Skip to content




This analyzer helps you investigate suspicious emails received from known or unknown senders to ensure that their email addresses aren't compromised.

No API key required.

If the email is compromised then it returns: - Total breaches - Most recent breach - Breached data - Critical data - Exposure rating: The comparative data exposure and risk rating assigned to this email address.

Testing Inoitsu analyzer (Cortex)#

You need first to enable the analyzer.

enable analyzer

Navigate to Analyzers then run Inoitsu analyzer.

run analyzer

Test Inoitsu analyzer on a compromised email address.


Test Inoitsu analyzer on an uncompromised email address.


Testing Inoitsu analyzer (TheHive)#

In the observables section add emails to test.

Then select the emails that you want to analyze, select Inoitsu and click on Run selected analyzers.

thehive iocs


To view the report of the compromised email, click on Inoitsu:Compromised="True"

analyzer report

To view the report of the uncompromised email, click on Inoitsu:Compromised="False"

analyzer report 2


Author: Abdelkader Ben Ali
License: MIT
Version: 1.0
Supported observables types:
- mail
Registration required: False
Subscription required: False
Free subscription: True
Third party service:


Query Inoitsu for a compromised email address.


No specific configuration required.

Templates samples for TheHive#

Inoitsu long report sample

Inoitsu mini report sample

Last update: November 15, 2021 06:39:12