Adding Dark Web Search Terms

Bolster’s Dark Web module monitors specific terms you define to surface threats such as stolen credentials, leaked code, or phishing kits. This guide shows you how to set up those search terms for accurate findings.

A search term consists of up to three elements:

1. Entity – Type of information to look for (optional)
2. Category – Types of dark web posts to look in (optional)
3. Value – Keyword or keywords that the search needs to match (required)

Steps to Add a Search Term

Here’s how to add a search term to the Dark Web module for Bolster to monitor.

1. Navigate to Attack Surface > Dark Web > Add Search Terms.
2. Under Search Terms, use the dropdowns to define the three elements:

• Monitor results in select category
• that includes select entity
• with value enter value

3. Select Submit to create the search.
4. Verify that it appears in the Searches list. At first, Last Search will say In Progress.

Example

If you wanted to look for:

• The credit card number 1111 2222 3333 4444
• Only in posts containing breach data for sale
• Excluding those same digits if they’re found in other contexts

Then you’d make the following Search Terms dropdown selections:

• Monitor results in Breach Data for Sale
• that includes Credit Card
• with value 1111 2222 3333 4444

For more examples covering full workflows for common use cases, see Setting Up Dark Web Detection Workflows.

Search Term Guidelines

To get useful results, your search terms should match the kind of dark web data you’re looking for. This helps ensure complete and relevant findings, giving you comprehensive protection and making triage easier.

Here are guidelines for building successful dark web searches.

Categories

Category narrows your search to a specific type of dark web content, such as posts selling breach data or malware. Select Any to search across all types.

For example, if your search focuses on finding potentially damaging information about company executives, choose the Employee Monitoring category to search only posts that talk about employee names.

Entities

Entity refers to the type of information the value represents.

Entity narrows your search to a specific type of information, such as an email address. Select Any to search across all types.

For example, if your search uses the Email-Domain entity, the value must be an email address in the expected format (e.g., identifier@domain.com).

Values

The keyword value is the most important part—it’s the exact text Bolster will look for on the dark web. So craft your value carefully to surface relevant results without too much noise. You can use Boolean operators like AND and OR (must be all caps) for precision.

More Examples

Here are a few sample search terms to show how values work in different contexts. You’ll see what gets returned (and what doesn’t) based on the combinations you use.

Refining Search Terms

To improve relevance and reduce noise, your Customer Success Manager or Bolster support contact can review your planned search terms and suggest refinements based on best practices.