Otx Api

AlienVault OTX API

Base URL

https://otx.alienvault.com/api/v1

Authentication

Header: X-OTX-API-KEY: $OTX_API_KEY

Rate Limits

• 10,000 requests/hour

Key Endpoints

IPv4 Indicator

# General info
curl -s "https://otx.alienvault.com/api/v1/indicators/IPv4/{ip}/general" \
  -H "X-OTX-API-KEY: $OTX_API_KEY"

# Reputation
curl -s "https://otx.alienvault.com/api/v1/indicators/IPv4/{ip}/reputation" \
  -H "X-OTX-API-KEY: $OTX_API_KEY"

# Passive DNS
curl -s "https://otx.alienvault.com/api/v1/indicators/IPv4/{ip}/passive_dns" \
  -H "X-OTX-API-KEY: $OTX_API_KEY"

# Associated malware
curl -s "https://otx.alienvault.com/api/v1/indicators/IPv4/{ip}/malware" \
  -H "X-OTX-API-KEY: $OTX_API_KEY"

Domain Indicator

curl -s "https://otx.alienvault.com/api/v1/indicators/domain/{domain}/general" \
  -H "X-OTX-API-KEY: $OTX_API_KEY"

Sections: /general, /geo, /malware, /url_list, /passive_dns, /whois

File Hash Indicator

curl -s "https://otx.alienvault.com/api/v1/indicators/file/{hash}/general" \
  -H "X-OTX-API-KEY: $OTX_API_KEY"

Sections: /general, /analysis

URL Indicator

curl -s "https://otx.alienvault.com/api/v1/indicators/url/{url}/general" \
  -H "X-OTX-API-KEY: $OTX_API_KEY"

Search Pulses

curl -s "https://otx.alienvault.com/api/v1/search/pulses?q={query}" \
  -H "X-OTX-API-KEY: $OTX_API_KEY"

Key Response Fields

• pulse_info.count — number of pulses referencing this indicator
• pulse_info.pulses[] — pulse details (name, description, tags, TLP, created)
• reputation — community reputation score
• validation[] — validation results from OTX
• passive_dns[] — historical DNS resolutions

CTI Value

OTX provides community-sourced intelligence. High pulse count = widely reported indicator. Useful for:

• Corroboration with other sources
• Discovering related indicators via pulse associations
• Historical passive DNS data
• Community context (pulse descriptions explain what the indicator relates to)

Response Summary Format

indicator: 
type: 
pulse_count: 
reputation: 
key_pulses:
  - name: 
    tags: []
    created: 
related_indicators: []
passive_dns: []
verdict: known-malicious|suspicious|clean|unknown

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: Liberty91LTD
• Source: Liberty91LTD/cti-skills
• License: MIT
• Homepage: https://liberty91.com/cti-skills

Install and usage instructions live in the source repository linked above.