Does Sherlog really index cookies?

Yes. Session cookies are first-class records, with validity indicators where determinable. Most breach-monitoring products stop at credentials, and cookies are how attackers bypass MFA after a password reset.

How fresh is the data?

Log batches are indexed continuously. Every record carries both timestamps, one for when the log was produced on the victim device and one for when we parsed it, so capture-to-index latency is measurable per record rather than asserted. We do not publish a median for it: computing one is a full scan of a twelve-billion-row table, and a figure nobody can recompute is a figure that goes quietly stale. The telemetry panel on our homepage shows the batches that just cleared the pipeline.

How do you handle combolists?

Recycled combolists are relabeled ULP, which marks them as secondary-source rather than primary capture. One filter switches a search between everything, primary stealer records only, or ULP only, so an exposure count never quietly inflates itself with resold material.

Who can see the credentials we pull?

Anyone you grant the Sherlog role, and the console hides secret values behind a reveal toggle so they are not sitting on screen by default. The real control is the record: every search, from the console or an API key, lands in your organization's activity log with the caller, the query and the filters. See our Trust Center for the full legal basis.

MODULE 01 · Credential & Cookie Intelligence

Whose password leaked, from which device, when? And does it still work?

Sherlog captures stealer logs in the channels where they are first collected and indexes both credentials and session cookies, keeping the victim-machine context that combolists throw away.

See Sherlog in a demo See pricing

01Capabilities

What Sherlog sees

Cookies as well as passwords

Passwords get rotated; a live session cookie walks straight past MFA. Sherlog indexes cookies as first-class records, carrying the domain, the path, the Secure / HttpOnly / SameSite flags, the browser and profile they were taken from, and the expiry with an expired marker on each one. That ends the "we reset the password, we're safe" illusion.

Capture at the source

We catch stealer logs in the channel where they are first dropped, before they are chopped up and resold. Each record keeps the machine context a combolist strips: hostname, hardware ID, OS user and victim IP, labeled by stealer family and dated twice, once for when the log was produced on the victim device and once for when we parsed it. Filter by country, by either date, and drop recycled combolists outright.

A matching engine that thinks in domains

Exact, fuzzy and family matching. A family search for acme.com picks up sso.acme.com and mail.acme.com without burying you in false positives, and exact mode pins the query to one host.

Every search is on the record

Each query, from the console or from an API key, is written to your organization's activity log with the caller, the filters it ran and whether it arrived over the API. API traffic is capped by a daily org-wide ceiling, console work is not metered, and keys are shown once at creation and revocable from the same screen.

One record, annotated

Anatomy of a stealer-log record

Every field is an operational decision: what to reset, what to revoke, which machine to pull.

SHERLOG RECORD

sample · masked

source: stealer/redline
collected_at: 2026-07-11T03:12:44Z1

username: [email protected]
password: Pa••••••••3!2

cookies: 14 · active: true
session: sso.acme.com3

machine: Windows 11 · DESKTOP-••••
victim_country: US4

Captured at first drop

Source channel and capture timestamp are primary-record facts rather than recycled combolist noise, so every record carries where it came from and when it was taken.

Every lookup is on the record

Secret values stay hidden in the console until an analyst reveals them, and the query that surfaced this record is written to your organization's activity log with the caller and the filters behind it.

The cookie is the headline

An active session cookie walks straight past MFA. Resetting the password alone does not close this record; revoking the session does.

Context combolists throw away

Victim-machine OS, hostname and country tell you which device is infected, which is the difference between a password reset and an incident response.

02The API is the product

Same data, same permissions, over HTTP

Everything the console shows, the API serves. Real endpoint, sample response, masked values.

GET /api/sherlog/leak/search

REQUEST

curl -H "X-API-Key: sk_••••••••" \
  "https://console.generalintels.com/api/sherlog/leak/search\
?q=acme.com&search_type=domain&match=family&country=US&limit=50"

RESPONSE · 200

{
  "success": true,
  "meta": {
    "query": "acme.com",
    "search_type": "domain",
    "count": 3,
    "limit": 50,
    "offset": 0,
    "sort": "desc",
    "date_type": "log_date",
    "has_more": false
  },
  "data": [
    {
      "id": "e3e346a0-3279-4930-ab9b-348db1383c32",
      "url": "https://sso.acme.com/login",
      "username": "[email protected]",
      "password": "••••••••",
      "log_date": "2026-07-11T03:12:44+02:00",
      "parsing_date": "2026-07-11T03:19:02+02:00",
      "stealer_name": "RedLine",
      "country": "US",
      "ip_address": "•••.•••.29.165",
      "computer_name": "DESKTOP-••••",
      "hardware_id": "3afd955b••••",
      "machine_user": "jdoe"
    }
  ]
}

Credential and victim-IP values are redacted in this sample; the API returns them in full. Cookies live on the sibling route, /api/sherlog/cookies/search.

Quota, in the open

Console work is unmetered. What your tier caps is the API: a daily org-wide ceiling, published on the pricing page rather than discovered in a support ticket. Past it further calls are declined until the counter resets. There is no overage billing, and your API consumption is a live bar in the console.

See the daily API ceilings

Full API reference ships with your workspace: every endpoint, versioned.

03In practice

A night in the exploitation window

03:12

A stealer log batch drops in a Telegram channel. Sherlog's pipeline picks it up.

03:19

Batch parsed and indexed. Nothing is sent anywhere; the records are simply searchable from here on.

08:05

The morning query on your domain family returns three new records. One carries a session cookie for your SSO portal that has not reached its expiry.

08:41

Your analyst resets the password and revokes the session, cookie included. The listing never found a buyer.

Questions

Sherlog, honestly answered

Keep exploring

The other windows

Platform overview

Your competitors will learn about the leak from the invoice.

Learn about it from the log batch.

Request a demo Explore the platform

NDA-friendly briefings · global coverage · no slideware