XposedOrNot for Wazuh

Live

The official XposedOrNot integration for Wazuh is available now. Get the integration script, rules and setup guide from XposedOrNot-Wazuh on GitHub.

What it does

• Custom integration for Wazuh 4.x managers: emails seen in authentication, user-creation and IdP alerts are checked against the breach database.
• Enriched alerts with breach count, years, records, exposed data classes and worst-case password risk, plus ready-made rules at sensible severity levels.
• Built-in result caching and per-email suppression so the free keyless API comfortably covers steady-state use.
• Stdlib-only script (no pip installs on your manager), hard time budgets, and fail-open behavior that never stalls your pipeline.
• Masked email addresses in logs and alerts by default.

Get started

• Download the integration from XposedOrNot-Wazuh and follow the README to deploy it on your Wazuh 4.x manager.
• No API key needed; the free, keyless community API is the default.
• Questions or feedback? Open an issue on the repository or write to [email protected].

← All integrations