AlienVault OTX

Modified on: Fri, 11 Jun, 2021 at 9:13 AM

Overview

Maltego AlienVault OTX Transforms bring AT&T's Open Threat Exchange integration to Maltego.


AlienVault Open Threat Exchange® (OTX™) is an open information sharing and analysis network where anyone can provide OTX Pulses.


OTX Pulses provide a summary of the threat, a view into the software targeted, and the related indicators of compromise (IOC) that can be used to detect the threats.


The OTX Transforms provide a means to query Pulses and the following IOCs:

  • IP Addresses
  • Domains
  • Hostnames (subdomains)
  • Email
  • URL/URI
  • File Hashes: MD5, SHA1, SHA256, PEHASH, IMPHASH
  • CIDR Rules
  • File Paths
  • MUTEX name
  • CVE number


Founded by AlienVault (now AT&T Cybersecurity), the Open Threat Exchange (OTX) offers a place for thousands of threat researchers and security professionals to share and discuss the latest threats and the indicators linked to them. With more than 140,000 participants from 140 countries, OTX receives more than 19 million indicators daily.


The new AlienVault OTX Transforms in Maltego allow users to harness this power for free and query threat intelligence using Maltego.


Access

Registration is free. Users will need to register using their email address. Following successful registration, users will be provided with an API key which is required to fully exploit the OTX Transform Hub item.


Sign up for an account here: https://otx.alienvault.com/


Additional Resources

For an interesting walk-through of the new AlienVault OTX Transform Hub item check out our blog post, Combining the power of AlienVault OTX and Maltego to bolster your investigations.


Read more about AlienVault OTX on our website here.


AlienVault OTX Transforms

To IP Addresses (Passive DNS) [OTX].

Transform Settings

Display Name Setting Type Default Value Optional Popup Authentication
API Key string   true false true

Transform Meta Info

Information Value
Display Name To IP Addresses (Passive DNS) [OTX].
Owner  
Author Maltego
Data Source OTX
Output Entities maltego.IPv4Address, maltego.IPv6Address

Variants

Transform Name Input Entities Short Description
alienvault.otx.domainToPassiveDnsSectionIpAddress maltego.Domain Returns the IP addresses detected by OTX for the domain.
alienvault.otx.dnsNameToPassiveDnsSectionIpAddress maltego.DNSName Returns the IP addresses detected by OTX for the DNS name.

Description

Returns the related domains detected by OTX for the input domain.


Transform Settings

Display Name Setting Type Default Value Optional Popup Authentication
API Key string   true false true

Transform Meta Info

Information Value
Display Name To Related Domains (Whois) [OTX].
Owner  
Author Maltego
Data Source OTX
Transform Name alienvault.otx.domainToWhoisSectionRelations
Input Entities maltego.Domain
Output Entities maltego.Domain
Short Description Returns the related domains detected by OTX for the input domain.

To DNS Records (Passive DNS) [OTX].

Description

Returns the DNS records observed by OTX for the input Entity.


Transform Settings

Display Name Setting Type Default Value Optional Popup Authentication
API Key string   true false true

Transform Meta Info

Information Value
Display Name To DNS Records (Passive DNS) [OTX].
Owner  
Author Maltego
Data Source OTX
Output Entities maltego.DNSName,maltego.NSRecord,maltego.MXRecord,maltego.ARecord,maltego.AAAARecord, maltego.Phrase
Short Description Returns the DNS records observed by OTX for the input Entity.

Variants

Transform Name Input Entities
alienvault.otx.ipv4ToPassiveDnsSectionDnsRecords maltego.IPv4Address
alienvault.otx.domainToPassiveDnsSectionDnsRecords maltego.Domain
alienvault.otx.ipv6ToPassiveDnsSectionDnsRecords maltego.IPv6Address

To Service Banner [OTX].

Description

Returns the service banner observed by OTX for the input Entity.


Transform Settings

Display Name Setting Type Default Value Optional Popup Authentication
API Key string   true false true

Transform Meta Info

Information Value
Display Name To Service Banner [OTX].
Owner  
Author Maltego
Data Source OTX
Transform Name alienvault.otx.dnsNameToHttpScanSectionService
Input Entities maltego.DNSName
Output Entities maltego.Service
Short Description Returns the service banner observed by OTX for the input Entity.

To GPS [OTX].

Description

Returns the GPS observed by OTX for the input Entity.


Transform Settings

Display Name Setting Type Default Value Optional Popup Authentication
API Key string   true false true

Transform Meta Info

Information Value
Display Name To GPS [OTX].
Owner  
Author Maltego
Data Source OTX
Output Entities maltego.GPS
Short Description Returns the GPS observed by OTX for the input Entity.

