AlienVault Open Threat Exchange

The AlienVault Open Threat Exchange Connector integrates with Swimlane to allow retrieving data about Domains, Hashes, IPs, Pulse Indicators, and URLs.

Prerequisites

In order to use this connector, you will need an AlienVault OTX API Key. In order to acquire an OTX API key, you will need to register an account at https://otx.alienvault.com/. You should be able to to find your OTX key under your account settings after signing up.

Capabilities

The AlienVault Open Threat Exchange Connector has the following capabilities:

Get Domain

Get Hash

Get IP

Get Pulse Indicators

Get URL

Additional Documentation

AlienVault Open Threat Exchange Connector Documentation

AlienVault Open Threat Exchange API Documentation

AlienVault Open Threat Exchange Authentication Guide

Configurations

API Key Authentication

Authenticates using an API Key

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
X-OTX-API-KEY	API key	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Get Domain Indicators

Endpoint

URL: api/v1/indicators/domain/{{domain}}/{{section}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.domain	string	Required	Parameters for the Get Domain Indicators action
path_parameters.section	string	Required	Parameters for the Get Domain Indicators action

Input Example

{"path_parameters":{"domain":"swimlane.com","section":"general"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
sections	array	Output field: sections
whois	string	Output field: whois
alexa	string	Output field: alexa
indicator	string	Output field: indicator
type	string	Type of the resource
type_title	string	Type of the resource
validation	array	Unique identifier
validation.file_name	string	Unique identifier
validation.file	string	Unique identifier
base_indicator	object	Output field: base_indicator
pulse_info	object	Output field: pulse_info
pulse_info.count	number	Count value
pulse_info.pulses	array	Output field: pulse_info.pulses
pulse_info.pulses.file_name	string	Name of the resource
pulse_info.pulses.file	string	Output field: pulse_info.pulses.file
pulse_info.references	array	Output field: pulse_info.references
pulse_info.references.file_name	string	Name of the resource
pulse_info.references.file	string	Output field: pulse_info.references.file
pulse_info.related	object	Output field: pulse_info.related
pulse_info.related.alienvault	object	Output field: pulse_info.related.alienvault
pulse_info.related.alienvault.adversary	array	Output field: pulse_info.related.alienvault.adversary
pulse_info.related.alienvault.adversary.file_name	string	Name of the resource
pulse_info.related.alienvault.adversary.file	string	Output field: pulse_info.related.alienvault.adversary.file

Output Example

{"status_code":200,"response_headers":{"Content-Type":"application/json","Content-Length":"268","Connection":"keep-alive","Date":"Fri, 06 Jan 2023 00:27:24 GMT","Server":"gunicorn","Cache-Control":"max-age=0","X-Frame-Options":"SAMEORIGIN","X-Remote-User-Name":"swimlane_dev","X-OTX-ACTIVE":"1","Content-Encoding":"gzip","Access-Control-Allow-Origin":"*","Vary":"Accept-Encoding","X-Cache":"Miss from cloudfront","Via":"1.1 e074760d97af50b62db843a4057448cc.cloudfront.net (CloudFront)","X-Amz-Cf-Pop"...

Get File Hash Indicators

Endpoint

URL: api/v1/indicators/file/{{file_hash}}/{{section}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.file_hash	string	Required	Parameters for the Get File Hash Indicators action
path_parameters.section	string	Required	Parameters for the Get File Hash Indicators action

Input Example

{"path_parameters":{"file_hash":"6c5360d41bd2b14b1565f5b18e5c203cf512e493","section":"general"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
sections	array	Output field: sections
type	string	Type of the resource
type_title	string	Type of the resource
indicator	string	Output field: indicator
validation	array	Unique identifier
validation.file_name	string	Unique identifier
validation.file	string	Unique identifier
base_indicator	object	Output field: base_indicator
base_indicator.id	number	Unique identifier
base_indicator.indicator	string	Output field: base_indicator.indicator
base_indicator.type	string	Type of the resource
base_indicator.title	string	Output field: base_indicator.title
base_indicator.description	string	Output field: base_indicator.description
base_indicator.content	string	Response content
base_indicator.access_type	string	Type of the resource
base_indicator.access_reason	string	Response reason phrase
pulse_info	object	Output field: pulse_info
pulse_info.count	number	Count value
pulse_info.pulses	array	Output field: pulse_info.pulses
pulse_info.pulses.file_name	string	Name of the resource
pulse_info.pulses.file	string	Output field: pulse_info.pulses.file
pulse_info.references	array	Output field: pulse_info.references
pulse_info.references.file_name	string	Name of the resource

Output Example

{"status_code":200,"response_headers":{"Content-Type":"application/json","Content-Length":"323","Connection":"keep-alive","Date":"Mon, 09 Jan 2023 23:40:19 GMT","Server":"gunicorn","Cache-Control":"max-age=0","X-Frame-Options":"SAMEORIGIN","X-Remote-User-Name":"swimlane_dev","X-OTX-ACTIVE":"1","Content-Encoding":"gzip","Access-Control-Allow-Origin":"*","Vary":"Accept-Encoding","X-Cache":"Miss from cloudfront","Via":"1.1 021fce58f4d2d5cc960cb6a0e0c04fc0.cloudfront.net (CloudFront)","X-Amz-Cf-Pop"...

