Overview
Maltego AlienVault OTX Transforms bring AT&T's Open Threat Exchange integration to Maltego.
AlienVault Open Threat Exchange® (OTX™) is an open information sharing and analysis network where anyone can provide OTX Pulses.
OTX Pulses provide a summary of the threat, a view into the software targeted, and the related indicators of compromise (IOC) that can be used to detect the threats.
The OTX Transforms provide a means to query Pulses and the following IOCs:
- IP Addresses
- Domains
- Hostnames (subdomains)
- Email
- URL/URI
- File Hashes: MD5, SHA1, SHA256, PEHASH, IMPHASH
- CIDR Rules
- File Paths
- MUTEX name
- CVE number
Founded by AlienVault (now AT&T Cybersecurity), the Open Threat Exchange (OTX) offers a place for thousands of threat researchers and security professionals to share and discuss the latest threats and the indicators linked to them. With more than 140,000 participants from 140 countries, OTX receives more than 19 million indicators daily.
The new AlienVault OTX Transforms in Maltego allow users to harness this power for free and query threat intelligence using Maltego.
Access
Registration is free. Users will need to register using their email address. Following successful registration, users will be provided with an API key which is required to fully exploit the OTX Data Hub item.
Sign up for an account here: https://otx.alienvault.com/
Updates
12 October 2022
AlienVault Pagination Timeout Update:
A Pagination Timeout setting was added which takes in seconds.
- This timeout is used by Transforms when fetching API results from AlienVault.
- This is a time-consuming process and to avoid requests hanging and customers losing transform results, Transforms will return the collected data when the pagination timeout elapses.
- The default value is 60 seconds and the maximum that can be set is 120 seconds.
Affected Transforms:
- dnsNameToUrlSectionUrl
- domainToUrlSectionUrl
- ipv4AddressToUrlSectionUrl
- ipv6AddressToUrlSectionUrl
- urlToUrlListSectionIpAddress
Additional Resources
For an interesting walk-through of the new AlienVault OTX Data Hub item check out our blog post, Combining the power of AlienVault OTX and Maltego to bolster your investigations.
Read more about AlienVault OTX on our website here.
To IP Addresses (Passive DNS) [OTX].
| API Key | string | | true | false | true |
| Display Name | To IP Addresses (Passive DNS) [OTX]. |
| Owner | |
| Author | Maltego |
| Data Source | OTX |
| Output Entities | maltego.IPv4Address, maltego.IPv6Address |
Variants
| alienvault.otx.domainToPassiveDnsSectionIpAddress | maltego.Domain | Returns the IP addresses detected by OTX for the domain. |
| alienvault.otx.dnsNameToPassiveDnsSectionIpAddress | maltego.DNSName | Returns the IP addresses detected by OTX for the DNS name. |
To Related Domains (Whois) [OTX].
Description
Returns the related domains detected by OTX for the input domain.
| API Key | string | | true | false | true |
| Display Name | To Related Domains (Whois) [OTX]. |
| Owner | |
| Author | Maltego |
| Data Source | OTX |
| Transform Name | alienvault.otx.domainToWhoisSectionRelations |
| Input Entities | maltego.Domain |
| Output Entities | maltego.Domain |
| Short Description | Returns the related domains detected by OTX for the input domain. |
To DNS Records (Passive DNS) [OTX].
Description
Returns the DNS records observed by OTX for the input Entity.
| API Key | string | | true | false | true |
| Display Name | To DNS Records (Passive DNS) [OTX]. |
| Owner | |
| Author | Maltego |
| Data Source | OTX |
| Output Entities | maltego.DNSName,maltego.NSRecord,maltego.MXRecord,maltego.ARecord,maltego.AAAARecord, maltego.Phrase |
| Short Description | Returns the DNS records observed by OTX for the input Entity. |
Variants
| alienvault.otx.ipv4ToPassiveDnsSectionDnsRecords | maltego.IPv4Address |
| alienvault.otx.domainToPassiveDnsSectionDnsRecords | maltego.Domain |
| alienvault.otx.ipv6ToPassiveDnsSectionDnsRecords | maltego.IPv6Address |
To Service Banner [OTX].
Description
Returns the service banner observed by OTX for the input Entity.
| API Key | string | | true | false | true |
| Display Name | To Service Banner [OTX]. |
| Owner | |
| Author | Maltego |
| Data Source | OTX |
| Transform Name | alienvault.otx.dnsNameToHttpScanSectionService |
| Input Entities | maltego.DNSName |
| Output Entities | maltego.Service |
| Short Description | Returns the service banner observed by OTX for the input Entity. |
To GPS [OTX].
