Derbentçi user guide
Build your inventory, set up teams and configure notifications for your needs. Then track priority findings through to remediation in the same panel.
Language preference
Change the interface language using Türkçe / English in the top right corner. Your panel preference is saved for your user and company account. Customer records and source descriptions retain their original language.
1. Sign in to your account
Sign in to the admin panel with your company account. If you have access to multiple companies, choose the company you want to work with in the panel.
2. Set up teams and inventory
Define responsible teams in Teams. In Inventory, record the asset, vendor, product and full installed version. Add its responsible team, internet exposure and criticality.
- Use the product suggestions or enter product details manually.
- Enter the complete installed version; additional version and patch details also matter when matching vulnerabilities.
- Saved assets are scanned in the background. Check Inventory for missing versions, scan errors or matches requiring review.
3. Configure notification preferences
Choose critical, high, medium and low severity levels for team notifications. Link the relevant assets to the team. Configure service status and data breach notifications separately.
4. Review priority findings
Review the risk distribution and pending work in Overview. In Vulnerabilities, assess product and version matches alongside the CVSS score, CISA KEV record and EPSS value. The priority score also reflects the asset's internet exposure and criticality.
Verify records requiring review against the actual installation details and the vendor advisory.
5. Record actions and remediation
Add an assignee, due date and action note to the finding. After applying an update or other action, record remediation evidence and the new version. Track overdue and unassigned work in Overview.
Time-limited risk acceptance requires administrator approval and an expiry date.
6. Track software components and services
Upload CycloneDX JSON/XML or SPDX JSON/tag-value files in SBOM. Review OSV component matches and changes between document versions. CI import keys are scoped to a company and can be revoked.
Choose supported providers in Service Status. Review changes and recoveries, and configure notifications for the relevant team.
7. Data breaches and reports
Filter KVKK announcements in Data Breaches by the last 1, 3, 7, 15 or 30 days, or view all records. Overview shows announcements from the last 7 days.
Download a PDF summary of open findings, risk distribution, asset counts and KEV matches from Reports.
Intelligence and research tools
Review indicators with source and date filters in Malicious Links. Create company-specific IOCs, brand monitoring and ATT&CK mappings in Threat Intelligence. Compare SBOM uploads, and review actor profiles, risk notifications and source history in Intelligence and Research.
To monitor domains and certificates, add a domain and publish the displayed TXT record in DNS. Verification is checked hourly. In Threat Hunting, record your hypothesis, query and results; queries are not executed in this section.
Check source and delivery status
Review the latest source checks and errors in Data Flow. Notification delivery details are updated using feedback from the configured email provider. Notifications for published records depend on completion of the relevant source check and matching process.
Return to frequently asked questions or sign in to the admin panel.
Questions and answers
What do Malicious Links records show?
Malicious and suspicious indicators from threat feeds, with their sources and statuses. Suspicious records require analyst review; a listed record does not establish that your company experienced an attack.
When are domain verification and certificate checks performed?
Add the displayed TXT record to DNS for the domain. The worker checks hourly and processes up to 20 domains per run. DNS propagation and source availability can affect verification time.
Does Threat Hunting execute my queries?
It stores hypotheses, log requirements, queries, results and evidence. Queries are not executed against a SIEM here; analysts add the results of their own research.
Where do risk change notifications appear?
EPSS increases, additions to KEV and changes to affected versions appear with old and new values in Risk Notifications. Existing email preferences are managed separately.
Does brand monitoring scan the whole internet?
It checks active threat feeds and valid company IOC records for similarity indicators. It does not cover all domain registrations; results require analyst assessment.
Which vulnerabilities does Derbentçi associate with my organisation?
It compares vendor, product and version information with your inventory, separating exact or high-confidence matches from records requiring review. Records with missing version information need further assessment.
Can I select notification severity levels?
Choose critical, high, medium and low levels for team notifications. Service and data breach notifications are configured separately.
When are new records reported?
Sources are checked regularly. After import, matching and notification preferences are assessed before records enter the delivery queue. Delivery time also depends on source publication and update times.
Which SBOM formats are supported?
CycloneDX JSON and XML, and SPDX JSON and tag-value formats are supported. Upload files in the panel or send them from CI using a company-scoped import key.
How can I follow KVKK data breach announcements?
Public KVKK announcements are listed by date range in Data Breaches. Overview shows the last 7 days. Enable the notification preference to receive new announcements by email.
What information is service status based on?
Public status sources from supported providers. A separately configured Microsoft Graph connection supports company-specific Microsoft 365 status. Provider status does not guarantee that every internal workflow is working.