Integration

AlienVault OTX integration

AlienVault Open Threat Exchange DirectConnect API for threat intelligence enrichment: look up the reputation, geolocation, passive DNS, related malware and URL history of an IP address, domain, hostname, file hash, URL or CVE, browse and search community pulses, subscribe to the ones worth following, and publish your own indicators as a pulse. Access uses the OTX API key of a community account.

Connect AlienVault OTX How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in AlienVault OTX.Built from the 18 AlienVault OTX tools below, on the connection you add once.

Common AlienVault OTX use cases

checking a link extracted from a phishing email
enriching a specific host name seen in DNS logs
enriching IPv6 traffic seen in network telemetry
monitoring a trusted researcher for new reporting
enriching a domain extracted from a phishing email
reading the full context behind an indicator match
loading a pulse's observables into a detection rule
validating a stored OTX key before an enrichment run
finding community reporting on a named malware family
automatically subscribing to pulses that match a search

What you can do with AlienVault OTX

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Pulse, 9 operations

create_pulseCreate pulsePOSTPublishes your own indicators to OTX as a new pulse.
get_pulseGet pulseGETReturns a single OTX pulse including its indicators, tags and attribution.
list_pulse_activityList pulse activityGETReturns the pulses that recently changed across the account subscriptions.
list_subscribed_pulse_idsList subscribed pulse idsGETReturns just the identifiers of the subscribed pulses, without their indicators.
list_subscribed_pulsesList subscribed pulsesGETReturns the full threat intelligence pulses the account subscribes to, with all their indicators.
list_user_pulsesList user pulsesGETReturns the pulses a given OTX user has published.
search_pulsesSearch pulsesGETSearches the public OTX pulse corpus by keyword, malware family or actor name.
subscribe_to_pulseSubscribe to pulseGETAdds a pulse to the account subscriptions so its indicators appear in the feed.
unsubscribe_from_pulseUnsubscribe from pulseGETRemoves a pulse from the account subscriptions so it stops appearing in the feed.

Indicator, 8 operations

get_cve_indicatorGet cve indicatorGETReturns OTX community reporting that references a given CVE.
get_domain_indicatorGet domain indicatorGETReturns OTX intelligence about a domain, one section at a time.
get_file_indicatorGet file indicatorGETReturns OTX intelligence about a file hash, either its pulse context or its analysis.
get_hostname_indicatorGet hostname indicatorGETReturns OTX intelligence about a fully qualified host name, one section at a time.
get_ipv4_indicatorGet ipv4 indicatorGETReturns OTX intelligence about an IPv4 address, one section at a time.
get_ipv6_indicatorGet ipv6 indicatorGETReturns OTX intelligence about an IPv6 address, one section at a time.
get_pulse_indicatorsGet pulse indicatorsGETReturns the observables of a pulse without its narrative metadata.
get_url_indicatorGet url indicatorGETReturns OTX intelligence about a specific URL.

User, 1 operation

get_current_userGet current userGETReturns the OTX profile the API key belongs to.

Use AlienVault OTX from Claude Code, Cursor or Codex

Connect AlienVault OTX in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its AlienVault OTX operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect AlienVault OTX

Create your workspace
Sign up free. Nothing to install.
Connect AlienVault OTX once
Add your AlienVault OTX connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

AlienVault OTX integration FAQ

What can you do with the AlienVault OTX integration?

LiveContext exposes 18 operations on AlienVault OTX, covering pulse, indicator and user. Common uses include checking a link extracted from a phishing email, enriching a specific host name seen in DNS logs and enriching IPv6 traffic seen in network telemetry.