Live Merged in OpenCTI-Platform/connectors#6999
The XposedOrNot internal-enrichment connector adds data-breach exposure to Email-Addr
observables in OpenCTI:
which breaches an address appears in, when, how many records were exposed, which data classes leaked and
how passwords were stored. It ships in the official
OpenCTI-Platform/connectors
repository and works without an API key.
For a breached address the connector enriches the observable in place and attaches one Note:
data-breach and, when at least one breach stored passwords in plaintext,
plaintext-password-exposure. Both are refreshed on every run; your other labels are kept.XPOSEDORNOT_UPDATE_SCORE=true. See the score note below before switching it on.A clean address (no known breach) completes with the status No known breach exposure for this email address (XposedOrNot) and changes nothing. The connector is playbook-compatible: when there is nothing to add, the incoming bundle is handed back unchanged so the next step still runs.
Docker (recommended): add the connector service to the docker-compose.yml of your
OpenCTI stack, next to your other connectors, then start it.
Use a fresh UUIDv4 for CONNECTOR_ID if you run more than one instance.
Manual (Python 3, from a clone of the connectors repository):
Edit config.yml before the last step: set opencti.url and opencti.token;
the remaining keys mirror the environment variables in the table below.
In OpenCTI open Data → Ingestion → Connectors. XposedOrNot should be listed as an
internal enrichment connector with a green status and Email-Addr in its scope. If it is missing,
check the container logs:
Email-Addr observable (Observations → Observables), or create one.data-breach label, an external reference and a
Note tabulating each breach. If the address is clean, the work completes with no changes.To enrich automatically, set CONNECTOR_AUTO=true. Keep it off on the keyless API: the limits
below are easy to hit with automatic enrichment, so configure an API key first.
None required. The defaults use the free, keyless community API. The variables you are most likely to change:
| Variable | Default | What it does |
|---|---|---|
XPOSEDORNOT_API_KEY | empty | Optional key from plus.xposedornot.com. Switches to the commercial Plus API with higher rate limits. |
CONNECTOR_MAX_TLP | amber |
Highest TLP an observable may carry and still be enriched. The email address leaves your platform, so this gates what may be sent. |
XPOSEDORNOT_TLP_LEVEL | amber |
TLP marking applied to the Note. The Note also inherits every marking of the source observable. |
XPOSEDORNOT_UPDATE_SCORE | false |
Write the XposedOrNot risk score to the observable's score. Community API only; it overwrites the existing score. |
XPOSEDORNOT_MAX_NOTE_BREACHES | 50 |
How many breaches the Note tabulates, newest first. 0 renders all of them. |
CONNECTOR_AUTO | false |
Enrich every new Email-Addr automatically. Needs an API key in practice. |
CONNECTOR_LOG_LEVEL | error |
debug, info, warn or error. |
The full reference, including XPOSEDORNOT_API_BASE_URL, is in the connector's
README.
Email-Addr observables into detection-oriented workflows or feeds.
Keyless community API: 2 requests/second, 25/hour, 100/day per IP. HTTP 429 responses are retried twice with
backoff honouring Retry-After; if the limit is still hit, that single enrichment is reported in
error and the connector keeps running. The optional commercial key raises these limits.
Set CONNECTOR_LOG_LEVEL=debug and watch the connector logs. The email address and API key are redacted from every message.
| Log message | Meaning |
|---|---|
XposedOrNot rate limited; backing off | Expected under keyless bursts. Configure a key for volume. |
XposedOrNot: still rate limited after retries | Three attempts exhausted; only that enrichment failed. |
XposedOrNot: request rejected (check the API key) | The Plus API refused the key in XPOSEDORNOT_API_KEY. |
XposedOrNot: redirect refused | The base URL redirected. Point XPOSEDORNOT_API_BASE_URL at the endpoint that answers directly (https only). |
XposedOrNot request failed | Network or TLS failure between the connector and the API. |
| Observable not enriched, no error | Its TLP is above CONNECTOR_MAX_TLP, it is not an Email-Addr, or the address has no known breach. |
CONNECTOR_MAX_TLP, mark results restrictively and use them
within lawful, authorised investigations. See our privacy policy.