--- title: AlienVault Open Threat Exchange slug: connectors/alienvault-open-threat-exchange docTags: createdAt: 2026-06-09T16:30:23.073Z --- The AlienVault Open Threat Exchange Connector integrates with Swimlane to allow retrieving data about Domains, Hashes, IPs, Pulse Indicators, and URLs. ## Prerequisites In order to use this connector, you will need an AlienVault OTX API Key. In order to acquire an OTX API key, you will need to register an account at [https://otx.alienvault.com/](https://otx.alienvault.com/). You should be able to to find your OTX key under your account settings after signing up. ## Capabilities The AlienVault Open Threat Exchange Connector has the following capabilities: - Get Domain - Get Hash - Get IP - Get Pulse Indicators - Get URL ## Additional Documentation - [AlienVault Open Threat Exchange Connector Documentation](https://docs.swimlane.com/connectors/alienvault-open-threat-exchange) - [AlienVault Open Threat Exchange API Documentation](https://otx.alienvault.com/api) - [AlienVault Open Threat Exchange Authentication Guide](https://docs.swimlane.com/authentication-guides/alienvault-open-threat-exchange) # Configurations ## API Key Authentication Authenticates using an API Key ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | X-OTX-API-KEY | API key | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Get Domain Indicators Get Domain Indicators ### Endpoint - **URL:** `api/v1/indicators/domain/{{domain}}/{{section}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ----------------------------------------------- | | `path_parameters.domain` | string | Required | Parameters for the Get Domain Indicators action | | `path_parameters.section` | string | Required | Parameters for the Get Domain Indicators action | ### Input Example `{"path_parameters":{"domain":"swimlane.com","section":"general"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------------------- | -------- | ----------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `sections` | array | Output field: sections | | `whois` | string | Output field: whois | | `alexa` | string | Output field: alexa | | `indicator` | string | Output field: indicator | | `type` | string | Type of the resource | | `type_title` | string | Type of the resource | | `validation` | array | Unique identifier | | `validation.file_name` | string | Unique identifier | | `validation.file` | string | Unique identifier | | `base_indicator` | object | Output field: base\_indicator | | `pulse_info` | object | Output field: pulse\_info | | `pulse_info.count` | number | Count value | | `pulse_info.pulses` | array | Output field: pulse\_info.pulses | | `pulse_info.pulses.file_name` | string | Name of the resource | | `pulse_info.pulses.file` | string | Output field: pulse\_info.pulses.file | | `pulse_info.references` | array | Output field: pulse\_info.references | | `pulse_info.references.file_name` | string | Name of the resource | | `pulse_info.references.file` | string | Output field: pulse\_info.references.file | | `pulse_info.related` | object | Output field: pulse\_info.related | | `pulse_info.related.alienvault` | object | Output field: pulse\_info.related.alienvault | | `pulse_info.related.alienvault.adversary` | array | Output field: pulse\_info.related.alienvault.adversary | | `pulse_info.related.alienvault.adversary.file_name` | string | Name of the resource | | `pulse_info.related.alienvault.adversary.file` | string | Output field: pulse\_info.related.alienvault.adversary.file | ### Output Example `{"status_code":200,"response_headers":{"Content-Type":"application/json","Content-Length":"268","Connection":"keep-alive","Date":"Fri, 06 Jan 2023 00:27:24 GMT","Server":"gunicorn","Cache-Control":"max-age=0","X-Frame-Options":"SAMEORIGIN","X-Remote-User-Name":"swimlane_dev","X-OTX-ACTIVE":"1","Content-Encoding":"gzip","Access-Control-Allow-Origin":"*","Vary":"Accept-Encoding","X-Cache":"Miss from cloudfront","Via":"1.1 e074760d97af50b62db843a4057448cc.cloudfront.net (CloudFront)","X-Amz-Cf-Pop"...