Description
Returns the GPS observed by OTX for the input Entity.
| API Key | string | | true | false | true |
| Display Name | To GPS [OTX]. |
| Owner | |
| Author | Maltego |
| Data Source | OTX |
| Output Entities | maltego.GPS |
| Short Description | Returns the GPS observed by OTX for the input Entity. |
Variants
| alienvault.otx.domainToGeoSectionGps | maltego.Domain |
| alienvault.otx.dnsNameToGeoSectionGps | maltego.DNSName |
| alienvault.otx.ipv4AddressToGeoSectionGps | maltego.IPv4Address |
To WhoisRecord [OTX].
Description
Returns the Whois record for the input Entity.
| API Key | string | | true | false | true |
| Display Name | To WhoisRecord [OTX]. |
| Owner | |
| Author | Maltego |
| Data Source | OTX |
| Transform Name | alienvault.otx.domainToWhoisSectionWhoisRecord |
| Input Entities | maltego.Domain |
| Output Entities | maltego.WhoisRecord |
| Short Description | Returns the Whois record for the input Entity. |
To Domains sharing Email (Whois) [OTX].
Description
Returns the related domains sharing the same email detected by OTX for the input Entity.
| API Key | string | | true | false | true |
| Display Name | To Domains sharing Email (Whois) [OTX]. |
| Owner | |
| Author | Maltego |
| Data Source | OTX |
| Transform Name | alienvault.otx.domainToWhoisSectionDomainSharingEmail |
| Input Entities | maltego.Domain |
| Output Entities | maltego.Domain |
| Short Description | Returns the related domains sharing the same email detected by OTX for the input Entity. |
To Malware Hashes [OTX].
Description
Returns the malware hashes observed by OTX for the input Entity.
| API Key | string | | true | false | true |
| Display Name | To Malware Hashes [OTX]. |
| Owner | |
| Author | Maltego |
| Data Source | OTX |
| Output Entities | maltego.Hash |
| Short Description | Returns the malware hashes observed by OTX for the input Entity. |
Variants
| alienvault.otx.ipv6AddressToMalwareSectionHash | maltego.IPv6Address |
| alienvault.otx.dnsNameToMalwareSectionHash | maltego.DNSName |
| alienvault.otx.domainToMalwareSectionHash | maltego.Domain |
| alienvault.otx.ipv4AddressToMalwareSectionHash | maltego.IPv4Address |
To linking IP Addresses (Whois) [OTX].
Description
Returns the related IP addressees linking to the input domain.
| API Key | string | | true | false | true |
| Display Name | To linking IP Addresses (Whois) [OTX]. |
| Owner | |
| Author | Maltego |
| Data Source | OTX |
| Transform Name | alienvault.otx.domainToWhoisSectionLinkingIps |
| Input Entities | maltego.Domain |
| Output Entities | maltego.Ipv4Address |
| Short Description | Returns the related IP addressees linking to the input domain. |
To Domains observed on IP Address [OTX].
Description
Returns the domains observed by OTX for the input Entity.
| API Key | string | | true | false | true |
| Display Name | To Domains observed on IP Address [OTX]. |
| Owner | |
| Author | Maltego |
| Data Source | OTX |
| Transform Name | alienvault.otx.ipv4AddressToUrlListSectionDomain |
| Input Entities | maltego.IPv4Address |
| Output Entities | maltego.Domain |
| Short Description | Returns the domains observed by OTX for the input Entity. |
To Location [OTX].
Description
Returns the Location observed by OTX for the input Entity.
| API Key | string | | true | false | true |
| Display Name | To Location [OTX]. |
| Owner | |
| Author | Maltego |
| Data Source | OTX |
| Output Entities | maltego.Location |
| Short Description | Returns the Location observed by OTX for the input Entity. |
Variants
| alienvault.otx.ipv4AddressToGeoSectionLocation | maltego.IPv4Address |
| alienvault.otx.domainToGeoSectionLocation | maltego.Domain |
| alienvault.otx.dnsNameToGeoSectionLocation | maltego.DNSName |
To Domains sharing Nameserver (Whois) [OTX].
Description
Returns the related domains sharing the same name server detected by OTX for the input Entity.
| API Key | string | | true | false | true |
| Display Name | To Domains sharing Nameserver (Whois) [OTX]. |
| Owner | |
| Author | Maltego |
| Data Source | OTX |
| Transform Name | alienvault.otx.domainToWhoisSectionDomainSharingNameServer |
| Input Entities | maltego.Domain |
| Output Entities | maltego.Domain |
| Short Description | Returns the related domains sharing the same name server detected by OTX for the input Entity. |
To URLs [OTX].