Get IPV4 Indicators

Endpoint

URL: api/v1/indicators/IPv4/{{ip}}/{{section}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.ip	string	Required	Parameters for the Get IPV4 Indicators action
path_parameters.section	string	Required	Parameters for the Get IPV4 Indicators action

Input Example

{"path_parameters":{"ip":"8.8.8.8","section":"general"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
whois	string	Output field: whois
reputation	number	Output field: reputation
indicator	string	Output field: indicator
type	string	Type of the resource
type_title	string	Type of the resource
base_indicator	object	Output field: base_indicator
base_indicator.id	number	Unique identifier
base_indicator.indicator	string	Output field: base_indicator.indicator
base_indicator.type	string	Type of the resource
base_indicator.title	string	Output field: base_indicator.title
base_indicator.description	string	Output field: base_indicator.description
base_indicator.content	string	Response content
base_indicator.access_type	string	Type of the resource
base_indicator.access_reason	string	Response reason phrase
pulse_info	object	Output field: pulse_info
pulse_info.count	number	Count value
pulse_info.pulses	array	Output field: pulse_info.pulses
pulse_info.pulses.file_name	string	Name of the resource
pulse_info.pulses.file	string	Output field: pulse_info.pulses.file
pulse_info.references	array	Output field: pulse_info.references
pulse_info.references.file_name	string	Name of the resource
pulse_info.references.file	string	Output field: pulse_info.references.file
pulse_info.related	object	Output field: pulse_info.related

Output Example

{"status_code":200,"response_headers":{"Content-Type":"application/json","Content-Length":"646","Connection":"keep-alive","Date":"Mon, 09 Jan 2023 23:41:34 GMT","Server":"gunicorn","Cache-Control":"max-age=0","X-Frame-Options":"SAMEORIGIN","X-Remote-User-Name":"swimlane_dev","X-OTX-ACTIVE":"1","Content-Encoding":"gzip","Access-Control-Allow-Origin":"*","Vary":"Accept-Encoding","X-Cache":"Miss from cloudfront","Via":"1.1 804a8375579a9f838ab10ed130908180.cloudfront.net (CloudFront)","X-Amz-Cf-Pop"...

Get IPV6 Indicators

Endpoint

URL: api/v1/indicators/IPv6/{{ip}}/{{section}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.ip	string	Required	Parameters for the Get IPV6 Indicators action
path_parameters.section	string	Required	Parameters for the Get IPV6 Indicators action

Input Example

{"path_parameters":{"ip":"0000:0000:0000:0000:0000:ffff:0808:0808","section":"general"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
whois	string	Output field: whois
reputation	number	Output field: reputation
indicator	string	Output field: indicator
type	string	Type of the resource
type_title	string	Type of the resource
base_indicator	object	Output field: base_indicator
pulse_info	object	Output field: pulse_info
pulse_info.count	number	Count value
pulse_info.pulses	array	Output field: pulse_info.pulses
pulse_info.pulses.file_name	string	Name of the resource
pulse_info.pulses.file	string	Output field: pulse_info.pulses.file
pulse_info.references	array	Output field: pulse_info.references
pulse_info.references.file_name	string	Name of the resource
pulse_info.references.file	string	Output field: pulse_info.references.file
pulse_info.related	object	Output field: pulse_info.related
pulse_info.related.alienvault	object	Output field: pulse_info.related.alienvault
pulse_info.related.alienvault.adversary	array	Output field: pulse_info.related.alienvault.adversary
pulse_info.related.alienvault.adversary.file_name	string	Name of the resource
pulse_info.related.alienvault.adversary.file	string	Output field: pulse_info.related.alienvault.adversary.file
pulse_info.related.alienvault.malware_families	array	Output field: pulse_info.related.alienvault.malware_families
pulse_info.related.alienvault.malware_families.file_name	string	Name of the resource
pulse_info.related.alienvault.malware_families.file	string	Output field: pulse_info.related.alienvault.malware_families.file
pulse_info.related.alienvault.industries	array	Output field: pulse_info.related.alienvault.industries

Output Example

{"status_code":200,"response_headers":{"Content-Type":"application/json","Content-Length":"458","Connection":"keep-alive","Date":"Mon, 09 Jan 2023 23:42:33 GMT","Server":"gunicorn","Cache-Control":"max-age=0","X-Frame-Options":"SAMEORIGIN","X-Remote-User-Name":"swimlane_dev","X-OTX-ACTIVE":"1","Content-Encoding":"gzip","Access-Control-Allow-Origin":"*","Vary":"Accept-Encoding","X-Cache":"Miss from cloudfront","Via":"1.1 e074760d97af50b62db843a4057448cc.cloudfront.net (CloudFront)","X-Amz-Cf-Pop"...

