The Deep & Dark Web workspace supports several use cases and incident types. The Ticket Type field reflects these differences and allows customers to manage user permissions according to the ticket types users can view and act on. Ticket types also make it possible to tailor the experience, for example, by defining display rules and available actions, and bring this workspace in line with the standard used by other workspaces.
How ticket types and risk levels are determined
Ticket Type and risk level describe different aspects of a ticket:
Ticket Type groups a ticket by the kind of activity described and, for several types, by where it was found (a messaging app or a website/source URL).
Content Type identifies the threat or activity found in the message content. A machine-learning model assigns the Content Type.
Risk level is mapped to the Content Type identified for the message. The table below shows the current mapping. The specific reasoning behind an individual model classification is not available for users to infer from the classification method.
Content Type (Threat) | Risk level |
Credentials exposure | High |
Credit card exposure | High |
Mention to fraud tool | Medium |
Mention to sale | Medium |
Data consultation via BIN | Low |
Data consultation via CPF | Low |
Suspicious message | Low |
Automatic bot message | Low |
Undefined | Low |
A ticket’s risk level is based on its identified Content Type; it is not the same field as its Ticket Type. For example, the Ticket Type distinguishes data exposure in a messaging app from data exposure on a website, while the risk mapping is based on the detected content.
Ticket types
Data exposure in messaging app
Tickets whose content contains exposed credit card information or exposed credentials and whose reference is from WhatsApp, Telegram, or Discord.
Data exposure in website
Tickets whose content contains exposed credit card information or exposed credentials and whose reference URL is from a website source such as the darknet, forums, or markets.
Data sale in messaging app
Tickets whose content contains data sale but does not also contain exposed credit card information or exposed credentials, and whose reference is from WhatsApp, Telegram, or Discord.
Data sale in website
Tickets whose content contains data sale but does not also contain exposed credit card information or exposed credentials, and whose reference URL is from a website source such as the darknet, forums, or markets.
Fraud tool or scheme in messaging app
Tickets whose content contains fraud tools but does not also contain data sale, exposed credit card information, or exposed credentials, and whose reference is from WhatsApp, Telegram, or Discord.
Fraud tool or scheme in website
Tickets whose content contains fraud tools but does not also contain data sale, exposed credit card information, or exposed credentials, and whose reference URL is from a website source such as the darknet, forums, or markets.
Suspicious activity in messaging app
Tickets whose content contains suspicious messages, automatic bot messages, personal data consultations via BIN or CPF, or no content, and does not also contain fraud tools, data sales, exposed credit card information, or exposed credentials. The reference must be from WhatsApp, Telegram, or Discord.
Suspicious activity in website
Tickets whose content contains suspicious messages, automatic bot messages, personal data consultations via BIN or CPF, or no content, and does not also contain fraud tools, data sales, exposed credit card information, or exposed credentials. The reference URL must be from a website source such as the darknet, forums, or markets.
Infrastructure exposure
Previously classified as Vulnerability.
Ransomware Attack Alert
Tickets generated when ransomware groups announce new victims. The ticket references the group, the victim, and the attack date.
Deep & Dark Web Activity (legacy)
This type is no longer in use, but legacy tickets may still have it. It was the only ticket type in this workspace for a significant period and was used to document suspicious activity found in the deep and dark web.