Future live integrations would add CertStream (WebSocket), PhishTank (API key), URLScan (API key), and BreachDirectory as optional dependencies.
• Frontend — Requires @/lib/api-client, Next.js App Router, Lucide React icons (Shield, Globe, Eye, KeyRound, UserX, AlertTriangle, Search, ExternalLink, ArrowDownCircle, RefreshCw, Filter, TrendingUp, Loader2, CheckCircle2, XCircle, Clock, MessageSquare, ShoppingCart, FileText, Send, Ban, Fingerprint, Link2, Users).

To register the router with the FastAPI application, ensure the following is present in platform/api/app/main.py:

from app.routers import digital_risk
app.include_router(digital_risk.router)

UI Layout