Description
Returns the URLs observed by OTX for the input Entity.
| API Key | string | | true | false | true |
| Display Name | To URLs [OTX]. |
| Owner | |
| Author | Maltego |
| Data Source | OTX |
| Output Entities | maltego.URL |
| Short Description | Returns the URLs observed by OTX for the input Entity. |
Variants
| alienvault.otx.ipv4AddressToUrlSectionUrl | maltego.IPv4Address |
| alienvault.otx.dnsNameToUrlSectionUrl | maltego.DNSName |
| alienvault.otx.domainToUrlSectionUrl | maltego.Domain |
| alienvault.otx.ipv6AddressToUrlSectionUrl | maltego.IPv6Address |
To Ports [OTX].
Description
Returns the ports observed by OTX for the input Entity.
| API Key | string | | true | false | true |
| Display Name | To Ports [OTX]. |
| Owner | |
| Author | Maltego |
| Data Source | OTX |
| Transform Name | alienvault.otx.ipv4AddressToHttpScanSectionPort |
| Input Entities | maltego.IPv4Address |
| Output Entities | maltego.Port |
| Short Description | Returns the ports observed by OTX for the input Entity. |
To linking URLs (Whois) [OTX].
Description
Returns the related URLs link to the input domain.
| API Key | string | | true | false | true |
| Display Name | To linking URLs (Whois) [OTX]. |
| Owner | |
| Author | Maltego |
| Data Source | OTX |
| Transform Name | alienvault.otx.domainToWhoisSectionLinkingUrls |
| Input Entities | maltego.Domain |
| Output Entities | maltego.URL |
| Short Description | Returns the related URLs link to the input domain. |
To Domains (To change name) [OTX].
Description
Returns the domains observed by OTX for the input Entity.
| API Key | string | | true | false | true |
| Display Name | To Domains (To change name) [OTX]. |
| Owner | |
| Author | Maltego |
| Data Source | OTX |
| Transform Name | alienvault.otx.ipv6AddressToUrlListSectionDomain |
| Input Entities | maltego.IPv6Address |
| Output Entities | maltego.Domain |
| Short Description | Returns the domains observed by OTX for the input Entity. |
To DNS Name (Passive DNS) [OTX].
Description
Returns the DNS names observed by OTX for the input Entity.
| API Key | string | | true | false | true |
| Display Name | To DNS Name (Passive DNS) [OTX]. |
| Owner | |
| Author | Maltego |
| Data Source | OTX |
| Output Entities | maltego.DNSName |
| Short Description | Returns the DNS names observed by OTX for the input Entity. |
Variants
| alienvault.otx.ipv6ToPassiveDnsSectionDnsNames | maltego.IPv6Address |
| alienvault.otx.ipv4ToPassiveDnsSectionDnsNames | maltego.IPv4Address |
To As Number (Passive DNS) [OTX].
| API Key | string | | true | false | true |
| Display Name | To As Number (Passive DNS) [OTX]. |
| Owner | |
| Author | Maltego |
| Data Source | OTX |
| Output Entities | maltego.AS |
Variants
| alienvault.otx.ipv4ToPassiveDnsSectionAsNumber | maltego.IPv4Address | Returns the the autonomous system number observed by OTX for the input Entity. |
| alienvault.otx.dnsNameToPassiveDnsSectionAsNumber | maltego.DNSName | Returns the autonomous system number detected by OTX for the DNS name. |
| alienvault.otx.ipv6ToPassiveDnsSectionAsNumber | maltego.IPv6Address | Returns the autonomous system number observed by OTX for the input Entity. |
To Service Banners [OTX].
Description
Returns the service banners observed by OTX for the input Entity.
| API Key | string | | true | false | true |
| Display Name | To Service Banners [OTX]. |
| Owner | |
| Author | Maltego |
| Data Source | OTX |
| Output Entities | maltego.Service |
| Short Description | Returns the service banners observed by OTX for the input Entity. |
Variants
| alienvault.otx.ipv4AddressToHttpScanSectionService | maltego.IPv4Address |
| alienvault.otx.domainToHttpScanSectionService | maltego.Domain |
To AS Number [OTX].
