XposedOrNot for OpenCTI

Pull request under review  OpenCTI-Platform/connectors#6999

The XposedOrNot internal-enrichment connector is complete and its pull request is under community review at OpenCTI-Platform/connectors#6999. This page will carry the full installation guide once it merges.

What it does

• Internal-enrichment connector for Email-Addr observables.
• Score derived from breach risk, data-breach labels, and a plaintext-password-exposure label where applicable.
• A structured note with the full breach table (name, date, records, data classes, password risk) on the observable.
• Optional per-breach Incident objects behind a config flag, off by default to keep graphs clean.
• TLP-gated, deterministic re-enrichment (no duplicates), keyless by default with an optional commercial key.

In the meantime

• Use the free, keyless API or one of the eight official SDKs to bring breach checks into your own workflows today.
• Follow progress on GitHub and the blog.
• Want early access or have requirements? Write to [email protected].

← All integrations