The Have I Been Pwned Action Bundle enables ThreatQ users to enrich email address indicators with breach intelligence from the Have I Been Pwned (HIBP) platform. By querying the HIBP breached account endpoint, the action identifies known data breaches associated with an email address and enriches the indicator with breach-related context to support credential exposure investigations and incident response.

The integration provides the following action:

• Have I Been Pwned - Lookup - queries the Have I Been Pwned (HIBP) breached account endpoint using a submitted email address and returns details of known data breaches associated with the account.

The integration is compatible with Email Address type Indicators and returns enriched indicators and indicator attributes.

Note: This action is intended for use with ThreatQ TDR Orchestrator (TQO). An active TQO license is required for this feature.