Get Pulse Indicators

Endpoint

URL: api/v1/pulses/{{pulse_id}}/indicators

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.pulse_id	string	Required	Parameters for the Get Pulse Indicators action

Input Example

{"path_parameters":{"pulse_id":"57204e9b3c4c3e015d93cb12"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
results	array	Result of the operation
results.pulse_key	string	Result of the operation
results.id	number	Unique identifier
results.indicator	string	Result of the operation
results.type	string	Type of the resource
results.created	string	Result of the operation
results.content	string	Response content
results.title	string	Result of the operation
results.description	string	Result of the operation
results.expiration	object	Result of the operation
results.is_active	number	Result of the operation
results.false_positive	object	Result of the operation
results.false_positive.assessment	object	Result of the operation
results.false_positive.assessment_date	object	Result of the operation
results.false_positive.report_date	object	Result of the operation
results.slug	string	Result of the operation
count	number	Count value
previous	object	Output field: previous
next	object	Output field: next

Output Example

{"status_code":200,"response_headers":{"Content-Type":"application/json","Content-Length":"633","Connection":"keep-alive","Date":"Fri, 06 Jan 2023 00:23:30 GMT","Server":"gunicorn","Content-Encoding":"gzip","X-Frame-Options":"SAMEORIGIN","X-Remote-User-Name":"swimlane_dev","X-OTX-ACTIVE":"1","Access-Control-Allow-Origin":"*","Vary":"Accept-Encoding","X-Cache":"Miss from cloudfront","Via":"1.1 3cf6fe633fae664d54600fda39cf3e78.cloudfront.net (CloudFront)","X-Amz-Cf-Pop":"FOR50-P3","X-Amz-Cf-Id":"8...

Get URL Indicators

Endpoint

URL: api/v1/indicators/url/{{url}}/{{section}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.url	string	Required	Parameters for the Get URL Indicators action
path_parameters.section	string	Required	Parameters for the Get URL Indicators action

Input Example

{"path_parameters":{"url":"http://www.fotoidea.com/sport/4x4_san_ponso/slides/IMG_0068.html","section":"general"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
sections	array	Output field: sections
indicator	string	Output field: indicator
type	string	Type of the resource
type_title	string	Type of the resource
validation	array	Unique identifier
validation.file_name	string	Unique identifier
validation.file	string	Unique identifier
base_indicator	object	Output field: base_indicator
base_indicator.id	number	Unique identifier
base_indicator.indicator	string	Output field: base_indicator.indicator
base_indicator.type	string	Type of the resource
base_indicator.title	string	Output field: base_indicator.title
base_indicator.description	string	Output field: base_indicator.description
base_indicator.content	string	Response content
base_indicator.access_type	string	Type of the resource
base_indicator.access_reason	string	Response reason phrase
pulse_info	object	Output field: pulse_info
pulse_info.count	number	Count value
pulse_info.pulses	array	Output field: pulse_info.pulses
pulse_info.pulses.file_name	string	Name of the resource
pulse_info.pulses.file	string	Output field: pulse_info.pulses.file
pulse_info.references	array	Output field: pulse_info.references
pulse_info.references.file_name	string	Name of the resource

Output Example

{"status_code":200,"response_headers":{"Content-Type":"application/json","Content-Length":"375","Connection":"keep-alive","Date":"Fri, 06 Jan 2023 00:25:46 GMT","Server":"gunicorn","Cache-Control":"max-age=0","X-Frame-Options":"SAMEORIGIN","X-Remote-User-Name":"swimlane_dev","X-OTX-ACTIVE":"1","Content-Encoding":"gzip","Access-Control-Allow-Origin":"*","Vary":"Accept-Encoding","X-Cache":"Miss from cloudfront","Via":"1.1 021fce58f4d2d5cc960cb6a0e0c04fc0.cloudfront.net (CloudFront)","X-Amz-Cf-Pop"...

Response Headers

Header	Description	Example
Access-Control-Allow-Origin	HTTP response header: Access-Control-Allow-Origin	*
Cache-Control	Directives for caching mechanisms	max-age=0
Connection	HTTP response header: Connection	keep-alive
Content-Encoding	HTTP response header: Content-Encoding	gzip
Content-Length	The length of the response body in bytes	375
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Mon, 09 Jan 2023 23:40:19 GMT
Server	Information about the software used by the origin server	gunicorn
Vary	HTTP response header: Vary	Accept-Encoding
Via	HTTP response header: Via	1.1 804a8375579a9f838ab10ed130908180.cloudfront.net (CloudFront)
X-Amz-Cf-Id	HTTP response header: X-Amz-Cf-Id	r-BhM_yW66-BJWE4d7S-_c83xVUysFlrm9cDpXmZHf2mo0weHWeE1A==
X-Amz-Cf-Pop	HTTP response header: X-Amz-Cf-Pop	FOR50-P3
X-Cache	HTTP response header: X-Cache	Miss from cloudfront
X-Frame-Options	HTTP response header: X-Frame-Options	SAMEORIGIN
X-OTX-ACTIVE	HTTP response header: X-OTX-ACTIVE	1
X-Remote-User-Name	HTTP response header: X-Remote-User-Name	swimlane_dev