Otx api

Skill Liberty91LTD/cti-skills/skills/otx-api

AlienVault OTX API reference. Community threat intelligence pulses and indicator lookups.From its SKILL.md

Install

npx -y skills add Liberty91LTD/cti-skills --skill otx-api

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

16 stars16 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.5 KB, 746 tokens by cl100k_base, as published. Nobody here has run it

AlienVault OTX API

Base URL

https://otx.alienvault.com/api/v1

Authentication

Header: X-OTX-API-KEY: $OTX_API_KEY

Rate Limits

10,000 requests/hour

Key Endpoints

IPv4 Indicator

# General info
curl -s "https://otx.alienvault.com/api/v1/indicators/IPv4/{ip}/general" \
  -H "X-OTX-API-KEY: $OTX_API_KEY"

# Reputation
curl -s "https://otx.alienvault.com/api/v1/indicators/IPv4/{ip}/reputation" \
  -H "X-OTX-API-KEY: $OTX_API_KEY"

# Passive DNS
curl -s "https://otx.alienvault.com/api/v1/indicators/IPv4/{ip}/passive_dns" \
  -H "X-OTX-API-KEY: $OTX_API_KEY"

# Associated malware
curl -s "https://otx.alienvault.com/api/v1/indicators/IPv4/{ip}/malware" \
  -H "X-OTX-API-KEY: $OTX_API_KEY"

Domain Indicator

curl -s "https://otx.alienvault.com/api/v1/indicators/domain/{domain}/general" \
  -H "X-OTX-API-KEY: $OTX_API_KEY"

Sections: /general, /geo, /malware, /url_list, /passive_dns, /whois

File Hash Indicator

curl -s "https://otx.alienvault.com/api/v1/indicators/file/{hash}/general" \
  -H "X-OTX-API-KEY: $OTX_API_KEY"

Sections: /general, /analysis

URL Indicator

curl -s "https://otx.alienvault.com/api/v1/indicators/url/{url}/general" \
  -H "X-OTX-API-KEY: $OTX_API_KEY"

Search Pulses

curl -s "https://otx.alienvault.com/api/v1/search/pulses?q={query}" \
  -H "X-OTX-API-KEY: $OTX_API_KEY"

Key Response Fields

pulse_info.count — number of pulses referencing this indicator
pulse_info.pulses[] — pulse details (name, description, tags, TLP, created)
reputation — community reputation score
validation[] — validation results from OTX
passive_dns[] — historical DNS resolutions

CTI Value

OTX provides community-sourced intelligence. High pulse count = widely reported indicator. Useful for:

Corroboration with other sources
Discovering related indicators via pulse associations
Historical passive DNS data
Community context (pulse descriptions explain what the indicator relates to)

Response Summary Format

indicator: <value>
type: <ip|domain|hash|url>
pulse_count: <number>
reputation: <score>
key_pulses:
  - name: <pulse name>
    tags: [<tags>]
    created: <date>
related_indicators: [<list>]
passive_dns: [<domain/IP resolutions>]
verdict: known-malicious|suspicious|clean|unknown

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.