OTX DirectConnect API

https://otx.alienvault.com/api
Admin
OTX DirectConnect API enables synchronization of threat intelligence from AlienVault OTX to security...
Tokens:4,323
Snippets:27
Trust Score:10
Update:8 months ago
Show doc for...
Tokens:
Raw
### Python SDK Examples for OTX API

Source: https://otx.alienvault.com/api/index

This section highlights various Python integrations and SDK examples for the OTX API, demonstrating how to leverage OTX threat intelligence within different platforms and tools.

```Python
# Example: OpenCTI Connector
# Imports OTX threat data into the OpenCTI platform

# Example: MISP Importer
# Imports pulses into a MISP instance

# Example: Splunk Importer Tutorial
# Splunk and Sysmon via a CSV export

# Example: Bro Importer
# Integrate Bro with LevelBlue Labs OTX

# Example: OTX 2 CRITS
# Imports pulses into CRITS

# Example: The Hive
# Incident Response Platform

# Example: Maltego Transform
# A local Maltego transform

# Example: Signature Base
# Downloads indicators into a CSV file for Loki and Spark

# Example: SDK Examples
# Trivial examples included with the OTX SDK

# Example: HostIntel
# Collects various intelligence sources for hosts

# Example: IntelMQ
# Collects and processes security feeds using a message queuing protocol

# Example: FileIntel
# Collects various intelligence sources for a given file

# Example: CTI Toolbox

# Example: GoatRider
# Pulls down threat intelligence from a number of sources

# Example: ArcReactor
# Collects OSINT for SIEMs

# Example: OTX MISP
# Imports pulses into MISP

# Example: Splunk APP

# Example: RITAA
# Graylog matching

# Example: OTX Siphon
# Pulls subscribed indicators into to a csv file.

```

--------------------------------

### Discover TAXII Services with cabby (Local)

Source: https://otx.alienvault.com/api/index

Illustrates how to discover OTX TAXII services using a locally installed cabby instance. This command interacts with the TAXII discovery endpoint to list available services and their configurations.

```bash
taxii-discovery --path https://otx.alienvault.com/taxii/discovery
```

--------------------------------

### OTX TAXII Service Discovery Output

Source: https://otx.alienvault.com/api/index

This is an example output from the `taxii-discovery` command, detailing the available TAXII services (POLL, COLLECTION_MANAGEMENT, DISCOVERY) provided by OTX, including their versions, protocol bindings, addresses, and message bindings.

```text
=== Service Instance ===
  Service Type: POLL
  Service Version: urn:taxii.mitre.org:services:1.1
  Protocol Binding: urn:taxii.mitre.org:protocol:https:1.0
  Service Address: https://otx.alienvault.com/taxii/poll
  Message Binding: urn:taxii.mitre.org:message:xml:1.1
  Available: True
  Message: OTX Taxii Polling

=== Service Instance ===
  Service Type: COLLECTION_MANAGEMENT
  Service Version: urn:taxii.mitre.org:services:1.1
  Protocol Binding: urn:taxii.mitre.org:protocol:https:1.0
  Service Address: https://otx.alienvault.com/taxii/collections
  Message Binding: urn:taxii.mitre.org:message:xml:1.1
  Available: True
  Message: OTX Taxii Collections

=== Service Instance ===
  Service Type: DISCOVERY
  Service Version: urn:taxii.mitre.org:services:1.1
  Protocol Binding: urn:taxii.mitre.org:protocol:https:1.0
  Service Address: https://otx.alienvault.com/taxii/discovery
  Message Binding: urn:taxii.mitre.org:message:xml:1.1
  Available: True
  Message: OTX Taxii Discovery
```

--------------------------------

### Poll TAXII Collection for Data

Source: https://otx.alienvault.com/api/index

The `taxii-poll` program retrieves data from a specified TAXII collection. This example fetches the first page of results from the 'user_LevelBlue' feed starting from a specific date and time.

```bash
taxii-poll --path https://otx.alienvault.com/taxii/poll --collection user_LevelBlue \
    --username MY_OTX_API_KEY_HERE --password foo --begin 2017-04-15T00:00:00
```

