Configure ransomware domain alerts.
Ransomware domain alerts tell you the moment a leak-site victim claim names a domain you care about, whether that is one of your suppliers, something you run, an organization you track, or your own account's domain. They work differently from ordinary alert rules: instead of matching on search criteria such as sectors or threat actors, they match victim domains against the domains already in your account. For what the underlying feed collects, and why a claim is not a confirmed breach, see the Ransomware.live module.
The settings live in Account, then Billing Account settings, in the Ransomware.live Domain Alerts card between the Leaked Credentials and Email Sender sections.
You must be an account Owner or Admin to change these settings. Other roles can see the card, but the controls are disabled for them. This is stricter than the six IOC-enrichment modules, which any member of the account can configure.
The Ransomware.live module feed must be enabled, or there are no victim claims for these settings to match against. The feed is on by default.
Turn on domain alerts
- Go to Account, then Billing Account settings, and find the Ransomware.live Domain Alerts card.
- Turn on Enable domain-hit alerts. Its description reads "Turn off to stop all ransomware.live domain-match alerts for this billing account."
- Leave on the match toggles you want, and turn off any you do not. All four are on by default.
- Click Save.
| Toggle | What it matches |
|---|---|
| Suppliers | A victim domain matching one of your suppliers' domains |
| Assets | A victim domain matching one of your tracked organization assets |
| Other organization domains | A victim domain matching an organization you track, excluding your own |
| Your billing account domains | A victim domain matching your own account's domains |
Turning the master switch off stops every domain-match alert for the billing account without disturbing the feed itself, so claims keep arriving in your Recent Threats feed either way.
Domain alerts are enabled by default, with all four toggles on, but there are no destinations until you add some, and an alert with no destinations delivers nothing. Add at least one destination in the next section before you rely on this.
Each claim is recorded against your account once, at the point the alert is raised rather than after delivery, so a claim that matches while your destination list is empty is marked as handled and will not alert you again later.
Choose where alerts go
The destinations picker is the same one alert rules use, so anything you have already set up is available here. It starts empty and prefills nothing: click Add my email to add the address you are signed in with, or pick a stakeholder or an integration from the list.
- Email addresses, which must belong to a user or a Stakeholder on the account. You cannot send to an arbitrary address.
- Slack, Webhook, and MISP integrations already configured on the account.
You can add up to 50 destinations in total. See Set up automatic alerting for how the same picker behaves on ordinary alert rules.
What the alert looks like
The email subject is Ransomware.live domain match, and the message body follows one template:
<Group> claims <Victim> — matched your <supplier|asset|organization|account> domain <domain>. UNVERIFIED leak-site CLAIM.Alongside it is a View in Liberty91 link that opens the event, so you can read the claim and whatever else has been reported about the same occurrence before you act on it. The closing sentence is there on purpose: what triggered the alert is an attacker's assertion, not a confirmed breach.
Webhook destinations receive the same information as a JSON body:
{
"source": "ransomware.live",
"event_id": "…",
"eventinstance_id": "…",
"billingaccount_id": "…",
"message": "<Group> claims <Victim> — matched your supplier domain example.com. UNVERIFIED leak-site CLAIM.",
"matched_kind": "supplier",
"matched_domain": "example.com",
"url": "https://platform.liberty91.com/event-instance-details/<event id>/"
}matched_kind takes supplier, asset, org_domain, or ba_domain, which tells a
downstream system which of the four toggles produced the alert.
Limits worth knowing
One alert per claim, per account. If a single claim matches two of your suppliers, you get one alert rather than two.
Matching is exact on the domain. example.com matches example.com and
www.example.com, but not eu.example.com. Subdomain matching is not supported, so list the
registrable domain you actually want watched.
There is no backfill. Adding a supplier or an asset today does not alert you about a claim published before you added it. Alerts are generated as claims arrive.
A claim can be wrong. The domain on a leak-site post is whatever the group typed, and a bad one can produce an alert naming a company that is not actually you or your supplier. Treat the alert as a prompt to check rather than as confirmation.
Frequently asked questions
Who can change these settings?
An account Owner or Admin. Other roles can see the settings but the controls are disabled for them.
Will an alert fire for a subdomain of a domain I monitor?
Only for the www form. Matching is exact, so example.com matches example.com and www.example.com but not eu.example.com.
If I add a supplier today, will I hear about a claim published last week?
No. There is no backfill. Alerts are generated as claims arrive, so a claim published before you added the supplier will not alert you.