AlienVault OTX

AlienVault OTX Transforms for Maltego

Traditional threat-sharing model is a one-way communication between researchers/vendors and subscribers. Subscribers cannot interact with peers or threat researchers on emerging threats, as each recipient is isolated from one another. Open Threat Exchange (OTX) solves this problem by enabling everyone and anyone to create, collaborate, and consume threat data.

Founded by AlienVault (now AT&T Cybersecurity), it is the largest open threat intelligence community that’s 100% free, enabling collaborative defense with actionable, community-powered threat data. It provides an opportunity to, share the latest information about emerging threats, attack methods, and malicious actors, promoting greater security across the entire community.

Via OTX, more than 100,000 participants from 140 countries contribute over 19 million threat indicators daily.

OTX Pulses provide a summary of the threat, a view into the software targeted, and the related indicators of compromise (IOC) that can be used to detect the threats. The Pulses make it easier to answer questions around a threat such as ‘‘Is my environment exposed to this threat?'', ‘‘Is this relevant to my organization?’’ etc. .

Maltego AlienVault OTX Transforms bring AT&T’s Open Threat Exchange integration to Maltego. These new Transforms in Maltego allow users to harness OTX power for free and query threat intelligence using Maltego.

Kindly note that for Pulse lookups, an AlientVault API key is required. Sign up here to get your free API key.

Integration Benefits

• Query and browse free threat intelligence from over 19 million threat indicators contributed daily.
• Easily visualize AlienVault OTX Pulses, related IOCs & other infrastructure data such as IP Addresses, Domains, Hostnames (subdomains), Email, URL/URI, File Hashes: MD5, SHA1, SHA256, PEHASH, IMPHASH, CIDR Rules, File Paths, MUTEX name, CVE number
• Gain a comprehensive perspective of investigations by pivoting across other disparate data sources available on the Transform Hub, all in one single UI

Typical Users of This Data

• Threat Intelligence Teams
• Cyber Analysts
• Trust and Safety Teams
• Government Agencies