# DarkStrata - Full Text

> DarkStrata is a stolen-credential monitoring and dark-web surveillance platform. It detects compromised credentials in infostealer (stealer log) data, notifies affected employees privately, and empowers them to remediate. DarkStrata closes the loop on credential theft with real-time monitoring and built-in security awareness. The entire platform is accessible to AI agents over the Model Context Protocol (MCP) and a REST API.

## What DarkStrata does

Detect compromised credentials in stealer logs, notify employees privately, and empower them to take action. DarkStrata closes the loop on credential theft with real-time monitoring and built-in security awareness - don't just monitor; detect, notify, and remediate.

## MCP Server - AI Agent Integration

Connect AI agents directly to DarkStrata threat intelligence, credential monitoring, and security operations via the Model Context Protocol. Dozens of tools, resources, and guided prompts for security automation. Works with any MCP-compatible client.

- Endpoint: `https://mcp.darkstrata.io/mcp`
- Transport: Streamable HTTP (with SSE streaming for real-time events)
- Authentication: `x-api-key: <YOUR_API_KEY>`
- Open standard: works with any MCP-compatible client (Claude Desktop, Claude Code, Cursor, and others)

### Connecting

```json
{
  "mcpServers": {
    "darkstrata": {
      "url": "https://mcp.darkstrata.io/mcp",
      "headers": {
        "x-api-key": "<YOUR_API_KEY>"
      }
    }
  }
}
```

Replace `<YOUR_API_KEY>` with your DarkStrata API key, generated from your account settings at https://app.darkstrata.io/integrations/api-keys.

### Capability domains

- **Alerts** - Query, triage, and manage security alerts. Filter by severity, status, and type.
- **Assets** - Manage monitored domains and keywords. Add, remove, and verify assets.
- **Credential Check** - Search compromised credential databases with k-anonymity privacy.
- **Data Intelligence** - Query threat data, stealer logs, and exposure data across monitored domains.
- **Groups** - Organise and manage identity groups for monitoring.
- **Incident Response** - Request and manage credential data exports for incident investigation.
- **Lens** - Manage private security awareness invites and review completion metrics.
- **Organisations** - Manage organisations, view statistics, and update organisation details.
- **STIX/TAXII** - Access threat intelligence in STIX, CEF, and LEEF formats for SIEM integration.
- **Usage** - Monitor API usage, billing period summaries, and per-key breakdowns.
- **Composite Workflows** - Multi-step investigation tools that combine data across domains into unified reports.

### Tools

- `alerts-list` - List alerts with filtering and pagination
- `alerts-get` - Get detailed information about a specific alert, including its MITRE ATT&CK techniques
- `alerts-get-stats` - Get aggregate alert statistics and severity breakdown
- `alerts-update-status` - Update the status of an alert
- `alerts-delete` - Permanently delete an alert
- `assets-list` - List monitored domain assets with filtering
- `assets-get` - Get detailed information about a specific asset
- `assets-get-stats` - Get aggregate asset statistics
- `assets-register` - Register a new domain asset for monitoring
- `assets-register-bulk` - Register multiple domain assets in a single operation
- `assets-delete` - Remove a domain asset from monitoring
- `assets-delete-bulk` - Remove multiple domain assets from monitoring
- `assets-resubmit-dns` - Re-trigger DNS verification for an asset
- `credential-check-stats` - Get credential check database statistics
- `data-intelligence-query` - Query credential exposure data with comprehensive filtering
- `data-intelligence-get` - Get details about a specific credential exposure
- `data-intelligence-get-stats` - Get data intelligence statistics and threat score distribution
- `data-intelligence-hostnames` - List unique hostnames found in credential exposure data
- `data-intelligence-get-actions` - Get configured actions for a credential exposure
- `data-intelligence-update-actions` - Update actions for a credential exposure
- `groups-list` - List identity groups with filtering and pagination
- `groups-get` - Get detailed information about a specific group
- `groups-create` - Create a new identity group
- `groups-update` - Update a group's name, description, or configuration
- `groups-delete` - Delete a group
- `incident-response-request` - Request a new credential data export
- `incident-response-list` - List credential data export requests
- `incident-response-get` - Get details about a specific export request
- `incident-response-get-stats` - Get incident response export statistics
- `lens-invite-send` - Send Lens credential review invitations
- `lens-token-revoke` - Revoke a Lens review token
- `organisations-list` - List organisations accessible to the current API key
- `organisations-get` - Get detailed information about an organisation
- `organisations-get-stats` - Get organisation-level statistics
- `organisations-update` - Update organisation details
- `organisations-delete` - Delete an organisation
- `stix-export-alerts` - Export alerts as STIX 2.1 bundles for SIEM integration
- `stix-export-alert` - Export a specific alert as a STIX 2.1 bundle
- `stix-export-indicators` - Export STIX 2.1 indicators for SIEM ingestion
- `usage-get` - Get API usage data with optional filtering
- `usage-get-summary` - Get API usage summary for the current billing period
- `usage-get-by-key` - Get API usage breakdown by individual API key
- `security-posture-overview` - Comprehensive security posture overview combining multiple stats
- `investigate-domain` - Full investigation context for a domain
- `triage-alert` - Gather all context needed to triage a specific alert, including its MITRE ATT&CK techniques
- `exposure-summary` - Credential exposure summary across all monitored domains

