Data Points

💥 Data Breach

A known data breach or leak incident with exposed records.

Cyber

Sources

0 no-auth

Disciplines

that use it

Mission domains

reach

Workbench

—

native tool

🔗 Analyst pivots

Search platform →OSINT pivot →Source catalog →

🔌 Sources that yield Data Breach (2)

Source	Category	Auth	Format
DeHashed / Breach Lookup Compromised-credential search.	BREACHINT	KEY	`json`	home↗ api↗
Have I Been Pwned Breach exposure lookup (free breach list).	Operational Security	KEY	`json`	home↗ api↗

🧭 Disciplines

BREACHINT (2) →

🎯 Mission Domains

Operational Security (2) →Fraud & Identity (1) →Cyber Crime (1) →

🔍 Lookup

📜 Playbook — Data Breach exploitation

Direction — frame the requirement for Data Breach: what decision does this support, by when?
Collection — pull the 2 mapped sources (0 free) and the native workbench; capture provenance and observe OPSEC.
Processing — normalize, de-duplicate and enrich the collected data.
Analysis — correlate against local holdings; apply ACH; assign confidence.
Dissemination — open a case, draft a report, share via STIX/MISP.
Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

🤖 Copilot brief ⚡ AI Skills Resolve Enrich Auto-Collect Hunt Report Export

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

+ Case + Campaign Watchlist Tag Save search Whitelist Export STIX/MISP Report

🧩 Advanced Capabilities

Link Analysis Pivot Explorer Timeline Threat Hunting Analytics Detection Rules Blockchain OSINT Pivot Passive DNS TAXII 2.1 MISP Feed Create Alert Rule NetFlow Coverage & Gaps

✨ Enrichment pathways

Enrichment Runner →Resolve locally →Enrichment → local →Integrations →

🎫 Data Breach

A data breach is a named incident in which a dataset of records (credentials, PII, financial, health) was exfiltrated or exposed. It matters because breach corpora fuel credential-stuffing, phishing target selection, and identity resolution — and confirm which of a subject's accounts and secrets are compromised.

Format: Named breach (source, date, record count, exposed field schema); records as email:hash or email:plaintext, PII rows; combolists as user:pass; often distributed as SQL dump / CSV / JSON.

📡 How it is collected

Breach-monitoring service ingestion
Darknet forum / market dump acquisition
Paste-site and Telegram channel scraping
Combolist and stealer-log aggregation
Direct notification / disclosure filings
Exposed database (Elastic/Mongo) scanning

📚 Enrichment & validation sources

Have I Been Pwned →DeHashed →Intelligence X →LeakCheck →Firefox Monitor →Snusbase →BreachDirectory →Scylla / breach forums →

🔗 Pivot to

Email Address →dp_password / dp_credential →Phone Number →dp_person / identity →dp_domain (affected org) →actor-profile (breach seller) →

🧩 Analysis & hunting techniques

Credential exposure lookup per selector
Cross-breach identity linkage (email reuse)
Combolist deduplication & normalization
Stealer-log parsing (cookies, autofill)
Password-reuse & pattern analysis
Timeline correlation to intrusion events
PII enrichment / identity resolution
Domain-scoped exposure assessment

🔧 Tools

h8mail
HIBP API
Maltego (breach transforms)
SpiderFoot
breach-parse
DeHashed API
theHarvester

⚡ Workbench actions

Search selector across breaches
Enumerate exposed fields
Link identities across dumps
Extract credentials & cookies
Assess domain exposure
Timeline breach vs activity
Screen against sanctions/PII
Pivot to phone & person

📊 Dashboard KPIs

Breaches containing selectorTotal exposed recordsPlaintext-password exposure countMost-recent exposure dateCross-breach identity links

📂 Open

Data point →Email profile →SOCMINT →Link analysis →Correlate →

Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook