# User guide: LinceSec Everything you need to know to use the platform: monitoring modules, alert management, status changes, marking false positives, user management and much more. ## What is LinceSec? LinceSec is a multi-tenant **threat intelligence and brand protection** platform. It lets security teams monitor in real time whether their organization’s information has been compromised, whether suspicious domains impersonating their brand exist, whether offensive content is being published, or whether infrastructure is unintentionally exposed to the internet. - **Data Leaks**: Leaked credentials and documents - **Suspicious Domains**: Phishing and brand abuse - **Critical Posts**: Offensive content on social media - **Darkweb**: Mentions in hidden forums - **Infra Exposure**: Exposed services and ports - **Supply Chain**: Impersonation of your published software ## Access and tenant management ### Signing in 1. Go to your LinceSec instance URL. Enter your **email** and **password** and click *Sign in*. 2. If you have access to more than one tenant (organization), you’ll see a selector listing all of them. Choose the one you want to use as your active context. 3. You’ll be redirected to the **Dashboard**. The active tenant’s name appears at the top of the sidebar. ### Switching tenants If you belong to more than one tenant, you can switch context at any time without signing out. Click the active tenant’s name at the top of the sidebar. A menu will drop down listing the other available tenants. Selecting one reloads the view showing that organization’s data. > **Note:** Your role can be different in each tenant. For example, you might be an **Analyst** in one organization and a **Manager** in another. Each session’s permissions depend on the role assigned in the active tenant. ### Signing out Use the *Logout* button at the bottom of the left sidebar. ## General navigation The main interface is made up of a **sidebar** on the left and the **main content** in the center. The sidebar groups sections into three blocks: | Block | Sections | | --- | --- | | Main | Dashboard, Provisioning Portal | | Our modules | Data Leaks, Suspicious Domains, Critical Post, Darkweb, Infrastructure Exposure, Supply Chain Attacks | | Configuration | Users & Roles, Settings, Docs | > **Modules not enabled:** If a module isn’t enabled for your tenant, clicking it will redirect you to the **Upgrade** page, where you can request activation. Disabled modules still show up in the menu so you know they exist. ## Statuses and severities Every record on the platform (leaks, domains, posts, etc.) has a **status** and a **severity** level. Understanding these concepts is essential to managing alerts. ### Possible statuses | Status | Indicator | Meaning | | --- | --- | --- | | Active | Blue dot | New or unmanaged threat. This is the default view when entering any module. | | Resolved | Green dot | The team has taken action and considers the incident closed (e.g. password changed, domain blocked). | | False positive | Yellow dot | The detection doesn’t correspond to a real threat. Kept for audit purposes but requires no action. | | Deleted | Gray dot | Record manually discarded. Still visible in the "Deleted" view for traceability. | ### Status flow Active → Resolved | Active → False positive | Active → Deleted From any non-active status you can always **restore** the record to Active. ### Severities | Level | Guideline description | | --- | --- | | CRITICAL | Immediate potential impact: plaintext credentials, active phishing with MX records, critical infrastructure exposed. | | HIGH | Elevated risk requiring urgent but not immediate attention. | | MEDIUM | Moderate risk. Plan remediation in the short term. | | LOW | Low risk. Monitor or accept as residual risk. | > **Tip:** Severity is editable directly from the table or each record’s card. An analyst can adjust it manually if the automatic assessment doesn’t reflect the organization’s real context. ## Dashboard **Operations center**: A consolidated view of the active tenant’s security posture. The Dashboard has two tabs: **Overview** and **Issues Summary**. ### Overview - **KPIs per module**: Total number of active alerts in each module. - **Recent incidents**: List of the latest detected incidents sorted by date. - **Latest leaks**: Preview of the most recently found credentials or documents. ### Issues Summary - **Distribution by module**: Chart of open alert volume across active modules. - **Top threats by module**: The highest-severity threats in each module. - **Active module selector**: Click any module to filter the view. ## Provisioning Portal **Monitored assets**: Define which domains, keywords, VIP individuals and IPs LinceSec should watch for your organization. The Provisioning Portal is where you configure the monitoring *scope*. Without configured assets, detection modules won’t generate alerts relevant to your organization. Organized into four tabs: ### Domains Register the corporate domains LinceSec should monitor (e.g. `mycompany.com`). The Data Leaks module uses these domains to search for compromised credentials. 