# Lookup Otx

> Use when you need to check an IP, domain, file hash, or URL against AlienVault OTX community pulses. Returns pulse count, key pulses, tags, related indicators, and passive DNS. Commonly invoked by investigation skills to pull community context. Retrieval only — does not interpret.

- **Type:** Skill
- **Install:** `agentstack add skill-liberty91ltd-cti-skills-lookup-otx`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Liberty91LTD](https://agentstack.voostack.com/s/liberty91ltd)
- **Installs:** 0
- **Category:** [Search](https://agentstack.voostack.com/c/search)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Liberty91LTD](https://github.com/Liberty91LTD)
- **Source:** https://github.com/Liberty91LTD/cti-skills/tree/main/skills/lookup-otx
- **Website:** https://liberty91.com/cti-skills

## Install

```sh
agentstack add skill-liberty91ltd-cti-skills-lookup-otx
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# lookup-otx

Queries AlienVault OTX for community pulse context on IPs, domains, file hashes, and URLs. Retrieval only — do not interpret results.

## When to invoke

- User asks what pulses reference an indicator
- Investigation skill needs community context (who's tracking this?)
- IOC enrichment pipeline is adding pulse metadata

## How to invoke

Two CLIs are provided. Pick by capability needed:

### Basic lookup — Node CLI (zero deps)

```bash
node tools/clis/otx.js  
# where  is one of: ip, domain, hash, url
```

Hits the `/general` endpoint only. Returns pulses, related indicators, passive DNS, whois. Best for fast retrieval inside an investigation chain.

### Advanced operations — Python CLI (uses official OTXv2 SDK)

```bash
python3 tools/clis/otx.py indicator   [--section SECTION]
python3 tools/clis/otx.py pulse search  [--limit N]
python3 tools/clis/otx.py pulse get 
python3 tools/clis/otx.py pulse subscribed [--limit N]
```

Self-bootstraps a private venv at `tools/clis/.venv-otx/` on first run (requires Python 3 + a working `python3 -m venv`). No global pip install.

Capabilities the Node CLI doesn't have:
- **Full indicator details** across every OTX section (general, reputation, geo, malware, url_list, passive_dns, http_scans, analysis) instead of just `/general`. Pass `--section` to limit.
- **Pulse keyword search** (`pulse search "lazarus"`) — discover pulses by topic.
- **Pulse retrieval by ID** with full description, references, and indicator list.
- **Subscribed pulses** — list pulses your OTX account follows.

Examples:
```bash
# Basic — same shape as Node CLI but with all sections populated
python3 tools/clis/otx.py indicator domain example.com

# Just one section
python3 tools/clis/otx.py indicator ip 203.0.113.42 --section malware

# Hash type auto-detected from length (MD5/SHA1/SHA256)
python3 tools/clis/otx.py indicator hash 44d88612fea8a8f36de82e1278abb02f

# Discover pulses by keyword
python3 tools/clis/otx.py pulse search "ransomware exchange"

# Pull a specific pulse
python3 tools/clis/otx.py pulse get 5f8f3e6e2a1b3c4d5e6f7a8b
```

Both CLIs accept `--dry-run` to preview the request without calling the API. Both exit code 2 if `$OTX_API_KEY` is unset (when not in dry-run). Report missing key; do not fabricate.

## Response format

```yaml
source: otx
indicator: 
type: ip | domain | hash | url
query_time: 
pulse_count: 
key_pulses:
  - name: 
    tags: []
    created: 
    tlp: 
    author: 
related_indicators: []
passive_dns: []   # only for IP/domain
```

## Rate limits

Free tier: 10,000 req/hour — effectively unconstrained for interactive use.

## Source reliability (Admiralty default)

Default rating for downstream `/score-source`: **C3** (fairly reliable, possibly true). Community-submitted pulses vary wildly in quality. Upgrade to **B2** if pulse author is a known trustworthy org (Mandiant, Unit42, Talos, etc.).

## Related skills

- `/lookup-virustotal` — reputation aggregator for the same indicator
- `/lookup-urlscan` — live scan of URLs/domains
- `/score-source` — apply Admiralty rating
- `/ip-investigation`, `/domain-investigation`, `/hash-investigation`, `/url-investigation`

## See also

- Integration setup: `tools/integrations/otx.md`
- Node CLI source: `tools/clis/otx.js`
- Python CLI source (OTXv2 SDK): `tools/clis/otx.py`
- Official Python SDK: https://github.com/AlienVault-OTX/OTX-Python-SDK
- API reference: https://otx.alienvault.com/api

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Liberty91LTD](https://github.com/Liberty91LTD)
- **Source:** [Liberty91LTD/cti-skills](https://github.com/Liberty91LTD/cti-skills)
- **License:** MIT
- **Homepage:** https://liberty91.com/cti-skills

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-liberty91ltd-cti-skills-lookup-otx
- Seller: https://agentstack.voostack.com/s/liberty91ltd
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.