The All Records view displays exposure records associated with your organization's verified, active watchlist identifiers. By default, the table shows records from the last 12 months.

Use filters to narrow results by date range, source type, severity, or other available criteria. You can also review exposed session details, investigate individual records, and export filtered results.

Viewing records

The All Records view lets you:

Browse exposure records associated with your organization's verified, active watchlist identifiers
Filter records by type, severity, source, identifier, and date range
Search across supported record fields
Open individual records to review exposure details
Export filtered records for further investigation

For more information about how watchlist identifiers determine record visibility, see Watchlist Management.

Filter records

Use filters to narrow the records displayed in All Records. You can combine filters to investigate specific exposures without reviewing the entire dataset.

Available filters include:

Identifier type (domain, email, IP, or subdomain)
Specific identifier value
Severity
Source Type
Date range

Applying filters updates the records and counts displayed in the table.

Filter by date range

By default, All Records displays records from the last 12 months. You can select a custom date range to investigate exposures from a specific period or view older records.

Open Workforce Threat Protection > All Records.
Select the date range filter.
Choose a custom start and end date.
Apply the filter to update the records displayed.

The date range filter uses the record's discovery date and operates independently of the Overview dashboard date range. Changing the date range in All Records doesn't change dashboard metrics.

Filter by source type

Use the Source Type filter to narrow records by exposure category, such as breaches, malware, combo lists, or phishing.

Select the Source Type filter.
Choose one or more source categories.
Combine Source Type with Severity, date range, or other available filters to refine the results.

The Source Type column identifies the source category for each record. Selected Source Type filters are preserved in the page URL, allowing you to reload or share the filtered view.

Record Type Tabs

At the top of the All Records view, records are organized by type:

All – Displays all record types
Corporate – Credentials exposed in breaches, combolists, or phishing campaigns
Infected Employee – Credentials stolen by infostealer malware

Record type definitions are explained in Data Model & Record Types.

Selecting a tab narrows the dataset to that specific category.

Search Functionality

The search bar allows free-text search across indexed fields, including:

Email address
Username
Identifier value
Source title
Select searchable metadata fields

Search operates within the currently selected filters and record type tab.

Review exposed session details

The All Records table includes additional information to help identify exposed sessions that may require investigation.

Session Status: Displays Active or Expired for applicable access records, based on cookie expiration.
Cookie Domain: Displays the domain associated with the exposed session, when available.
Cookie Expiration: Displays the cookie expiration date, when available. This column is hidden by default and can be enabled from the column picker.

To review exposed session details:

Open All Records.
Review the Session Status column to identify records marked Active or Expired.
Review the Cookie Domain column to identify the associated domain, when available.
Open the column picker and enable Cookie Expiration to display expiration dates.

Use these details to prioritize further investigation of potentially active exposed sessions.

Note: Session Status is based on cookie expiration information and doesn't independently confirm whether a session remains valid.

Record Detail Drawer

Selecting a record opens the Record Detail Drawer.

The drawer displays all available structured fields associated with that record. Field availability varies by record type and source.

Common fields may include:

Email address
Username
Password (masked by default)
Target URL (when available)
Source title
Severity score
Discovery date
Sighting history
Raw or additional source metadata

Password Visibility

Passwords are masked by default. Users with appropriate permissions can toggle visibility.

Password visibility controls do not modify the underlying data. They affect display only.

Sighting History

Some records include a sighting count, which reflects how many times the same credential has appeared across multiple recaptured datasets.

Sighting history provides additional context but does not change severity scoring.

For more information on sighting logic and severity scoring, see Data Model & Record Types and Severity Levels.

Export filtered records

You can export records matching your selected filters, including custom date ranges and source types.

Apply your preferred filters before selecting Export. The downloaded file includes only records matching the selected criteria.

For detailed instructions, see Exporting Records.

Relationship to Other Views

The Overview Dashboard provides aggregated metrics and trend analysis.
The Recent Records view highlights newly ingested or recently updated records for workflow tracking.

The All Records view provides the most complete and flexible dataset for reviewing exposure data tied to your organization.

Infected User Records

If the Infected User view is enabled for your account, the Infected User tab appears as a selectable record type. These records are derived from malware logs and may include:

Stolen credentials
Session cookies
Browser-stored authentication data

Session cookies may allow attackers to reuse authenticated sessions without re-entering credentials.

Definition of an Infected User

Recaptured exposure data — including stolen credentials and session cookies — tied to users associated with your domain who are operating malware-infected devices.

View All Records