AlienVault Open Threat Exchange (OTX)

Overview

AlienVault OTX is a community threat-intelligence platform — pulses (threat summaries), indicators of compromise (IPs, domains, hashes, URLs), and malware samples shared by security researchers worldwide. The API requires a free OTX key.

Note (verified 2026-08): the service responds (a request without the right endpoint returned 404 “endpoint not found” — the API is alive but requires the v1 endpoints with a key).

Quick Start

Get an OTX key (free account at otx.alienvault.com) then (replace YOUR_KEY):

# Subscribed pulses (the main feed):
curl "https://otx.alienvault.com/api/v1/pulses/subscribed?limit=10" \
  -H "X-OTX-API-KEY: YOUR_KEY"

Indicator lookup (IP):

curl "https://otx.alienvault.com/api/v1/indicators/IPv4/8.8.8.8/general" \
  -H "X-OTX-API-KEY: YOUR_KEY"

A pulse’s details:

curl "https://otx.alienvault.com/api/v1/pulses/PULSE_ID" \
  -H "X-OTX-API-KEY: YOUR_KEY"

Authentication

• Register a free account at otx.alienvault.com → your API key is on the account settings page.
• Send it as the X-OTX-API-KEY header.

Rate Limits & Notes

• Free tier: community account limits (roughly a few hundred requests/day); paid tiers scale.
• Endpoints: /api/v1/pulses/{id}, /api/v1/indicators/{type}/{value}/general, /api/v1/indicators/{type}/{value}/pulses, malware samples, and more.
• Indicator types: IPv4, domain, hostname, file (hash), URL.
• Pulses are community-curated threat summaries with linked indicators — good for enrichment.

FAQ

Is OTX free? Free community account with per-day limits; paid tiers scale.

How do I get a key? Register at otx.alienvault.com — the key is in your account settings.

What data is available? Threat pulses, indicators (IPs/domains/hashes/URLs), and malware samples.