otx

Open Threat Exchange (OTX) is a community-driven threat intelligence platform for sharing and consuming indicators of compromise (IOCs). It was developed by AlienVault and became part of AT&T Cybersecurity after AT&T’s 2018 acquisition of AlienVault. The platform enables security practitioners to publish Pulses—collections of indicators grouped around a campaign, actor, or threat scenario—and to search for and subscribe to Pulses relevant to their environment. Indicators can include IP addresses, domain names, URLs, file hashes, and other data such as ASNs and email addresses. Each indicator carries contextual metadata such as first seen, last seen, confidence, and tags, and may be labeled with a Traffic Light Protocol (TLP) designation indicating sharing restrictions.

OTX supports programmatic access via a REST API and provides integration points with a range of security products and SIEM/SOAR platforms, allowing automatic enrichment of detections with community-sourced IOCs. The platform emphasizes collaboration and crowd-sourced intelligence, with contributions sourced from researchers, vendors, and defenders and subjected to basic moderation and validation.

While OTX can accelerate threat detection and discovery, indicators may vary in quality and timeliness, and organizations typically correlate OTX data with internal telemetry before acting. OTX remains a widely used resource in threat intelligence workflows and is offered as a free service with optional enterprise features within AT&T Cybersecurity’s portfolio.