> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/attack-surface-management-detections/digital-risk-protection.md).

# Digital Risk Protection

Organizations face significant challenges in safeguarding their brand and digital assets from threats such as credential theft and brand impersonation. Using our comprehensive asset inventory, along with embedded intelligence and automation, Cortex XDR Digital Risk Protection discovers and helps you mitigate the following risks:

* **Brand risk domains**

  Brand risk domains pose a threat to organizations because they can be used by threat actors to deceive customers, partners, or employees by impersonating a legitimate brand or application. These domains can be used for phishing attacks, spreading malware, launching social engineering campaigns, or other fraudulent activities. Additionally, malicious brand risk domains can also be used to steal sensitive information such as login credentials, financial data, or intellectual property.
* **Leaked credentials**

  Leaked Credentials pose a risk to organizations by providing unauthorized access to sensitive systems and data, leading to data breaches, financial losses, and reputation damage.

  Cortex XDR focuses on externally reported credential leaks, specifically surfacing those that have occurred within the last six months.

### How to enable Digital Risk Protection

Digital Risk Protection is **disabled** by default. You can enable it by enabling the Brand Risk Domains and Brand Risk Leaked Credentials attack surface rules. When enabled, these rules generate issues that include brand risk domain and leaked credential information on the issue details panel.

1. Navigate to **Modules** → **Attack Surface** → **Policies** → **Attack Surface Rules**.
2. Filter the list of attack surface rules by **ASM Issue Categories = Brand Protection**.

   ![drp-rules.png](/files/bMfExaS2CWrKagT2Yuhg)
3. Select either or both rules, right-click and select **Enable**.

{% hint style="info" %}

### Note

Both of these attack surface rules are based on the attributed domain assets that appear in the asset inventory. If there are no attributed domains in your inventory, Cortex XDR will not generate Digital Risk Protection findings and issues.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/attack-surface-management-detections/digital-risk-protection.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.