Variants

Transform Name Input Entities
alienvault.otx.domainToGeoSectionGps maltego.Domain
alienvault.otx.dnsNameToGeoSectionGps maltego.DNSName
alienvault.otx.ipv4AddressToGeoSectionGps maltego.IPv4Address

To WhoisRecord [OTX].

Description

Returns the Whois record for the input Entity.


Transform Settings

Display Name Setting Type Default Value Optional Popup Authentication
API Key string   true false true

Transform Meta Info

Information Value
Display Name To WhoisRecord [OTX].
Owner  
Author Maltego
Data Source OTX
Transform Name alienvault.otx.domainToWhoisSectionWhoisRecord
Input Entities maltego.Domain
Output Entities maltego.WhoisRecord
Short Description Returns the Whois record for the input Entity.

To Domains sharing Email (Whois) [OTX].

Description

Returns the related domains sharing the same email detected by OTX for the input Entity.


Transform Settings

Display Name Setting Type Default Value Optional Popup Authentication
API Key string   true false true

Transform Meta Info

Information Value
Display Name To Domains sharing Email (Whois) [OTX].
Owner  
Author Maltego
Data Source OTX
Transform Name alienvault.otx.domainToWhoisSectionDomainSharingEmail
Input Entities maltego.Domain
Output Entities maltego.Domain
Short Description Returns the related domains sharing the same email detected by OTX for the input Entity.

To Malware Hashes [OTX].

Description

Returns the malware hashes observed by OTX for the input Entity.


Transform Settings

Display Name Setting Type Default Value Optional Popup Authentication
API Key string   true false true

Transform Meta Info

Information Value
Display Name To Malware Hashes [OTX].
Owner  
Author Maltego
Data Source OTX
Output Entities maltego.Hash
Short Description Returns the malware hashes observed by OTX for the input Entity.

Variants

Transform Name Input Entities
alienvault.otx.ipv6AddressToMalwareSectionHash maltego.IPv6Address
alienvault.otx.dnsNameToMalwareSectionHash maltego.DNSName
alienvault.otx.domainToMalwareSectionHash maltego.Domain
alienvault.otx.ipv4AddressToMalwareSectionHash maltego.IPv4Address

To linking IP Addresses (Whois) [OTX].

Description

Returns the related IP addressees linking to the input domain.


Transform Settings

Display Name Setting Type Default Value Optional Popup Authentication
API Key string   true false true

Transform Meta Info

Information Value
Display Name To linking IP Addresses (Whois) [OTX].
Owner  
Author Maltego
Data Source OTX
Transform Name alienvault.otx.domainToWhoisSectionLinkingIps
Input Entities maltego.Domain
Output Entities maltego.Ipv4Address
Short Description Returns the related IP addressees linking to the input domain.

To Domains observed on IP Address [OTX].

Description

Returns the domains observed by OTX for the input Entity.


Transform Settings

Display Name Setting Type Default Value Optional Popup Authentication
API Key string   true false true

Transform Meta Info

Information Value
Display Name To Domains observed on IP Address [OTX].
Owner  
Author Maltego
Data Source OTX
Transform Name alienvault.otx.ipv4AddressToUrlListSectionDomain
Input Entities maltego.IPv4Address
Output Entities maltego.Domain
Short Description Returns the domains observed by OTX for the input Entity.

To Location [OTX].

Description

Returns the Location observed by OTX for the input Entity.


Transform Settings

Display Name Setting Type Default Value Optional Popup Authentication
API Key string   true false true

Transform Meta Info

Information Value
Display Name To Location [OTX].
Owner  
Author Maltego
Data Source OTX
Output Entities maltego.Location
Short Description Returns the Location observed by OTX for the input Entity.

Variants

Transform Name Input Entities
alienvault.otx.ipv4AddressToGeoSectionLocation maltego.IPv4Address
alienvault.otx.domainToGeoSectionLocation maltego.Domain
alienvault.otx.dnsNameToGeoSectionLocation maltego.DNSName

To Domains sharing Nameserver (Whois) [OTX].

Description

Returns the related domains sharing the same name server detected by OTX for the input Entity.


Transform Settings

Display Name Setting Type Default Value Optional Popup Authentication
API Key string   true false true

Transform Meta Info

Information Value
Display Name To Domains sharing Nameserver (Whois) [OTX].
Owner  
Author Maltego
Data Source OTX
Transform Name alienvault.otx.domainToWhoisSectionDomainSharingNameServer
Input Entities maltego.Domain
Output Entities maltego.Domain
Short Description Returns the related domains sharing the same name server detected by OTX for the input Entity.

To URLs [OTX].

Description

Returns the URLs observed by OTX for the input Entity.


Transform Settings

Display Name Setting Type Default Value Optional Popup Authentication
API Key string   true false true

Transform Meta Info

Information Value
Display Name To URLs [OTX].
Owner  
Author Maltego
Data Source OTX
Output Entities maltego.URL
Short Description Returns the URLs observed by OTX for the input Entity.

