xonThreatIntel+ / Integrations
Splunk Breach Monitoring Integration
The official XposedOrNot app for Splunk brings breach exposure data into the SIEM your SOC already lives in: breached and exposed email addresses for your domains, collected from the XposedOrNot API and visualized in ready-made dashboards.
What you get
- Breach and exposure data for monitored domains as Splunk events, ready for correlation searches and alerting.
- Dashboards for exposure visibility out of the box, no SPL required to get started.
- Real-time updates as new breach data lands in the XposedOrNot index, which ingests new data daily.
- An official, developer-supported app maintained by the XposedOrNot team.
Setup
- Install the app from Splunkbase (app 7631) on Splunk Enterprise 9.0-9.4.
- Add your XposedOrNot API key. A free community key works; xonPlus plans raise the rate limits when you monitor more domains or query at volume.
- Point the app at the domains you monitor and let the dashboards populate.
Full API reference lives in the developer docs.
Beyond the app
Teams that outgrow polling move to xonThreatIntel+ feeds: webhooks push new exposures the moment they land, and JSON/STIX 2.1 output drops into any SIEM pipeline. Security teams monitoring their own domains get the same alerts through xonEnterprise+ from $25/mo. All plans are on the public price list.
Frequently asked questions
Is the Splunk app free?
Yes. The app installs free from Splunkbase. It needs an XposedOrNot API key to collect data; a free community key works, and paid xonPlus plans raise the API rate limits behind it.
Which Splunk versions are supported?
Splunk Enterprise 9.0 through 9.4. The app is listed on Splunkbase in the Investigative and SIEM categories.
What data lands in Splunk?
Breach exposure data for the domains you monitor: breached and exposed email addresses with breach metadata, collected from the XposedOrNot API and visualized in the app's dashboards.
Who maintains the app?
The XposedOrNot team builds and maintains it directly. It is listed on Splunkbase as developer-supported, and support is available through the same channels as every xonPlus product.