OTX is an open community sharing various indicators of compromise (IOC’s) such as IP addresses, domains, hostnames, URL’s, SHAs, etc.
To utilize this Add-On with the OTX API feed, you’ll want to head over to Alien Vault OTX to establish an account. Once you’ve signed up you will be able to access detailed documentation as well as your API key via the dashboard. On the dashboard, select the API Integration link to get to your API key.
Then you just need to enter the Splunk App Manager and select Set up to configure the AlienVault OTX API.
This Add-on integrates a Splunk command in order to interact with Alien Vault OTX API feed:
- checkotx <IOC>
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.