AlienVault OTX v2

Query Indicators of Compromise in AlienVault OTX.

Category

Data Enrichment & Threat Intelligence

Pack

AlienVault_OTX

Configuration parameters

• url — Server address (required)
• credentials —
• api_token — API Token
• default_threshold — Indicator Threshold. The minimum number of pulses to consider the indicator as malicious.
• min_valid_sources — Minimum number of validated sources to consider the indicator as benign.
• max_indicator_relationships — Maximum number of relationships for indicators
• integrationReliability — Source Reliability (required)
• create_relationships — Create relationships
• should_error — Should Error When Not Found
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings

Commands (12)

• alienvault-get-passive-dns-data-by-indicator — Returns passive DNS records by indicator.
• alienvault-get-pulse-details — Returns pulse details.
• alienvault-get-related-hashes-by-indicator — Returns related hashes by indicator.
• alienvault-get-related-urls-by-indicator — Returns related URLs by indicator.
• alienvault-search-cve — Query Common Vulnerabilities and Exposures (CVE) in AlienVault OTX.
• alienvault-search-hostname — Searches for a host name in AlienVault OTX.
• alienvault-search-ipv6 — Queries IPv6 in AlienVault OTX.
• alienvault-search-pulses — Searches for pulses in AlienVault OTX.
• domain — Queries a domain in AlienVault OTX.
• file — Query a file in AlienVault OTX.
• ip — Queries an IP address in AlienVault OTX.
• url — Queries a URL in AlienVault OTX.