Open Threat Exchange (OTX)
Operator: AlienVault, Inc. (LevelBlue)
Collects and links threat information about IP addresses, domains, URLs and files from an open security community.
Technical Infrastructure
Product
LevelBlue Open Threat Exchange (OTX), previously branded AlienVault. The current OTX EULA names AlienVault, Inc. as the contracting party.
Availability and source date
Active
As of: 16 October 2026.
No functionality test has been performed.
Use in OSINT research
A technical indicator leads to known threat information and linked reports. The origin and currency of individual community contributions must be checked.
Queries
| Input | Result | Result type |
|---|---|---|
| IP address | Known threat reports, linked malware, URLs and passive DNS data, where available. | Retrieved |
| Domain / website | Linked reports, observed malware connections, URLs, passive DNS data and WHOIS information. | Retrieved |
| URL | Reports about this URL and available results from LevelBlue Labs URL analysis. | Retrieved |
| File hash | Metadata and available static and dynamic analyses for the matching file. | Retrieved |
| IP address | Technical OTX risk assessment based on report reliability and priority. Not proof of a current attack. | Derived |
Features
- Searches for known threat information about technical indicators.
- Groups related indicators and sources into reports called Pulses.
- Links IP addresses and domains to observed malware, URLs and DNS data.
- Imports indicators from reports and other uploaded files.
- Allows threat reports to be shared and commented on, and supports private groups.
- Provides data through the DirectConnect API, SDK and STIX/TAXII.
Categories
- Technical Infrastructure
- Threat intelligence
Coverage
Geographical coverage
Worldwide
Dataset
Community contributions and LevelBlue Labs analyses of threat indicators worldwide. OTX reports over 20 million indicators contributed daily and participants from 140 countries.
Access
Requirements
A free OTX account is required for an API key and participation. This account is separate from other LevelBlue community accounts.
Export
DirectConnect API and SDK, and STIX/TAXII, for importing data. Manual file exports are not described on the pages reviewed.
Provider
AlienVault, Inc. (LevelBlue)
Country of establishment
Unknown
Interfaces
API
Available. DirectConnect API with a free OTX account and its own key. Java, Python and Go SDKs and STIX/TAXII are documented.
MCP
Not documented. No MCP access is described on the OTX product page, in the API reference or in the provider guide.
AI agents
Not documented. DirectConnect and endpoint agents are security integrations. An AI agent integration is not described there.
Usage note
Under the EULA, free OTX use is restricted to non-commercial purposes.
Legal note
Limitations
- Community reports may be incomplete or out of date. An indicator alone does not establish a current attack.
- USM Anywhere and OSSIM are separate products.
- DirectConnect and endpoint agents do not establish an AI integration.
Guides and practical reports
Official · OTX: reports, indicators and reputation data
LevelBlue · EN
Explains Pulses, indicator types and the origins of reputation information; USM integration is described separately.