` ## Get File Hash Indicators Get File Hash Indicators ### Endpoint - **URL:** `api/v1/indicators/file/{{file_hash}}/{{section}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | -------------------------------------------------- | | `path_parameters.file_hash` | string | Required | Parameters for the Get File Hash Indicators action | | `path_parameters.section` | string | Required | Parameters for the Get File Hash Indicators action | ### Input Example `{"path_parameters":{"file_hash":"6c5360d41bd2b14b1565f5b18e5c203cf512e493","section":"general"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------- | -------- | ----------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `sections` | array | Output field: sections | | `type` | string | Type of the resource | | `type_title` | string | Type of the resource | | `indicator` | string | Output field: indicator | | `validation` | array | Unique identifier | | `validation.file_name` | string | Unique identifier | | `validation.file` | string | Unique identifier | | `base_indicator` | object | Output field: base\_indicator | | `base_indicator.id` | number | Unique identifier | | `base_indicator.indicator` | string | Output field: base\_indicator.indicator | | `base_indicator.type` | string | Type of the resource | | `base_indicator.title` | string | Output field: base\_indicator.title | | `base_indicator.description` | string | Output field: base\_indicator.description | | `base_indicator.content` | string | Response content | | `base_indicator.access_type` | string | Type of the resource | | `base_indicator.access_reason` | string | Response reason phrase | | `pulse_info` | object | Output field: pulse\_info | | `pulse_info.count` | number | Count value | | `pulse_info.pulses` | array | Output field: pulse\_info.pulses | | `pulse_info.pulses.file_name` | string | Name of the resource | | `pulse_info.pulses.file` | string | Output field: pulse\_info.pulses.file | | `pulse_info.references` | array | Output field: pulse\_info.references | | `pulse_info.references.file_name` | string | Name of the resource | ### Output Example `{"status_code":200,"response_headers":{"Content-Type":"application/json","Content-Length":"323","Connection":"keep-alive","Date":"Mon, 09 Jan 2023 23:40:19 GMT","Server":"gunicorn","Cache-Control":"max-age=0","X-Frame-Options":"SAMEORIGIN","X-Remote-User-Name":"swimlane_dev","X-OTX-ACTIVE":"1","Content-Encoding":"gzip","Access-Control-Allow-Origin":"*","Vary":"Accept-Encoding","X-Cache":"Miss from cloudfront","Via":"1.1 021fce58f4d2d5cc960cb6a0e0c04fc0.cloudfront.net (CloudFront)","X-Amz-Cf-Pop"...` ## Get IPV4 Indicators Get IPV4 Indicators ### Endpoint - **URL:** `api/v1/indicators/IPv4/{{ip}}/{{section}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | --------------------------------------------- | | `path_parameters.ip` | string | Required | Parameters for the Get IPV4 Indicators action | | `path_parameters.section` | string | Required | Parameters for the Get IPV4 Indicators action | ### Input Example `{"path_parameters":{"ip":"8.8.8.8","section":"general"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------- | -------- | ----------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `whois` | string | Output field: whois | | `reputation` | number | Output field: reputation | | `indicator` | string | Output field: indicator | | `type` | string | Type of the resource | | `type_title` | string | Type of the resource | | `base_indicator` | object | Output field: base\_indicator | | `base_indicator.id` | number | Unique identifier | | `base_indicator.indicator` | string | Output field: base\_indicator.indicator | | `base_indicator.type` | string | Type of the resource | | `base_indicator.title` | string | Output field: base\_indicator.title | | `base_indicator.description` | string | Output field: base\_indicator.description | | `base_indicator.content` | string | Response content | | `base_indicator.access_type` | string | Type of the resource | | `base_indicator.access_reason` | string | Response reason phrase | | `pulse_info` | object | Output field: pulse\_info | | `pulse_info.count` | number | Count value | | `pulse_info.pulses` | array | Output field: pulse\_info.pulses | | `pulse_info.pulses.file_name` | string | Name of the resource | | `pulse_info.pulses.file` | string | Output field: pulse\_info.pulses.file | | `pulse_info.references` | array | Output field: pulse\_info.references | | `pulse_info.references.file_name` | string | Name of the resource | | `pulse_info.references.file` | string | Output field: pulse\_info.references.file | | `pulse_info.related` | object | Output field: pulse\_info.related | ### Output Example `{"status_code":200,"response_headers":{"Content-Type":"application/json","Content-Length":"646","Connection":"keep-alive","Date":"Mon, 09 Jan 2023 23:41:34 GMT","Server":"gunicorn","Cache-Control":"max-age=0","X-Frame-Options":"SAMEORIGIN","X-Remote-User-Name":"swimlane_dev","X-OTX-ACTIVE":"1","Content-Encoding":"gzip","Access-Control-Allow-Origin":"*","Vary":"Accept-Encoding","X-Cache":"Miss from cloudfront","Via":"1.1 804a8375579a9f838ab10ed130908180.cloudfront.net (CloudFront)","X-Amz-Cf-Pop"...