ConsultingInvestigation

Incident Investigation

Link suspicious account activity to external breach data during incident response.

Start with 500 free creditsDocumentation

Email breaches · 1 credit per lookup · no monthly fee

Suspicious login02:14
Email in breach dump02:15
Session revoked02:16
Breach data linked to incident

The problem

Mid-incident, you need to know: was this account compromised via credential reuse from an external breach, or is something worse happening inside your perimeter? The answer changes your entire response.

With Encrata

Check the affected accounts' breach history during triage. Suspicious logins on accounts whose credentials appear in recent dumps point to credential stuffing, contain with resets and move on. No breach history points somewhere darker, and you know to keep digging.

How it works

1

Send the address

Call the breach endpoint with an email address, one-off for a signup check, or on a schedule for monitoring.

2

We check known breaches

Encrata searches disclosed breach data and returns every breach the address appears in, when it happened, and what leaked.

3

Respond to exposure

Alert the user, raise a risk score, force a reset or require MFA, the full breach history is one credit away.

One call, structured answer

Incident Investigation runs on the email breaches lookup at 1 credit per lookup. Same API key, same JSON shape as every other Encrata lookup.

  • Full breach history, names, dates and exposed data classes per breach
  • 1 credit per check, so continuous monitoring stays affordable
  • New-breach detection turns a public leak into a same-day security response
  • Works for one address or your whole domain
Terminal
curl -X POST "https://encrata.com/api/agent/breaches" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email": "sam@corp.com"}'
response.json
{
  "email": "sam@corp.com",
  "breached": true,
  "breach_info": {
    "breach_count": 2,
    "services": [
      { "name": "LinkedIn", "breach_date": "2012-05-05",
        "data_types": ["Email addresses", "Passwords"] }
    ],
    "exposed_data": ["Email addresses", "Passwords"]
  },
  "credits": 1
}

Breach history in triage

Add the breach check to your triage runbook: for every account in an incident, pull breach history and note whether exposed credentials predate the suspicious activity. The timeline correlation, breach public on Monday, anomalous logins Wednesday, distinguishes credential stuffing from insider threats and targeted compromise in minutes.

Faster, surer classification

The classification speed matters because responses diverge: stuffing gets resets and rate limits; a compromise with no external breach trail gets forensics. Attach the breach evidence to the incident record, post-incident reviews and cyber-insurance claims both benefit from a documented 'how the credentials leaked' chain.

More email breaches use cases

View all

New breach: DataCo

Your email was exposed · just now

Secure account

Breach Alerts

Warn users the moment their email address shows up in a newly disclosed data breach

CybersecurityMonitoring

Identity risk

78/100
4 prior breaches · manual review

Risk Scoring

Raise risk scores for identities with prior breach exposure before approving transactions

FintechRisk
Breach affects 3 users
Password resets sent

Password Reset

Trigger targeted password resets when a breach relevant to your users becomes public

SaaSSecurity
Start with 500 free credits
$curl https://encrata.com/api/agent/lookup -H "Authorization: Bearer YOUR_API_KEY" -d '{"e": "satya@microsoft.com"}'