Variants

Transform Name Input Entities
alienvault.otx.ipv4AddressToUrlSectionUrl maltego.IPv4Address
alienvault.otx.dnsNameToUrlSectionUrl maltego.DNSName
alienvault.otx.domainToUrlSectionUrl maltego.Domain
alienvault.otx.ipv6AddressToUrlSectionUrl maltego.IPv6Address

To Ports [OTX].

Description

Returns the ports observed by OTX for the input Entity.


Transform Settings

Display Name Setting Type Default Value Optional Popup Authentication
API Key string   true false true

Transform Meta Info

Information Value
Display Name To Ports [OTX].
Owner  
Author Maltego
Data Source OTX
Transform Name alienvault.otx.ipv4AddressToHttpScanSectionPort
Input Entities maltego.IPv4Address
Output Entities maltego.Port
Short Description Returns the ports observed by OTX for the input Entity.

To linking URLs (Whois) [OTX].

Description

Returns the related URLs link to the input domain.


Transform Settings

Display Name Setting Type Default Value Optional Popup Authentication
API Key string   true false true

Transform Meta Info

Information Value
Display Name To linking URLs (Whois) [OTX].
Owner  
Author Maltego
Data Source OTX
Transform Name alienvault.otx.domainToWhoisSectionLinkingUrls
Input Entities maltego.Domain
Output Entities maltego.URL
Short Description Returns the related URLs link to the input domain.

To Domains (To change name) [OTX].

Description

Returns the domains observed by OTX for the input Entity.


Transform Settings

Display Name Setting Type Default Value Optional Popup Authentication
API Key string   true false true

Transform Meta Info

Information Value
Display Name To Domains (To change name) [OTX].
Owner  
Author Maltego
Data Source OTX
Transform Name alienvault.otx.ipv6AddressToUrlListSectionDomain
Input Entities maltego.IPv6Address
Output Entities maltego.Domain
Short Description Returns the domains observed by OTX for the input Entity.

To DNS Name (Passive DNS) [OTX].

Description

Returns the DNS names observed by OTX for the input Entity.


Transform Settings

Display Name Setting Type Default Value Optional Popup Authentication
API Key string   true false true

Transform Meta Info

Information Value
Display Name To DNS Name (Passive DNS) [OTX].
Owner  
Author Maltego
Data Source OTX
Output Entities maltego.DNSName
Short Description Returns the DNS names observed by OTX for the input Entity.

Variants

Transform Name Input Entities
alienvault.otx.ipv6ToPassiveDnsSectionDnsNames maltego.IPv6Address
alienvault.otx.ipv4ToPassiveDnsSectionDnsNames maltego.IPv4Address

To As Number (Passive DNS) [OTX].

Transform Settings

Display Name Setting Type Default Value Optional Popup Authentication
API Key string   true false true

Transform Meta Info

Information Value
Display Name To As Number (Passive DNS) [OTX].
Owner  
Author Maltego
Data Source OTX
Output Entities maltego.AS

Variants

Transform Name Input Entities Short Description
alienvault.otx.ipv4ToPassiveDnsSectionAsNumber maltego.IPv4Address Returns the the autonomous system number observed by OTX for the input Entity.
alienvault.otx.dnsNameToPassiveDnsSectionAsNumber maltego.DNSName Returns the autonomous system number detected by OTX for the DNS name.
alienvault.otx.ipv6ToPassiveDnsSectionAsNumber maltego.IPv6Address Returns the autonomous system number observed by OTX for the input Entity.

To Service Banners [OTX].

Description

Returns the service banners observed by OTX for the input Entity.


Transform Settings

Display Name Setting Type Default Value Optional Popup Authentication
API Key string   true false true

Transform Meta Info

Information Value
Display Name To Service Banners [OTX].
Owner  
Author Maltego
Data Source OTX
Output Entities maltego.Service
Short Description Returns the service banners observed by OTX for the input Entity.

Variants

Transform Name Input Entities
alienvault.otx.ipv4AddressToHttpScanSectionService maltego.IPv4Address
alienvault.otx.domainToHttpScanSectionService maltego.Domain

To AS Number [OTX].

Description

Returns the Autonomous System Number observed by OTX for the input Entity.


Transform Settings

Display Name Setting Type Default Value Optional Popup Authentication
API Key string   true false true

Transform Meta Info

Information Value
Display Name To AS Number [OTX].
Owner  
Author Maltego
Data Source OTX
Output Entities maltego.AS
Short Description Returns the Autonomous System Number observed by OTX for the input Entity.

Variants

Transform Name Input Entities
alienvault.otx.domainToGeoSectionAsNumber maltego.Domain
alienvault.otx.ipv4AddressToToGeoSectionAsNumber maltego.IPv4Address

To IP Address [OTX].

