概要
Enrich an email address with its data-breach exposure: breach names, dates, records, exposed data classes, password-storage risk and descriptions. Labels the observable, scores its exposure (optional) and attaches a summary note. No API key required.
XposedOrNot is an open, free data-breach search service tracking 760+ breaches. Given an email address, it returns the breaches the address appears in, with per-breach detail: breach date, records exposed, exposed data classes, affected domain, industry, password-storage risk and a short description, plus an overall risk score.
Integrating XposedOrNot with OpenCTI lets analysts enrich an Email-Addr observable in place: the observable receives data-breach labels (plus a plaintext-password-exposure label when applicable), an external reference and, optionally, a score, and a markdown summary note is attached with a per-breach table covering the most recent breaches (50 by default, configurable), with a line naming how many more were found whenever the table is capped. The score is the XposedOrNot risk score (community API only): it measures how exposed the address is, not how malicious it is, and it overwrites the observable's existing score. The score is off by default; set XPOSEDORNOT_UPDATE_SCORE=true to write it. The connector works without any API key via the free community API (rate limits apply); an optional commercial key raises limits. Breach exposure tied to an email address is personal information and must only be used for lawful, authorised investigations (GDPR / legal basis / proper investigative framework).