Know what is exposed.
Discover domains, subdomains, IPs and the services behind them.
See the exposure.
Understand
the threat.
Cyber threat intelligence. External attack surface. Digital risk. One operational perspective for the security teams connecting the dots.
AI-powered intelligence. Built around your external exposure.
Your organization, in context
example.comOrganizationService changeTCP / 443
Certificate findingTLS / HTTPS
External assetportal.example.com
Technical evidence
Investigation context
An exposed service. The full picture.
Connect an internet-facing asset to its DNS, certificate and service evidence. Understand what changed before deciding what to investigate.
Interactive illustration · Sample data
Connect the signals.
Bring account, content, brand and threat findings into organizational context.
Move the investigation forward.
Review evidence, triage alerts and hand findings to your security workflows.
A wider view.
A clearer next step.
External risk crosses boundaries. Your investigation should be able to follow it.
Tetharion brings CTI, external attack surface management and digital risk monitoring into a shared workspace. Move from the overview to the affected asset, account or record without losing the context.
External attack surface
Domains · DNS · IPs · TLS · Services · Findings
Cyber threat intelligence
Global IOCs · Threat sources · Dark web findings
Digital risk monitoring
Account leaks · Content matches · Lookalike domains
An investigation workspace.
Across your external footprint.
Explore the capabilities that connect discovery, context and operational review.
Capabilities are described from the supplied product documentation. Data availability depends on the record and configured monitoring scope.
Unified CTI Dashboard
Read the overall picture, then follow the finding.
A unified view of alarms, assets, leaked accounts, vulnerability exposure, brand signals and dark web findings connects the overview to individual investigations.
- Shared operational overview
- Module-level investigations
- Visibility for analysts and leaders
External Asset Inventory
Know your internet-facing footprint.
Review domains, subdomains, IP addresses and DNS records alongside certificate, WAF/CDN and infrastructure context. Track supported discovery and change events.
- Domain and subdomain discovery
- DNS additions, changes and deletions
- IP, certificate and infrastructure context
Asset Details & Scan Results
Investigate the services behind the asset.
Follow host and service evidence: port, protocol, product/version, banner, scan time and L4/L7 findings. Examine new, closed or changed services in technical context.
- Host and service evidence
- L4/L7 findings
- Service change tracking
Vulnerability Management
Prioritize exposure with the evidence in view.
Review finding severity, the affected host or service and available technical details. CVE/CPE references are provided when available in the record.
- Severity-focused findings
- Affected asset and service context
- Available CVE/CPE references
Leaked Account Monitoring
Put account exposure into organizational context.
Review employee, customer and third-party records by category, associated URL and date. Support identity investigations with sensitive-data access controls.
- Employee, customer and third-party records
- Associated URL and date
- A leak alone is not proof of compromise
Deception Monitor
Investigate domains that resemble your brand.
Assess algorithmic similarity and typosquatting signals together with reachability, available registration data and corporate asset relationships. Similarity is an investigation signal.
- Similarity type and score
- Reachability and WHOIS context
- Associated corporate assets
Global Threat Intelligence
Explore indicators with the right filters.
Review domains, IP:port records, URLs and file hashes. Filter the global repository by threat type, malware family, confidence, tags and timestamps.
- Domain, IP:port, URL and hash records
- Threat family and confidence filters
- Repository records are not incident detections
Content & Keyword Monitoring
Find content connected to your organization.
Filter organization-related records by keyword, URL, discovery date and available metadata to investigate brand and data exposure signals.
- Organization-related keywords
- Discovery dates and source URLs
- Available record metadata
Dark Web Findings
Bring closed-source findings into the investigation.
Review mentions, files and archive references, with details and raw content where accessible. Content acquisition can involve request, approval, queue and processing stages.
- Mentions, files and archive references
- Available raw content
- Content acquisition status
Alarm Triage & Workflow
Follow discoveries and changes through triage.
Review new discoveries and changes by alert type, severity and time. Configure notifications and carry evidence into existing investigation and response processes.
- Alert type, severity and timing
- Notification rules
- Operational review and handoff
Scanners, Users & Integrations
Configure the workspace around your responsibilities.
Define domains, hostnames, IPs and keywords. Manage scanner operations, module permissions, sensitive account access, VIP monitoring scope and delivery configuration.
- Monitoring scope definitions
- Module and sensitive-data permissions
- Syslog, API and email delivery
Signals become useful
when they have context.
Follow an external finding from discovery to an informed handoff.
Collect
Bring together asset, account, brand, vulnerability and threat findings.
Contextualize
Review signals alongside organizational assets and technical evidence.
Triage
Assess alert type, severity, timing and investigation priority.
Act & report
Notify, track and hand evidence to response teams and security leaders.
Built for the teams
behind the investigation.
A common source of context. A different perspective for each team.
Keep the investigation moving.
Bring alarm triage, IOC research, account exposure and dark web findings into a common investigation workflow.
- Review alerts by type, severity and time
- Follow related records and technical evidence
- Deliver findings through notifications and syslog
Fits into your
security operations.
Carry the findings into existing processes, with delivery options and access controls that support enterprise workflows.
Syslog delivery
UDP, TCP and TLS transport. Formats include RFC 5424, RFC 3164, CEF, LEEF and JSON.
Scoped API access
Account and content data, with client scopes, IP allowlists and request limits.
Configurable notifications
Email rules by user, severity, alert type and subject. Active delivery services and recipients must be configured.
Access by responsibility
Module permissions and separate controls for sensitive account data, alongside tenant-based workspaces.
Take a closer look.
Product details you can share with your security team.
A few things
worth knowing.
What does Tetharion monitor?
Internet-facing assets, DNS and certificates, services and vulnerability findings, account leak records, organization-related content, lookalike domains, dark web findings and global threat indicators. The configured scope determines what is monitored.
Does an account leak prove a compromise?
No. A leak record is evidence for an identity investigation. It does not, by itself, prove that the account is currently compromised. Similarly, an IOC in the global repository does not mean an incident has been detected in your environment.
Can we use Tetharion with our existing workflows?
Tetharion includes alert workflows, configurable email notifications, syslog delivery, scoped account/content API access and user permissions. Available delivery depends on active services and your configuration.
What should we bring to an evaluation?
Start with your organizational domains and the scenarios you want to investigate: external asset exposure, account leaks, brand impersonation or organization-related content. The demo can focus on that monitoring scope.
How do we access our workspace?
Use Workspace login and enter your assigned tenant ID. You will be redirected to your dedicated workspace at app.tetharion.com.
Start with your exposure.
See what connects.
Tell us what your team needs to investigate. Plan a walkthrough around your domains and priority scenarios.
See beyond the surface.