--------------------------------

### OTX DirectConnect API - Get Subscribed Pulses

Source: https://otx.alienvault.com/api/index

This endpoint allows you to retrieve subscribed pulses from OTX. It supports pagination.

```APIDOC
## GET /api/v1/pulses/subscribed

### Description
Retrieves a paginated list of pulses that the authenticated user is subscribed to.

### Method
GET

### Endpoint
/api/v1/pulses/subscribed

### Parameters
#### Query Parameters
- **page** (integer) - Optional - The page number of results to retrieve.

#### Headers
- **X-OTX-API-KEY** (string) - Required - Your OTX API key for authentication.

### Request Example
```bash
curl "https://otx.alienvault.com/api/v1/pulses/subscribed?page=1" \
  -H "X-OTX-API-KEY: <INSERT_USER_API_KEY>"
```

### Response
#### Success Response (200)
- **list** (array) - A list of pulse objects.
- **next** (string) - URL for the next page of results, if available.
- **prev** (string) - URL for the previous page of results, if available.
- **count** (integer) - The total number of pulses available.
- **next_url** (string) - The URL for the next page of results.
- **url** (string) - The URL for the current page of results.

#### Response Example
```json
{
  "list": [
    {
      "id": "60e8b3b3a1b2c3d4e5f6a7b8",
      "name": "Example Pulse",
      "description": "This is an example pulse.",
      "author_name": "Example User",
      "created": "2023-10-27T10:00:00Z",
      "modified": "2023-10-27T10:00:00Z",
      "tags": ["malware", "exploit"],
      "is_private": false,
      "subscriber_count": 100
    }
  ],
  "next": null,
  "prev": null,
  "count": 1,
  "next_url": null,
  "url": "/api/v1/pulses/subscribed?page=1"
}
```
```

--------------------------------

### Discover TAXII Services with cabby (Docker)

Source: https://otx.alienvault.com/api/index

Demonstrates how to use the cabby tool within a Docker container to discover available TAXII services provided by OTX. This helps in understanding the TAXII endpoint configurations.

```bash
docker run --rm=true eclecticiq/cabby:latest taxii-discovery --path https://otx.alienvault.com/taxii/discovery
```

--------------------------------

### Go Client for OTX API

Source: https://otx.alienvault.com/api/index

This section mentions a client library for the OTX API developed in Go.

```Go
// Example: Go Client
// Client for GO

```

--------------------------------

### List Available TAXII Collections

Source: https://otx.alienvault.com/api/index

The `taxii-collections` program lists available TAXII collections. User-specific collections require authentication with an OTX API key as the username. Public collections are shown if no username is provided.

```bash
$ taxii-collections --path https://otx.alienvault.com/taxii/collections --username MY_OTX_API_KEY_HERE --password foo

2017-04-25 14:53:42,286 INFO: Sending Collection_Information_Request to https://otx.alienvault.com/taxii/collections
=== Data Collection Information ===
Collection Name: user_LevelBlue
Collection Type: DATA_FEED
Available: True
Collection Description: Data feed for user: LevelBlue
Supported Content: All
=== Polling Service Instance ===
Poll Protocol: urn:taxii.mitre.org:protocol:https:1.0
Poll Address: https://otx.alienvault.com/taxii/poll
Message Binding: urn:taxii.mitre.org:message:xml:1.1
==================================

=== Data Collection Information ===
Collection Name: group_999
Collection Type: DATA_FEED
Available: True
Collection Description: Data feed for group: id=999 name=Secret Group #1
Supported Content: All
=== Polling Service Instance ===
Poll Protocol: urn:taxii.mitre.org:protocol:https:1.0
Poll Address: https://otx.alienvault.com/taxii/poll
Message Binding: urn:taxii.mitre.org:message:xml:1.1
==================================

=== Data Collection Information ===
Collection Name: group_1000
Collection Type: DATA_FEED
Available: True
Collection Description: Data feed for group: id=18 name=My Malware Group
Supported Content: All
=== Polling Service Instance ===
Poll Protocol: urn:taxii.mitre.org:protocol:https:1.0
Poll Address: https://otx.alienvault.com/taxii/poll
Message Binding: urn:taxii.mitre.org:message:xml:1.1
==================================
```

