The rule that fired, its severity, the alert's status and the malicious domains it cites.

Do we have to write parsers?

No. Each SIEM gets the format it already reads, such as UDM events in Google Security Operations or STIX indicators in Microsoft Sentinel.

How do we know it arrived?

Every delivery records the provider's response. If one fails, the dashboard shows the provider's error.

Can analysts send a finding by hand?

Yes. Analysts and AI agents can send any domain from your results to a connected SIEM through the API or the MCP server.

Which plans include Security Operations?

Security Operations is an Enterprise add-on.

Security Operations

Triage malicious domains
in the SIEM you already use

Your analysts don't need another console. Every malicious domain reaches your SIEM as a native event, ready for the searches they already run.

Book a demo

How it works

Trace a malicious domain
to the device that resolved it

Analysts work each finding like any other event, then join it to DNS logs to find the device that looked up the domain.

No new console

Findings land next to everything else your analysts triage.

No parsers to write

Each SIEM receives the finding in its own schema, ready to search from the first delivery.

Ready for detections

Search and alert on findings with the queries and fields your analysts use every day.

Find the device

Join a finding to DNS logs and start the investigation at the laptop that resolved the domain.

Alertsacme-billing.comHigh

Credential phishing page detected

Verdict: Phishing95%
Registered: 3 days ago
Page: Sign in to Acme

Sent to

SplunkAcknowledged
Google SecOpsAccepted
Elastic SecurityAccepted
Microsoft SentinelCreated

Search & ReportingMessagesSettingsActivityHelp

index=security sourcetype="hibs:v1"

Last 60 minutes

3 events (10/27/26 8:30:00.000 AM to 9:30:00.000 AM)

Events (3)PatternsStatistics

iTimeEvent

10/27/26
9:18:04.000 AM

{"schema_version":1,"event_type":"finding.created","finding":{"title":"Credential phishing page detected"

event_type: finding.created
finding.title: Credential phishing page detected
finding.level: high
finding.alert_status: active
finding.fqdns{}: acme-billing.com

10/27/26
9:02:11.000 AM

{"schema_version":1,"event_type":"finding.created","finding":{"title":"Lookalike parked","level":"low","fqdns":["acmme.com"]}}

10/27/26
8:47:30.000 AM

{"schema_version":1,"event_type":"finding.created","finding":{"title":"New lookalike registered","level":"medium","fqdns":["acme-sso.net"]}}

Security OperationsInvestigationDetectionSettings

UDM Search

metadata.vendor_name = "Have I Been Squatted"

Last 1 hour

1 eventAggregations

2026-10-27 09:18:04GENERIC_EVENTacme-billing.com

Event viewer

UDM fieldsRaw log

metadata.event_type: GENERIC_EVENT
metadata.product_event_type: finding.created
security_result.rule_name: Credential phishing page detected
security_result.severity: HIGH
about.hostname: acme-billing.com

DiscoverSecurityObservabilityHelp

event.dataset : "haveibeensquatted.finding"

Last 1 hour

3 hits

@timestampmessage

Oct 27, 09:18:04Credential phishing page detected

Oct 27, 09:02:11Lookalike parked

Oct 27, 08:47:30New lookalike registered

Document

TableJSON

event.kind: alert
event.category: threat
event.severity: 73
message: Credential phishing page detected
related.hosts: acme-billing.com

Microsoft Sentinel | LogsIncidentsHuntingSettings

ThreatIntelligenceIndicator | where SourceSystem == "Have I Been Squatted" | join kind=inner (DnsEvents) on $left.DomainName == $right.Name | summarize FirstSeen = min(TimeGenerated1) by Computer, ClientIP

Last 1 hour

ResultsChart

Computer	ClientIP	FirstSeen
FIN-LT-042	10.20.4.42	10/27/2026, 9:16:42 AM

Destinations

Pick a SIEM
(or all four)

Connect in minutes from the dashboard, with a setup guide for each SIEM.

FAQ

Frequently asked questions

Abusive infrastructure,
disrupted

Have I Been Squatted helps security teams detect infrastructure targeting their organization, investigate it with evidence, and coordinate takedowns.

Book a demo

Trace a malicious domainto the device that resolved it

Pick a SIEM(or all four)

Splunk Enterprise and Cloud

Google Security Operations

Elastic Security

Microsoft Sentinel

Frequently asked questions

What's in a finding?

Do we have to write parsers?

How do we know it arrived?

Can analysts send a finding by hand?

Which plans include Security Operations?

Abusive infrastructure,disrupted

Detection

Response

Trace a malicious domain
to the device that resolved it

Pick a SIEM
(or all four)

Abusive infrastructure,
disrupted