XposedOrNot for TheHive / Cortex

Merged  Merged in TheHive-Project/Cortex-Analyzers#1471

The XposedOrNot Cortex analyzer was merged into Cortex-Analyzers on October 5, 2026, in TheHive-Project/Cortex-Analyzers#1471. It reaches your Cortex instance once your analyzers are updated from that repository. A full installation guide will be added to this page.

What it does

• Two analyzer flavors for mail observables: a fast breach-names check and a detailed breach-analytics report.
• Taxonomies for triage: breach count, overall risk, and a malicious flag when plaintext-password exposure is found.
• Rich long reports: per-breach logos, dates, records, exposed data classes and password-risk badges.
• Breached-site domains extracted as artifacts for pivoting.
• Works keyless out of the box; optional commercial API key for volume. TLP/PAP-gated.

In the meantime

• Use the free, keyless API or one of the eight official SDKs to bring breach checks into your own workflows today.
• Follow progress on GitHub and the blog.
• Questions or requirements? Write to help@xposedornot.com.

← All integrations