Threat Detection

Detection runs asynchronously and creates findings or alerts. Notifications follow your notification configuration; detection does not mean every teammate receives a message.

How it works

Every third-party script loaded on your site goes through a multi-stage pipeline. First, cside deobfuscates and normalizes the script, then checks it against static detection rules and scores it on several threat signals. If a script crosses a risk threshold, cside runs a deeper AI-powered analysis. Malicious scripts trigger an alert to all your configured notification destinations.

Detection methods

cside uses a layered approach to identify malicious scripts:

Known bad sources

Scripts are checked against databases of known malicious sources, including:

• Hostnames: domains known to serve malicious content
• URLs: specific URLs that have been flagged as malicious
• IP addresses: IP addresses associated with malicious activity

Known bad payloads

Script content is compared against known malicious payloads using:

• File hashes: SHA-256 and other hash comparisons against databases of known malicious script payloads

Script normalization

Before analysis, cside deobfuscates and normalizes scripts to reveal what they actually do. This reverses common obfuscation techniques so attackers can’t bypass detection just by disguising their code.

Threat scoring

cside calculates a risk score for each script based on signals like content changes, domain age, behavioral flags, and how many sites are affected. Scripts above the risk threshold get escalated for deeper analysis.

AI-based deep analysis

High-risk scripts go through AI-powered analysis that catches threats static rules miss:

• Obfuscated malicious code - scripts trying to hide what they do
• Zero-day threats - attack patterns not yet in any database
• Behavioral anomalies - scripts doing things they shouldn’t be

Alerts and notifications

When cside flags a malicious script, it can notify your team through any destination in your notification configs - email, Slack, Discord, Jira, Linear, S3, or custom webhooks.

To set this up, create a notification config with the Script Threat Detected trigger. See Notifications for details.

From detection to blocking

Detection runs asynchronously and creates findings or alerts. Notifications follow your notification configuration; detection does not mean every teammate receives a message.

For a URL, IP address, hostname, or domain alert, Block can stop matching scripts on domains using Script Method, on Business plans and above. Hash alerts offer Resolve only. Review Resolving Alerts before acting.

Existing protections, such as managed threat-list blocking, Vendor Permissions, and Approved Tags, can already enforce restrictions independently of a manual alert action. Scan Method has no browser runtime enforcement; use your own CSP to prevent unauthorized loads. See Scan Method setup.

Threat detection vs. vulnerability detection

cside offers two complementary security features:

These two features cover different angles - use both for the best coverage of your third-party scripts.