Open Threat Exchange (OTX) is an open information-sharing network that allows security professionals to access and share real-time threat data globally. It hosts the largest crowd-sourced repository for threat data, which expires after 30 days without additional evidence, and is focused on privacy by not collecting personal or internal information. OTX facilitates collaboration among users to enhance threat response through validated threat intelligence and analysis.

1. INTRODUCTION TO OPEN
THREAT EXCHANGE

2. WHAT IS OTX?
An open information sharing and
analysis network
Provides access to real-time,
detailed information about threats
and incidents around the world
Enables security professionals to
share threat data and benefit from
data shared by others
At the heart of OTX is the world’s
largest, crowd-sourced repository
for threat data.

3. OTX + ALIENVAULT LABS

4. SCORING AND ANALYSIS
 Confirmation by other
sources
 Voting based on known
abuse patterns
 White-listing known sources
of false positives

5. THE THREAT LANDSCAPE
CHANGES
• IPs Change
IPs may be rebound to a different server, owner
• Threats Get Remediated
In the case of compromised/slaved servers, system
owners may remediate threat
• Threats Naturally Expire
Campaigns and targeted attacks end per orchestrator’s
plans

6. DATA EXPIRY
 Contributed Data: expires
after 30 days
 Scanning: expires after 30
days without additional
evidence
 Malware: validate ongoing
hosting
 Web-based Threats:
confirm ongoing activity

7. DATA PRIVACY IN OTX
122.225.118.219 # Scanning Host
CN,Hangzhou,30.2936000824,120.161399841
122.225.118.66 # Scanning Host
CN,Hangzhou,30.2936000824,120.161399841
188.138.100.156 # Malware IP;Scanning Host DE,,51.0,9.0
211.87.176.197 # Scanning Host CN,,35.0,105.0
95.163.107.201 # Spamming RU,,60.0,100.0
188.138.110.48 # Malicious Host;Scanning Host DE,,51.0,9.0
72.167.131.220 # Malware IP US,Scottsdale,33.6119003296,-
111.890602112
174.120.172.125 # Malware IP US,Houston,29.7523002625,-
95.3669967651
210.148.165.67 # Malware IP JP,,36.0,138.0
75.75.253.84 # Spamming US,Henderson,36.0312004089,-
115.073898315
What OTX Collects
• External IPs connecting
to system
• Traffic Patterns (Timestamps)
What OTX Does NOT Collect
• System data
• System information
• Internal IP traffic
• Any personally identifiable
information
OTX API Example