` ## Get IPV6 Indicators Get IPV6 Indicators ### Endpoint - **URL:** `api/v1/indicators/IPv6/{{ip}}/{{section}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | --------------------------------------------- | | `path_parameters.ip` | string | Required | Parameters for the Get IPV6 Indicators action | | `path_parameters.section` | string | Required | Parameters for the Get IPV6 Indicators action | ### Input Example `{"path_parameters":{"ip":"0000:0000:0000:0000:0000:ffff:0808:0808","section":"general"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------------------------- | -------- | ------------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `whois` | string | Output field: whois | | `reputation` | number | Output field: reputation | | `indicator` | string | Output field: indicator | | `type` | string | Type of the resource | | `type_title` | string | Type of the resource | | `base_indicator` | object | Output field: base\_indicator | | `pulse_info` | object | Output field: pulse\_info | | `pulse_info.count` | number | Count value | | `pulse_info.pulses` | array | Output field: pulse\_info.pulses | | `pulse_info.pulses.file_name` | string | Name of the resource | | `pulse_info.pulses.file` | string | Output field: pulse\_info.pulses.file | | `pulse_info.references` | array | Output field: pulse\_info.references | | `pulse_info.references.file_name` | string | Name of the resource | | `pulse_info.references.file` | string | Output field: pulse\_info.references.file | | `pulse_info.related` | object | Output field: pulse\_info.related | | `pulse_info.related.alienvault` | object | Output field: pulse\_info.related.alienvault | | `pulse_info.related.alienvault.adversary` | array | Output field: pulse\_info.related.alienvault.adversary | | `pulse_info.related.alienvault.adversary.file_name` | string | Name of the resource | | `pulse_info.related.alienvault.adversary.file` | string | Output field: pulse\_info.related.alienvault.adversary.file | | `pulse_info.related.alienvault.malware_families` | array | Output field: pulse\_info.related.alienvault.malware\_families | | `pulse_info.related.alienvault.malware_families.file_name` | string | Name of the resource | | `pulse_info.related.alienvault.malware_families.file` | string | Output field: pulse\_info.related.alienvault.malware\_families.file | | `pulse_info.related.alienvault.industries` | array | Output field: pulse\_info.related.alienvault.industries | ### Output Example `{"status_code":200,"response_headers":{"Content-Type":"application/json","Content-Length":"458","Connection":"keep-alive","Date":"Mon, 09 Jan 2023 23:42:33 GMT","Server":"gunicorn","Cache-Control":"max-age=0","X-Frame-Options":"SAMEORIGIN","X-Remote-User-Name":"swimlane_dev","X-OTX-ACTIVE":"1","Content-Encoding":"gzip","Access-Control-Allow-Origin":"*","Vary":"Accept-Encoding","X-Cache":"Miss from cloudfront","Via":"1.1 e074760d97af50b62db843a4057448cc.cloudfront.net (CloudFront)","X-Amz-Cf-Pop"...` ## Get Pulse Indicators Get Pulse Indicators ### Endpoint - **URL:** `api/v1/pulses/{{pulse_id}}/indicators` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ---------------------------------------------- | | `path_parameters.pulse_id` | string | Required | Parameters for the Get Pulse Indicators action | ### Input Example `{"path_parameters":{"pulse_id":"57204e9b3c4c3e015d93cb12"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `results` | array | Result of the operation | | `results.pulse_key` | string | Result of the operation | | `results.id` | number | Unique identifier | | `results.indicator` | string | Result of the operation | | `results.type` | string | Type of the resource | | `results.created` | string | Result of the operation | | `results.content` | string | Response content | | `results.title` | string | Result of the operation | | `results.description` | string | Result of the operation | | `results.expiration` | object | Result of the operation | | `results.is_active` | number | Result of the operation | | `results.false_positive` | object | Result of the operation | | `results.false_positive.assessment` | object | Result of the operation | | `results.false_positive.assessment_date` | object | Result of the operation | | `results.false_positive.report_date` | object | Result of the operation | | `results.slug` | string | Result of the operation | | `count` | number | Count value | | `previous` | object | Output field: previous | | `next` | object | Output field: next | ### Output Example `{"status_code":200,"response_headers":{"Content-Type":"application/json","Content-Length":"633","Connection":"keep-alive","Date":"Fri, 06 Jan 2023 00:23:30 GMT","Server":"gunicorn","Content-Encoding":"gzip","X-Frame-Options":"SAMEORIGIN","X-Remote-User-Name":"swimlane_dev","X-OTX-ACTIVE":"1","Access-Control-Allow-Origin":"*","Vary":"Accept-Encoding","X-Cache":"Miss from cloudfront","Via":"1.1 3cf6fe633fae664d54600fda39cf3e78.cloudfront.net (CloudFront)","X-Amz-Cf-Pop":"FOR50-P3","X-Amz-Cf-Id":"8...