### Resources (live)

- `alerts-stats` - Alert counts by status and severity breakdown
- `assets-stats` - Asset verification statistics
- `data-intelligence-stats` - Data intelligence metrics and monthly trends
- `credential-check-stats` - Credential database size and freshness
- `organisations-stats` - Organisation-level statistics
- `organisations-alerts-stats` - Organisation-level alert statistics
- `incident-response-stats` - Incident response export statistics
- `usage-summary` - API usage summary for current billing period
- `usage-by-key` - API usage breakdown per API key
- `dashboard` - Dashboard widget data including recent activity

### Guided prompts (investigation workflows)

- **Triage Alert** - Fetch an alert, enrich it with threat context, suggest a severity rating, and draft a response plan.
- **Analyse Exposure** - Pull exposure data for a domain, cross-reference with credential databases, and assess organisational risk.
- **Incident Response** - Gather all relevant alerts, exposures, and threat data for a domain and produce an incident timeline.
- **Onboard Assets** - Walk through adding domains and keywords to monitoring with verification steps.
- **Executive Summary** - Compile dashboard statistics, recent alerts, and exposure trends into a board-ready briefing.

## REST API

- Base URL: `https://api.darkstrata.io`
- Authentication: `x-api-key: <YOUR_API_KEY>`
- Full reference: https://docs.darkstrata.io
- Official SDKs (Node.js, Python, Rust, Go, C#, Java, PHP): https://github.com/darkstrata/darkstrata-sdks
- Umbraco package (blocks compromised passwords and logins): https://darkstrata.io/en/docs/umbraco/
- Laravel integration (bundled with the PHP SDK): https://darkstrata.io/en/docs/laravel/
- Splunk Technology Add-on: https://darkstrata.io/en/docs/splunk/
- Webhook signature verification (HMAC-SHA256, X-DarkStrata-Signature): https://darkstrata.io/en/docs/webhooks/
- Directory sync (Google Workspace, Microsoft Entra ID, CSV, Groups API): https://darkstrata.io/en/docs/directory-sync/

### Examples

Check credential exposure for a hostname:

    curl https://api.darkstrata.io/v1/data-intelligence/query \
      -H "x-api-key: $DARKSTRATA_API_KEY" \
      -G --data-urlencode "keyword=acme-corp.io"

List active critical alerts:

    curl "https://api.darkstrata.io/v1/alerts?severity=CRITICAL&status=ACTIVE" \
      -H "x-api-key: $DARKSTRATA_API_KEY"

## Authentication

All API and MCP requests authenticate with an API key sent in the `x-api-key` header. Generate and manage keys from your account at https://app.darkstrata.io/integrations/api-keys. Send the key on every request as `x-api-key: <YOUR_API_KEY>`.

## Key pages

- API Reference: https://docs.darkstrata.io
- SDKs: https://github.com/darkstrata/darkstrata-sdks
- Umbraco Package: https://darkstrata.io/en/docs/umbraco/
- Laravel Integration: https://darkstrata.io/en/docs/laravel/
- Splunk Add-on: https://darkstrata.io/en/docs/splunk/
- Webhook Signatures: https://darkstrata.io/en/docs/webhooks/
- MCP Server: https://darkstrata.io/en/mcp/
- Credential Check APIs: https://darkstrata.io/en/credential-check-apis/
- SIEM Integrations: https://darkstrata.io/en/siem-integrations/
- MITRE ATT&CK Mapping: https://darkstrata.io/en/mitre-attack/
- Red Team Intelligence: https://darkstrata.io/en/red-team-intelligence/
- Stolen Data Monitoring: https://darkstrata.io/en/stolen-data-monitoring/
- Dark Web Monitoring: https://darkstrata.io/en/dark-web-monitoring/
- DarkStrata In Your Stack (SIEM/CTI/MDR/MSSP integration): https://darkstrata.io/en/in-your-stack/
- MSSP Partners (white-label, multi-tenant): https://darkstrata.io/en/mssp/
- Lens (security awareness): https://darkstrata.io/en/lens/
- What are infostealers: https://darkstrata.io/en/what-are-infostealers/
- Blog: https://darkstrata.io/en/blog/

## Contact

Support: support@darkstrata.io