--------------------------------

### Access OTX API via CLI

Source: https://otx.alienvault.com/api/index

This snippet shows how to access the OTX API using a curl command. It requires an API key for authentication and allows fetching subscribed pulses.

```bash
curl /api/v1/pulses/subscribed?page=1 -H "X-OTX-API-KEY: <INSERT_USER_API_KEY>"
```

--------------------------------

### Rust Bindings for OTX API

Source: https://otx.alienvault.com/api/index

This section lists bindings for the OTX API in the Rust programming language.

```Rust
// Example: Rust Bindings
// Bindings for Rust

```

--------------------------------

### Java Integrations for OTX API

Source: https://otx.alienvault.com/api/index

This section lists Java-based integrations for the OTX API, including a Graylog Importer and an Android Threat Scanner App.

```Java
// Example: Graylog Importer
// Threat Intelligence Plugin for Graylog

// Example: Threat Scanner App
// Android application

```

--------------------------------

### Ruby Wrapper for OTX API

Source: https://otx.alienvault.com/api/index

This section mentions a Ruby Gem that acts as a wrapper for the OTX API.

```Ruby
// Example: Ruby Wrapper
// Rubey Gem

```

--------------------------------

### PowerShell API for OTX

Source: https://otx.alienvault.com/api/index

This PowerShell script demonstrates pulling all LevelBlue indicators and exporting them to CSV files, utilizing the OTX API.

```PowerShell
# Example: PowerShell API for OTX
# Pulling all LevelBlue indicators and exporting to CSVs

```

--------------------------------

### Node.js SDK and Integrations for OTX API

Source: https://otx.alienvault.com/api/index

This section includes Node.js based integrations for the OTX API, such as a general Node SDK and a Brocade Firewall Update integration.

```Node.js
// Example: Node SDK

// Example: Brocade Firewall Update

```

--------------------------------

### F# Honeypot Pulse Creator for OTX API

Source: https://otx.alienvault.com/api/index

This section mentions 'BurningDogs', an F# application for creating honeypot pulses, likely interacting with the OTX API.

```F#
// Example: BurningDogs
// Honeypot Pulse Creator

```

--------------------------------

### JavaScript Chrome Extension for OTX API

Source: https://otx.alienvault.com/api/index

This section lists a Chrome extension called 'ThreatPinch' that utilizes JavaScript for interacting with OTX data.

```Javascript
// Example: ThreatPinch
// Chrome extension

```

--------------------------------

### OTX DirectConnect API - TAXII Server Details

Source: https://otx.alienvault.com/api/index

Information on how to connect to the OTX TAXII server to consume STIX/TAXII feeds.

```APIDOC
## OTX TAXII Server Configuration

### Description
OTX can function as a TAXII server, allowing you to consume threat intelligence feeds using any compatible TAXII client. The following details are required for configuration.

### Method
N/A (Configuration details)

### Endpoint
N/A

### Parameters
#### TAXII Client Configuration
- **Discovery URL** (string) - Required - `https://otx.alienvault.com/taxii/discovery`
- **Username** (string) - Required - Your OTX API key.
- **Password** (string) - Ignored - Any value can be provided.

### Request Example
N/A

### Response
N/A

### Testing / Exploration with `cabby`

#### Discovery
To discover available TAXII services:
```bash
taxii-discovery --path https://otx.alienvault.com/taxii/discovery
```

**Example Output:**
```
=== Service Instance ===
  Service Type: POLL
  Service Version: urn:taxii.mitre.org:services:1.1
  Protocol Binding: urn:taxii.mitre.org:protocol:https:1.0
  Service Address: https://otx.alienvault.com/taxii/poll
  Message Binding: urn:taxii.mitre.org:message:xml:1.1
  Available: True
  Message: OTX Taxii Polling