Description
Returns the Autonomous System Number observed by OTX for the input Entity.
| API Key | string | | true | false | true |
| Display Name | To AS Number [OTX]. |
| Owner | |
| Author | Maltego |
| Data Source | OTX |
| Output Entities | maltego.AS |
| Short Description | Returns the Autonomous System Number observed by OTX for the input Entity. |
Variants
| alienvault.otx.domainToGeoSectionAsNumber | maltego.Domain |
| alienvault.otx.ipv4AddressToToGeoSectionAsNumber | maltego.IPv4Address |
To IP Address [OTX].
Description
Returns the IPv6 Addresses observed by OTX for the input Entity.
| API Key | string | | true | false | true |
| Display Name | To IP Address [OTX]. |
| Owner | |
| Author | Maltego |
| Data Source | OTX |
| Transform Name | alienvault.otx.dnsNameToUrlListSectionIpAddress |
| Input Entities | maltego.DNSName |
| Output Entities | maltego.IPv4Address, maltego.IPv6Address |
| Short Description | Returns the IPv6 Addresses observed by OTX for the input Entity. |
To linking Domains (Whois) [OTX].
Description
Returns the related domains linking to the input domain.
| API Key | string | | true | false | true |
| Display Name | To linking Domains (Whois) [OTX]. |
| Owner | |
| Author | Maltego |
| Data Source | OTX |
| Transform Name | alienvault.otx.domainToWhoisSectionLinkingDomains |
| Input Entities | maltego.Domain |
| Output Entities | maltego.Domain |
| Short Description | Returns the related domains linking to the input domain. |
To As Number [OTX].
Description
Returns the Autonomous System Number observed by OTX for the input Entity.
| API Key | string | | true | false | true |
| Display Name | To As Number [OTX]. |
| Owner | |
| Author | Maltego |
| Data Source | OTX |
| Transform Name | alienvault.otx.dnsNameToGeoSectionAsNumber |
| Input Entities | maltego.DNSName |
| Output Entities | maltego.AS |
| Short Description | Returns the Autonomous System Number observed by OTX for the input Entity. |
To shared Email (Whois) [OTX].
Description
Returns the email shared by others domains as the input domain.
| API Key | string | | true | false | true |
| Display Name | To shared Email (Whois) [OTX]. |
| Owner | |
| Author | Maltego |
| Data Source | OTX |
| Transform Name | alienvault.otx.domainToWhoisSectionSharedEmail |
| Input Entities | maltego.Domain |
| Output Entities | maltego.Domain |
| Short Description | Returns the email shared by others domains as the input domain. |
To shared Nameservers (Whois) [OTX].
Description
Returns the related domains sharing same nameserver detected by OTX for the input domain.
| API Key | string | | true | false | true |
| Display Name | To shared Nameservers (Whois) [OTX]. |
| Owner | |
| Author | Maltego |
| Data Source | OTX |
| Transform Name | alienvault.otx.domainToWhoisSectionSharedNameservers |
| Input Entities | maltego.Domain |
| Output Entities | maltego.Domain |
| Short Description | Returns the related domains sharing same nameserver detected by OTX for the input domain. |
To IP Addresses [OTX].
Description
Returns the IP addresses observed by OTX for the input Entity.
| API Key | string | | true | false | true |
| Display Name | To IP Addresses [OTX]. |
| Owner | |
| Author | Maltego |
| Data Source | OTX |
| Transform Name | alienvault.otx.domainToUrlListSectionIpAddress |
| Input Entities | maltego.Domain |
| Output Entities | maltego.IPv4Address, maltego.IPv6Address |
| Short Description | Returns the IP addresses observed by OTX for the input Entity. |
To Subdomains (Passive DNS) [OTX].
Description
Returns the subdomains observed by OTX for the input Entity.
| API Key | string | | true | false | true |
| Display Name | To Subdomains (Passive DNS) [OTX]. |
| Owner | |
| Author | Maltego |
| Data Source | OTX |
| Transform Name | alienvault.otx.domainToPassiveDnsSectionSubdomains |
| Input Entities | maltego.Domain |
| Output Entities | maltegoDNSName |
| Short Description | Returns the subdomains observed by OTX for the input Entity. |
To DNS Names sharing SSL Certificate (Whois) [OTX].
Description
Returns the related DNS names sharing the same SSL Certificate observed by OTX for the input Entity.
| API Key | string | | true | false | true |
| Display Name | To DNS Names sharing SSL Certificate (Whois) [OTX]. |
| Owner | |
| Author | Maltego |
| Data Source | OTX |
| Transform Name | alienvault.otx.domainToWhoisSectionDnsNameSharingSsl |
| Input Entities | maltego.Domain |
| Output Entities | maltego.DNSName |
| Short Description | Returns the related DNS names sharing the same SSL Certificate observed by OTX for the input Entity. |