Detections

Purpose

Detections is the complete, searchable record of everything the platform has ever found — across every source and category — regardless of triage status. Where Intelligence is "the queue to work," Detections is "the permanent ledger." Nothing is deleted; dismissed items move to the Bin rather than disappearing, preserving a full audit trail.

Detection categories

Category	Examples	Typical source
Website & Domains	Phishing pages, typosquat domains, cloned login pages	Web crawlers, domain registration feeds
Social Media	Impersonation profiles, fake customer-support accounts	Platform APIs (Twitter/X, Facebook, Instagram, LinkedIn, TikTok, etc.)
Mobile Apps	Unauthorized/rogue apps using your brand in app stores	App store scanners (official + third-party stores)
Dark Web	Mentions of your brand, leaked data, credentials for sale	Dark web / paste-site feeds
Scams	Fraudulent promotions, fake giveaways, investment scams	Web + social crawlers
Counterfeit	Fake product listings on marketplaces	Marketplace scanners
Advertisement	Malicious/impersonating paid ads	Ad-network monitors
Data Exposure	Leaked credentials, exposed configs/keys tied to your brand	Dark web feeds, code/config leak scanners
Assets	Your own monitored digital assets (domains, social handles, app IDs) — the baseline for comparison	Configured by you
Bin	Dismissed/archived detections kept for audit history	Result of Intelligence triage

What each detection record contains

Primary identifier — the domain, handle, app ID, or listing URL.
Classification & severity/priority badges.
Status — New, In Review, Dismissed, Promoted, Resolved.
Evidence — screenshots, metadata (hosting provider, IP address, geographic location, platform, seller info where relevant).
Created / reported / status-reason columns for a complete audit trail.
Import support — detections can also be manually imported (e.g. a threat reported directly by a customer, employee, or partner outside of automated collection).

Lifecycle

stateDiagram-v2
    [*] --> New
    New --> Dismissed: Analyst/AI marks as noise
    New --> Promoted: Confirmed as real threat
    Promoted --> Incident
    Incident --> InMitigation
    InMitigation --> Resolved
    Dismissed --> Bin
    Resolved --> [*]

Detection volume trend (example)

xychart-beta
    title "New Detections per Week by Severity (Example)"
    x-axis [W1, W2, W3, W4, W5, W6]
    y-axis "Count" 0 --> 60
    bar [12, 18, 9, 22, 15, 11]
    line [40, 45, 38, 52, 47, 41]

(Bars = Critical/High severity detections; line = total detections across all severities.)

Typical use

Use category-specific views (Website & Domains, Social Media, Mobile Apps, etc.) to focus on one channel at a time — useful when a specific team owns a specific channel (e.g., social media team owns Social Media detections).
Use filters and columns (classification, severity, status, date) to build saved views for recurring reviews, such as a weekly "new critical detections" report.
Check the Bin periodically to audit what's been dismissed and confirm the reasons still hold up — useful during compliance reviews or when onboarding a new analyst.
Use manual import for threats reported through support tickets or discovered by employees so they get the same lifecycle tracking as automated detections.