ID Watch Automation

Editors Insight

Overview

Monitoring the dark web for leaked credentials is essential to protecting client security—but manually reviewing alerts from tools like ID Watch can be slow and inconsistent. Engineers often need to sift through email content to identify affected users and take action, which delays response time and increases risk.

To solve this problem, Pia automates the review process by parsing the ID Watch alert directly from the email body and applying logic to act accordingly. This ensures faster, more reliable responses to compromised credentials—without the manual overhead.

Even if you don’t have ID Watch, this automation can be modified so that it can be used for other dark web monitoring software as it’s not reading any values from ID Watch itself but just from the tickets in the client’s ticketing system.

Flow

1. Pia will obtain a copy of ticket data including the ticket body.
2. Pia will parse the information in the ticket body to determine the user’s username and/or email address and whether the password was included in the leaked data.
3. Pia will stop the package if the password was not included at this stage:
   • If the password is not included, Pia will close the ticket.
4. Pia will get all the On-Prem AD users from the group (if the client has On-Prem AD).
5. Pia will get the Azure user via their UPN.
6. Pia will then use logic to determine whether the On-Prem AD user or Azure user matches the username specified and then evaluate whether the account is enabled in On-Prem AD and/or Azure:
   • If the user does not have an On-Prem AD account or Azure account, Pia will close the ticket.
7. Pia will query On-Prem AD for the last time the user’s password was set and the last logon date for the user:
   • If the password change is newer than the date that ID Watch specifies, Pia will close the ticket.
8. Pia will then create a ticket note with the information above appended to the ticket.
9. Pia will present a form to the engineer with the same data as the ticket note and prompt the engineer with the following options:
   • Set password to change at next login: Toggles this flag on the account in On-Prem AD or Azure (based on where the account is).
   • Reset the user’s password: Starts the Password Reset automation.