` ## Get URL Indicators Get URL Indicators ### Endpoint - **URL:** `api/v1/indicators/url/{{url}}/{{section}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | -------------------------------------------- | | `path_parameters.url` | string | Required | Parameters for the Get URL Indicators action | | `path_parameters.section` | string | Required | Parameters for the Get URL Indicators action | ### Input Example `{"path_parameters":{"url":"http://www.fotoidea.com/sport/4x4_san_ponso/slides/IMG_0068.html","section":"general"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------- | -------- | ----------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `sections` | array | Output field: sections | | `indicator` | string | Output field: indicator | | `type` | string | Type of the resource | | `type_title` | string | Type of the resource | | `validation` | array | Unique identifier | | `validation.file_name` | string | Unique identifier | | `validation.file` | string | Unique identifier | | `base_indicator` | object | Output field: base\_indicator | | `base_indicator.id` | number | Unique identifier | | `base_indicator.indicator` | string | Output field: base\_indicator.indicator | | `base_indicator.type` | string | Type of the resource | | `base_indicator.title` | string | Output field: base\_indicator.title | | `base_indicator.description` | string | Output field: base\_indicator.description | | `base_indicator.content` | string | Response content | | `base_indicator.access_type` | string | Type of the resource | | `base_indicator.access_reason` | string | Response reason phrase | | `pulse_info` | object | Output field: pulse\_info | | `pulse_info.count` | number | Count value | | `pulse_info.pulses` | array | Output field: pulse\_info.pulses | | `pulse_info.pulses.file_name` | string | Name of the resource | | `pulse_info.pulses.file` | string | Output field: pulse\_info.pulses.file | | `pulse_info.references` | array | Output field: pulse\_info.references | | `pulse_info.references.file_name` | string | Name of the resource | ### Output Example `{"status_code":200,"response_headers":{"Content-Type":"application/json","Content-Length":"375","Connection":"keep-alive","Date":"Fri, 06 Jan 2023 00:25:46 GMT","Server":"gunicorn","Cache-Control":"max-age=0","X-Frame-Options":"SAMEORIGIN","X-Remote-User-Name":"swimlane_dev","X-OTX-ACTIVE":"1","Content-Encoding":"gzip","Access-Control-Allow-Origin":"*","Vary":"Accept-Encoding","X-Cache":"Miss from cloudfront","Via":"1.1 021fce58f4d2d5cc960cb6a0e0c04fc0.cloudfront.net (CloudFront)","X-Amz-Cf-Pop"...` # Response Headers | **Header** | **Description** | **Example** | | --------------------------- | -------------------------------------------------------- | ---------------------------------------------------------------- | | Access-Control-Allow-Origin | HTTP response header: Access-Control-Allow-Origin | \* | | Cache-Control | Directives for caching mechanisms | max-age=0 | | Connection | HTTP response header: Connection | keep-alive | | Content-Encoding | HTTP response header: Content-Encoding | gzip | | Content-Length | The length of the response body in bytes | 375 | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Mon, 09 Jan 2023 23:40:19 GMT | | Server | Information about the software used by the origin server | gunicorn | | Vary | HTTP response header: Vary | Accept-Encoding | | Via | HTTP response header: Via | 1.1 804a8375579a9f838ab10ed130908180.cloudfront.net (CloudFront) | | X-Amz-Cf-Id | HTTP response header: X-Amz-Cf-Id | r-BhM\_yW66-BJWE4d7S-\_c83xVUysFlrm9cDpXmZHf2mo0weHWeE1A== | | X-Amz-Cf-Pop | HTTP response header: X-Amz-Cf-Pop | FOR50-P3 | | X-Cache | HTTP response header: X-Cache | Miss from cloudfront | | X-Frame-Options | HTTP response header: X-Frame-Options | SAMEORIGIN | | X-OTX-ACTIVE | HTTP response header: X-OTX-ACTIVE | 1 | | X-Remote-User-Name | HTTP response header: X-Remote-User-Name | swimlane\_dev |