IBM X-Force Exchange
Operator: International Business Machines Corporation (IBM), United States
Researches threat information about IP addresses, URLs, domains, malware and vulnerabilities and groups it into collections.
Technical Infrastructure
Product
IBM X-Force Exchange with a limited free portal. Paid X-Force Threat Intelligence subscriptions provide the API and additional feeds.
Availability and source date
Active
As of: 16 October 2026.
No functionality test has been performed.
Use in OSINT research
A technical indicator leads to existing assessments and threat reports. Collections help record related information and share it with other users.
Queries
| Input | Result | Result type |
|---|---|---|
| IP address | Available geospatial data, DNS and WHOIS information for the IP address. | Retrieved |
| URL | Existing malware information and WHOIS details for this URL. | Retrieved |
| Domain / website | DNS and WHOIS information and available early warnings about spam, phishing and malware. | Retrieved |
| File hash | Existing information and analyses for the matching malware. | Retrieved |
| Keyword / free text | For a CVE identifier: vulnerability description, source links and CVSS score. | Retrieved |
| IP address | Technical IBM risk assessment and content categories for the IP address. Not proof of current malicious use. | Derived |
| URL | Technical IBM risk assessment and content categories for the URL. Not proof of current malicious use. | Derived |
Features
- Searches for threat information by IP address, URL, domain or file hash.
- Shows IBM reputation assessments and content categories for IP addresses and URLs.
- Adds DNS, WHOIS and malware information to technical indicators.
- Describes vulnerabilities with CVSS scores and further sources.
- Stores information in public, private or shared collections.
- Provides API data and STIX/TAXII feeds through separate subscriptions.
Categories
- Technical Infrastructure
- Threat intelligence
Coverage
Geographical coverage
Unknown
Dataset
Threat intelligence from IBM X-Force and community contributions. Available reports, feeds and detailed data vary by access and subscription.
Access
Requirements
An IBM account and acceptance of the product terms. API access requires a paid subscription, an API key and a password.
Export
Collections support internal information sharing. The separate API offers STIX export and TAXII/TAXII2 feeds; access depends on the subscription.
Provider
International Business Machines Corporation (IBM)
Country of establishment
United States
Interfaces
API
Limited availability. Documented API with a paid subscription. According to IBM, Freemium keys no longer provide API access. Features and data coverage depend on the tier.
MCP
Not documented. No dedicated X-Force MCP is described in the platform, API documentation or provider notices. Search references to third-party providers are not evidence from IBM.
AI agents
Not documented. The API and automation are documented; a direct AI agent integration is not described in these provider sources.
Usage note
Under the service description, IBM data available through free access may be used only for personal, internal and non-commercial purposes; community data has separate rights.
Legal note
Limitations
- A reputation score is IBM's assessment, not proof of current malicious use.
- Freemium access does not include the API; paid subscriptions have different content.
- The former editions page redirects to a general QRadar page and provides no current prices.
Guides and practical reports
Official · X-Force Threat Intelligence API: getting started and features
IBM · EN
Explains access requirements, API keys and available query types. API access is paid.