Description

Returns the IPv6 Addresses observed by OTX for the input Entity.


Transform Settings

Display Name Setting Type Default Value Optional Popup Authentication
API Key string   true false true

Transform Meta Info

Information Value
Display Name To IP Address [OTX].
Owner  
Author Maltego
Data Source OTX
Transform Name alienvault.otx.dnsNameToUrlListSectionIpAddress
Input Entities maltego.DNSName
Output Entities maltego.IPv4Address, maltego.IPv6Address
Short Description Returns the IPv6 Addresses observed by OTX for the input Entity.

To linking Domains (Whois) [OTX].

Description

Returns the related domains linking to the input domain.


Transform Settings

Display Name Setting Type Default Value Optional Popup Authentication
API Key string   true false true

Transform Meta Info

Information Value
Display Name To linking Domains (Whois) [OTX].
Owner  
Author Maltego
Data Source OTX
Transform Name alienvault.otx.domainToWhoisSectionLinkingDomains
Input Entities maltego.Domain
Output Entities maltego.Domain
Short Description Returns the related domains linking to the input domain.

To As Number [OTX].

Description

Returns the Autonomous System Number observed by OTX for the input Entity.


Transform Settings

Display Name Setting Type Default Value Optional Popup Authentication
API Key string   true false true

Transform Meta Info

Information Value
Display Name To As Number [OTX].
Owner  
Author Maltego
Data Source OTX
Transform Name alienvault.otx.dnsNameToGeoSectionAsNumber
Input Entities maltego.DNSName
Output Entities maltego.AS
Short Description Returns the Autonomous System Number observed by OTX for the input Entity.

To shared Email (Whois) [OTX].

Description

Returns the email shared by others domains as the input domain.


Transform Settings

Display Name Setting Type Default Value Optional Popup Authentication
API Key string   true false true

Transform Meta Info

Information Value
Display Name To shared Email (Whois) [OTX].
Owner  
Author Maltego
Data Source OTX
Transform Name alienvault.otx.domainToWhoisSectionSharedEmail
Input Entities maltego.Domain
Output Entities maltego.Domain
Short Description Returns the email shared by others domains as the input domain.

To shared Nameservers (Whois) [OTX].

Description

Returns the related domains sharing same nameserver detected by OTX for the input domain.


Transform Settings

Display Name Setting Type Default Value Optional Popup Authentication
API Key string   true false true

Transform Meta Info

Information Value
Display Name To shared Nameservers (Whois) [OTX].
Owner  
Author Maltego
Data Source OTX
Transform Name alienvault.otx.domainToWhoisSectionSharedNameservers
Input Entities maltego.Domain
Output Entities maltego.Domain
Short Description Returns the related domains sharing same nameserver detected by OTX for the input domain.

To IP Addresses [OTX].

Description

Returns the IP addresses observed by OTX for the input Entity.


Transform Settings

Display Name Setting Type Default Value Optional Popup Authentication
API Key string   true false true

Transform Meta Info

Information Value
Display Name To IP Addresses [OTX].
Owner  
Author Maltego
Data Source OTX
Transform Name alienvault.otx.domainToUrlListSectionIpAddress
Input Entities maltego.Domain
Output Entities maltego.IPv4Address, maltego.IPv6Address
Short Description Returns the IP addresses observed by OTX for the input Entity.

To Subdomains (Passive DNS) [OTX].

Description

Returns the subdomains observed by OTX for the input Entity.


Transform Settings

Display Name Setting Type Default Value Optional Popup Authentication
API Key string   true false true

Transform Meta Info

Information Value
Display Name To Subdomains (Passive DNS) [OTX].
Owner  
Author Maltego
Data Source OTX
Transform Name alienvault.otx.domainToPassiveDnsSectionSubdomains
Input Entities maltego.Domain
Output Entities maltegoDNSName
Short Description Returns the subdomains observed by OTX for the input Entity.

To DNS Names sharing SSL Certificate (Whois) [OTX].

Description

Returns the related DNS names sharing the same SSL Certificate observed by OTX for the input Entity.


Transform Settings

Display Name Setting Type Default Value Optional Popup Authentication
API Key string   true false true

Transform Meta Info

Information Value
Display Name To DNS Names sharing SSL Certificate (Whois) [OTX].
Owner  
Author Maltego
Data Source OTX
Transform Name alienvault.otx.domainToWhoisSectionDnsNameSharingSsl
Input Entities maltego.Domain
Output Entities maltego.DNSName
Short Description Returns the related DNS names sharing the same SSL Certificate observed by OTX for the input Entity.

Did you find it helpful? Yes No

Send feedback
Sorry we couldn't be helpful. Help us improve this article with your feedback.