=== Service Instance ===
  Service Type: COLLECTION_MANAGEMENT
  Service Version: urn:taxii.mitre.org:services:1.1
  Protocol Binding: urn:taxii.mitre.org:protocol:https:1.0
  Service Address: https://otx.alienvault.com/taxii/collections
  Message Binding: urn:taxii.mitre.org:message:xml:1.1
  Available: True
  Message: OTX Taxii Collections

=== Service Instance ===
  Service Type: DISCOVERY
  Service Version: urn:taxii.mitre.org:services:1.1
  Protocol Binding: urn:taxii.mitre.org:protocol:https:1.0
  Service Address: https://otx.alienvault.com/taxii/discovery
  Message Binding: urn:taxii.mitre.org:message:xml:1.1
  Available: True
  Message: OTX Taxii Discovery
```
```

--------------------------------

### TAXII Collections API

Source: https://otx.alienvault.com/api/index

Lists available threat intelligence collections. Authentication with an OTX API key as username provides access to personal collections.

```APIDOC
## GET /taxii/collections

### Description
Retrieves a list of available TAXII collections. Access to collections may vary based on user permissions. Public collections are available without authentication. To access personal collections, use your OTX API key as the username.

### Method
GET

### Endpoint
https://otx.alienvault.com/taxii/collections

### Parameters
#### Query Parameters
- **username** (string) - Optional - Your OTX API key to access personal collections.
- **password** (string) - Optional - Any value can be used as a password when using the API key.

### Request Example
```bash
taxii-collections --path https://otx.alienvault.com/taxii/collections --username MY_OTX_API_KEY_HERE --password foo
```

### Response
#### Success Response (200)
- **Collection Name** (string) - The name of the collection.
- **Collection Type** (string) - The type of the collection (e.g., DATA_FEED).
- **Available** (boolean) - Indicates if the collection is currently available.
- **Collection Description** (string) - A description of the collection.
- **Supported Content** (string) - The type of content supported by the collection.
- **Polling Service Instance** (object) - Details about the polling service for the collection.
  - **Poll Protocol** (string) - The protocol used for polling.
  - **Poll Address** (string) - The endpoint URL for polling.
  - **Message Binding** (string) - The message binding used for communication.

#### Response Example
```json
{
  "Collection Name": "user_LevelBlue",
  "Collection Type": "DATA_FEED",
  "Available": true,
  "Collection Description": "Data feed for user: LevelBlue",
  "Supported Content": "All",
  "Polling Service Instance": {
    "Poll Protocol": "urn:taxii.mitre.org:protocol:https:1.0",
    "Poll Address": "https://otx.alienvault.com/taxii/poll",
    "Message Binding": "urn:taxii.mitre.org:message:xml:1.1"
  }
}
```
```

--------------------------------

### TAXII Poll API

Source: https://otx.alienvault.com/api/index

Polls a specific TAXII collection to retrieve threat intelligence data. Allows filtering by date range.

```APIDOC
## GET /taxii/poll

### Description
Polls a specified TAXII collection to retrieve threat intelligence data. This endpoint is useful for verifying collection feeds and retrieving data within a given timeframe.

### Method
GET

### Endpoint
https://otx.alienvault.com/taxii/poll

### Parameters
#### Query Parameters
- **collection** (string) - Required - The name of the collection to poll.
- **username** (string) - Required - Your OTX API key for authentication.
- **password** (string) - Optional - Any value can be used as a password when using the API key.
- **begin** (string) - Optional - The start date and time for the poll in ISO 8601 format (e.g., '2017-04-15T00:00:00').
- **end** (string) - Optional - The end date and time for the poll in ISO 8601 format.

### Request Example
```bash
taxii-poll --path https://otx.alienvault.com/taxii/poll --collection user_LevelBlue --username MY_OTX_API_KEY_HERE --password foo --begin 2017-04-15T00:00:00
```

### Response
#### Success Response (200)
The response will contain the raw threat intelligence data from the specified collection and time range. The exact format depends on the collection's supported content.

#### Response Example
(Response content is raw data and not included here for brevity)
```
Tokens:
Raw