1. Type the domain into the text field (subdomains such as `internal.acme.io` are accepted). 2. Press Enter or the *Add* button. 3. The domain appears in the list. You can edit it (pencil icon) or remove it (trash icon with confirmation). ### Keywords / Brands Add brand terms you want to monitor in leaked content and social media (e.g. company name, product names, registered trademarks). One term per field. ### VIPs Register individuals whose personal information should be watched more closely. Each VIP requires a **name**, **email** and **title**. In the Data Leaks module, records tied to VIP emails are highlighted with a crown icon. ### IPs Register corporate IP addresses for infrastructure exposure detection. Only IPv4-formatted IPs are accepted (e.g. `203.0.113.42`). > **Editing and deleting:** To **edit** an item, click the pencil icon at the end of its row. To **delete**, use the trash icon. You’ll be asked to confirm before the record is permanently removed. ## Data Leaks **01 · Leaked credentials and data**: Detects whether your organization’s information has appeared in data breaches. ### Sub-modules | Tab | What it contains | | --- | --- | | Exposed Credentials | Email/password combinations found in compromised databases. Shows the password type and flags whether the email belongs to a VIP. | | Leaked Documents | Confidential documents detected in open sources or leak repositories. | | Pastebin Leaks | Posts on Pastebin-type platforms containing data related to your organization. | | Code Leaks | Source code fragments, tokens or secrets published in repositories or forums. | ### Table interface - **Search**: Filters in real time by any field in the table. - **Date range**: Limits results to the given period. - **VIP filter**: In the Credentials tab, enable the *VIP* toggle to see only VIP credentials. - **Visible columns**: Toggle columns with the chips under the controls. - **Sorting**: Click the *Date*, *Severity* and *Type* headers to sort. - **Pagination**: Navigate with the Previous/Next buttons. ### Hidden passwords In the *Password* column, passwords are masked by default. Click the eye icon to reveal it. The *Type* column indicates whether it’s plaintext or hashed. > **Warning:** **Plaintext** passwords pose an immediate risk: an attacker can use them without any additional processing. Prioritize these records for remediation. ### Changing a record’s status #### Individually 1. With the Active view selected, select one or more records using the checkboxes. 2. The **bulk actions** bar appears. Choose the new status from the dropdown (*Resolved*, *False Positive*, *Deleted*). 3. Confirm in the dialog. Records will move to their new status tab. #### Restoring a record From any view other than *Active*, select the records you want to restore and use the *Restore* button in the bulk actions bar. ### Changing severity The *Severity* column on each row has a dropdown selector. Choose the desired level. The change saves automatically. ### Bulk actions Select multiple records (or the header checkbox to select the whole page). The bulk bar shows the number selected, the status dropdown, the *Restore* button and the *Clear* button. ## Suspicious Domains **02 · Suspicious domains**: Detects typosquatting, phishing and brand abuse through fraudulent domains. ### Domain categories | Category | Description | | --- | --- | | Monitoring | Domains under active watch. Similar to the corporate domain but with no confirmed malicious activity. | | Brand abuse | Domains that fraudulently use the brand name (typosquatting, deceptive combinations). | | Phishing | Domains that mimic the organization’s identity with clear intent to deceive users. | ### Domain card - **Domain name** with a direct link. - **Country** where it’s registered. - **Registrant**: the entity that registered the domain. - **Registration date** and **expiration date**. - **MX Records**: whether the domain can send email (higher danger). - **Screenshot** if available. - **Severity** (editable dropdown). ### Actions on a domain #### Changing status from the card 1. Open the *Actions* selector and choose the desired status (*Resolved*, *Deleted*, *Active*). 2. Or use the quick **False positive** button to mark it with a single click. 