Removing Inactive Users from Data Breaches & Malware Compromised Users

When reviewing your Data Breach or Malware Compromised User Modules, you may want to filter out credentials that no longer belong to active employees. ShadowMap offers three ways to remove or archive inactive users:

1. Manual Archiving of Breaches

Any breach event or specific credential entry can be archived from your active view once you’ve confirmed it’s no longer relevant.

1. In the Data Breach Module and Stealer Log Module, locate the breach or user entry.

2. Click the check-box next to that record.

3. Select Archive.

4. The archived item moves out of your active list but remains in your audit logs for compliance purposes.

2. Automated Archiving via Azure AD Integration

To streamline cleanup, leverage our Azure AD OAuth integration (see “Automated Checks for the Dark Web Credentials”):

1. Configure the Azure AD app as per the  guide.

2. Enable the integration under Settings → Workflow & Integrations → Automated Credential Checks.

3. Each night, ShadowMap will:

   • Query your Azure AD tenant for current users.

   • Automatically archive any credentials in the breach list that belong to users no longer present in Azure AD.

   • Automatically highlight any working credentials in the breach list that belong to an active user in Azure AD.

   • Highlight and report the remaining valid compromised credentials.
     
     

This hands-off approach ensures your breach dashboard only shows accounts that truly need your attention.

3. CSV-Driven Bulk Updates

If you maintain an external HR or Access-Management system, you can periodically export a CSV of all active users and send it to our support team:

• Filename format: ActiveUsers_YYYYMMDD.csv

• Minimum columns: username,email

Email your file to support@securitybrigade.com, and we’ll process it server-side to:

• Archive any breach entries not found in your CSV

• Retain and highlight only those credentials still in use

4. Other Access-Management Integrations

Don’t use Azure AD? No problem. If you’d like to connect another identity platform (Okta, OneLogin, Ping Identity, etc.) for automated cleanup, just reach out to support@securitybrigade.com. We’ll evaluate the API or export capabilities of your system and advise on a custom integration.