3. The card’s status dot updates immediately. #### Details modal Click the **Details** chip to open a full modal where you can also change status, severity, category and view the screenshot. ### Filters - **Search**: Filters by domain name or registrant. - **MX filter**: Shows only domains with/without MX records. - **Date range**: Filters by registration date. - **Status view**: Active, Resolved, False positives or Deleted. ## Critical Posts **04 · Offensive content on social media**: Monitors posts on X, Reddit and Telegram related to your organization. ### Categories | Category | Description | | --- | --- | | Offensive Content | Posts with offensive language, threats or harmful content directed at the organization or its members. | | Hacktivism | Calls to hacktivist action, defacement campaigns, announced DDoS attacks or coordinated leaks. | | Activism | General activism posts mentioning the organization. May lead to public pressure or a reputational crisis. | ### Information for each post - **Platform**: X (Twitter), Reddit or Telegram. - **Author** and the author’s **follower count**. - **Title** and **excerpt** of the content. - **Publication date** and **link** to the original post. - **Evidence**: Indicator of whether an archived screenshot exists. - **Severity** (editable). ### Managing posts - Change status (Active / Resolved / False positive / Discarded) from the card. - Move to another category using the category buttons. - Open the details modal for full information. - Access the original post via the external link. ## Darkweb **05 · Mentions in hidden forums**: Detects mentions of your organization in dark web markets, forums and channels. The Darkweb module scans dark web sources (hacking forums, credential markets, private channels) for mentions of the domains, brands and assets configured in the Provisioning Portal. The interface and status management follow the same pattern as the other modules: filtering by status, individual or bulk status changes, severity adjustment and result export. ## Infrastructure Exposure **03 · Exposed services and infrastructure**: Identifies corporate assets unintentionally accessible from the internet. ### Information for each exposure - **Asset (host/IP)**: Name of the server or exposed IP address. - **Exposed port** and **service** (SSH, VPN, SFTP, RDP, etc.). - **Detection date** and **last seen**. - **Attack vectors**: List of identified vectors. - **Description**: Detail of the risk and observed activity. - **Geolocation**: City and country of the asset. - **Severity** (editable). ### Infrastructure statuses | Status | Description | | --- | --- | | Active | Confirmed, active exposure. Requires immediate action. | | Monitoring | Under watch. The team is tracking it but hasn’t remediated yet. | | Remediated | The exposure has been fixed (port closed, credentials rotated, etc.). | ## Supply Chain Attacks **06 · Impersonation of published software**: Detects package typosquatting, dependency confusion and abuse of your software’s dependency chain. The Supply Chain Attacks module monitors public package registries (npm, PyPI, Maven Central, NuGet, RubyGems), container registries and code platforms to detect attempts to **impersonate the software your company publishes** and protect your customers from malicious artifacts distributed under your name. ### Detection categories | Category | Description | | --- | --- | | Typosquatting | Packages with names nearly identical to your published libraries (typos, hyphens, misleading prefixes) aiming for confused installs. | | Dependency confusion | Public packages that reuse the names of your internal dependencies so package managers resolve the malicious version. | | Chain abuse | Abuse of the dependency chain: hijacked dependencies of your software, compromised maintainers, or trojanized versions published outside your official channels. | ### Information for each detection - **Package or artifact name** with a link to the registry where it’s published. - **Ecosystem**: npm, PyPI, Maven, NuGet, RubyGems, Docker Hub, GitHub… - **Legitimate package being imitated** and the name similarity score. - **Publication date** and **download count**. - **Malicious indicators**: suspicious install scripts, outbound connections, obfuscation. - **Severity** (editable). > **Warning:** A package with **active downloads** that imitates one of your artifacts poses an immediate risk to your customers: prioritize it and request a takedown from the relevant registry. The interface and status management follow the same pattern as the other modules: filtering by status, individual or bulk status changes, severity adjustment and result export. ## Users and roles **Team management**: Only accessible to users with the Administrator role in the active tenant. The Users & Roles section is split into three tabs: **Users**, **Roles** and **Audit Log**. ### Users tab #### User list - **Status**: Active, pending invitation acceptance, or suspended. - **Name** and **email**. - **Global role** in the tenant. - **Teams** they belong to and their role in each. - **MFA**: Whether two-factor authentication is enabled. - **Last activity**. #### Inviting a user 1. Click the *Invite User* button (top-right corner). 2. Enter the **email** and select the **role** they’ll have in the tenant. 3. Confirm. If the user doesn’t exist, they’ll be created with a *Pending* status and receive an invitation email. #### Editing a user Click the edit icon (pencil) on any row to open the side panel: - **Global role**: Change the user’s role in the tenant. - **Teams**: Add or remove the user from teams and assign their role in each. - **Effective permissions**: Informational summary of the global role and team roles. #### Resetting MFA If a user has lost access to their authenticator app, an administrator can reset their MFA setup using the reset icon on the user’s row. #### Bulk actions Select several users with the checkboxes. The bulk actions bar appears with options: *Change role*, *Change status*, *Resend invitation*, *Export*, *Assign team*. ## Roles and permissions ### Roles tab Shows all of the tenant’s roles organized into two groups: - **System Roles**: Predefined by the platform. Cannot be modified or deleted. - **Custom Roles**: Created by the tenant’s administrators. Can be edited, duplicated and deleted. ### System roles | Role | Description | | --- | --- | | Administrator | Full access. Manages users, roles, provisioning and tenant settings. The only role with access to Users & Roles and Settings. | | Manager | Can view and manage alerts across all modules. No access to user administration. | | Analyst | Can view and manage alerts. Standard working access. | | Read-only User | Can only view information. Cannot change statuses, severities or manage alerts. | ### Creating a custom role 1. In the Roles tab, click the + button next to "Custom Roles". 2. Enter a **name** and optionally a **description**. Confirm in the modal form. 3. The new role is created with **all permissions disabled**. Select it to edit its permission matrix. 4. Enable the desired permissions in the **Permission matrix** and click *Save*. ### Duplicating / deleting a role Hovering over a custom role reveals the duplicate and delete icons. Only custom roles can be deleted; you’ll be asked to confirm before deletion. ### Audit Log tab Chronological record of actions performed in the tenant: user creation, role changes, MFA resets, exports, logins, etc. Each entry shows timestamp, actor, action, target, details and source IP. Use the *Export Audit* button (available while on the Audit tab) to export the log. ## Settings > **Restricted access:** The **Settings** section is only accessible to users with the Administrator role in the active tenant. Contains the tenant’s general configuration: integrations, notifications, platform preferences and alert parameters. Check with the platform administrator before changing these settings. ## Module upgrades If you try to access a module that isn’t enabled for your tenant, the platform automatically redirects you to the **Upgrade** page. The modules available for activation are: - **LEAKS**: Data Leaks (credentials, documents, pastebin, code) - **SUSPICIOUS_DOMAINS**: Suspicious Domains - **CRITICAL_POSTS**: Critical Posts - **DARKWEB**: Darkweb - **INFRALEAK**: Infrastructure Exposure - **SUPPLY_CHAIN**: Supply Chain Attacks (package typosquatting, dependency confusion, chain abuse) ## Quick reference for common actions | Action | How to do it | | --- | --- | | Mark as false positive | Select the record → bulk bar → False Positive. In Suspicious Domains there’s also a quick button on the card. | | Mark as resolved | Select → bulk bar → Resolved. Or from the details modal. | | Restore a record | Status view → select → Restore. | | Change severity | Severity dropdown on the row or card. Saves automatically. | | View password in plaintext | Click the eye icon in the Password column. | | Filter VIPs only | Leaks module → Credentials tab → VIP button. | | Move a domain to another category | Suspicious Domains → card → category button or modal → Move to. | | Invite a user | Users & Roles → Users tab → Invite User. | | Create a custom role | Users & Roles → Roles tab → + button next to Custom Roles. | | Switch tenant | Click the tenant name in the sidebar → select another. |