# Indicators

Fetches individual IOC indicators (IPs, domains, hashes, and more) from AlienVault OTX subscribed pulses, enriched with parent-pulse threat context and filterable by type.

**Sync Type: Incremental**

## Overview

The AlienVault OTX Indicators input emits one record per Indicator of Compromise (IOC) drawn from the threat-intelligence pulses your OTX account subscribes to. Rather than requiring a lookup per value, it reuses the subscribed-pulses feed — where indicators are returned inline — and explodes each pulse into its individual indicators. Every emitted record carries the native indicator fields (value, type, title, description, activity, observation count) plus the threat context of its parent pulse (pulse ID and name, author, attributed adversary, TLP classification, tags, malware families, targeted industries and countries, references, and ATT&CK technique IDs).

You can restrict output to specific indicator types (for example only `IPv4` and `domain`, or only file hashes) via the **Indicator Types** setting; leaving it empty emits indicators of every type. The connector syncs incrementally using the same `modified_since` watermark as the Subscribed Pulses input, advancing after every complete page run so subsequent runs only process indicators from newly modified pulses. Each record is keyed on the globally-unique OTX indicator ID, so repeated indicators are de-duplicated downstream on re-emit.

## Requirements

### 1. AlienVault OTX Account

You need a free or commercial AlienVault OTX account at [https://otx.alienvault.com](https://otx.alienvault.com).

**Important:** The API key is not visible in your account settings until you have subscribed to at least one pulse. Subscribe to any public pulse before attempting to retrieve your key.

### 2. Obtain an API Key

1. Log in to [https://otx.alienvault.com](https://otx.alienvault.com).
2. Click your username in the top-right corner and select **Settings**.
3. In the left navigation, click **API Integration**.
4. Copy the key shown under **Your OTX Key**.

The key is a plain string — no Bearer prefix or Base64 encoding is needed. Keep it secret; it grants access to all endpoints your account is entitled to.

## Configuration

The following configuration defines the input parameters. Each field's specifications, such as type, requirements, and descriptions, are detailed below.

#### Settings

| Setting | Type | Required | Default | Description |
|---------|------|----------|---------|-------------|
| Indicator Types | array | No | — | Restrict emitted indicators to the selected OTX types. Leave empty to emit indicators of every type. Valid values: `IPv4`, `IPv6`, `CIDR`, `domain`, `hostname`, `URL`, `URI`, `FileHash-MD5`, `FileHash-SHA1`, `FileHash-SHA256`, `FileHash-PEHASH`, `FileHash-IMPHASH`, `email`, `SSLCertFingerprint`, `YARA`, `Snort`, `Sigma`, `Suricata`, `CVE`, `Mutex`, `FilePath`, `BitcoinAddress`. |
| Backfill Start Time | string | No | — | RFC 3339 UTC timestamp (e.g. `2024-01-01T00:00:00Z`) that bounds the initial full fetch. When set, only indicators from pulses modified at or after this time are fetched on the first run. When left empty, indicators from all subscribed pulses are retrieved after the current date time. |
| Use Synthetic Data | boolean | No | `false` | When enabled, the connector generates demo data instead of calling the real OTX API. Useful for testing pipeline configuration without consuming API quota. |

#### Secrets

| Secret | Type | Required | Description |
|--------|------|----------|-------------|
| API Key | string | Yes | OTX API key sent as the `X-OTX-API-KEY` request header. Found at https://otx.alienvault.com → Settings → API Integration. |

## Rate Limits

AlienVault OTX allows **10,000 authenticated requests per hour** per API key. The limit is per-hour, not per-second, so bursty pagination during a backfill is generally fine within that envelope. If the limit is exceeded the API returns HTTP **429 Too Many Requests**. No `Retry-After` header is documented; the connector will surface the error and retry on the next scheduled run.

See [AT&T Cybersecurity Success Center — API requests limit](https://success.alienvault.com/s/question/0D53q0000ADUdhBCQT/api-requests-limit) for further details.

## Setup Walk-through

1. **Create or log into your OTX account** at [https://otx.alienvault.com](https://otx.alienvault.com).
2. **Subscribe to at least one pulse** so your API key becomes visible. Use the search bar to find public pulses and click **Subscribe**.
3. **Retrieve your API key**: navigate to **Settings → API Integration** and copy the key.
4. **Open Monad** and navigate to **Inputs**.
5. Click **Add Input** and search for **AlienVault OTX — Indicators**.
6. Fill in the **Settings** form:
   - **Indicator Types** (optional): select one or more OTX indicator types to emit (e.g. `IPv4`, `domain`, `FileHash-SHA256`). Leave empty to emit indicators of every type.
   - **Backfill Start Time** (optional): enter an RFC 3339 UTC timestamp if you want to limit the initial sync window (e.g. `2024-01-01T00:00:00Z`). Leave blank for a full historical sync.
   - **Use Synthetic Data** (optional): enable to generate synthetic data instead of calling the real API, useful for testing.
7. Under **Secrets**, paste your OTX API key into the **API Key** field.
8. Click **Save**. The connector will perform an initial sync on its next scheduled run, then continue incrementally.

## Related Articles

- [AlienVault OTX External API Documentation](https://otx.alienvault.com/assets/static/external_api.html)
- [AlienVault OTX Portal](https://otx.alienvault.com)

## Sample Record

```json
{
  "id": 806179,
  "indicator": "185.220.101.42",
  "type": "IPv4",
  "title": "C2 server",
  "description": "Command and control server observed in campaign.",
  "created": "2026-05-02T05:28:06.026615",
  "is_active": 1,
  "expiration": "2026-06-02T23:28:06.026633",
  "access_type": "public",
  "role": "c2",
  "observations": 344,
  "pulse_id": "58f15111d3bb0b0b8ac54662",
  "pulse_name": "APT28 C2 Infrastructure",
  "pulse_author": "apt_tracker",
  "pulse_created": "2026-05-02T13:28:06.026496",
  "pulse_modified": "2026-05-02T14:28:06.026511",
  "pulse_adversary": "APT28",
  "pulse_tlp": "green",
  "pulse_tags": ["c2", "financial-sector"],
  "pulse_malware_families": ["Cobalt Strike"],
  "pulse_targeted_countries": ["United States", "Germany"],
  "pulse_industries": ["Finance"],
  "pulse_references": ["https://blog.example.com/apt28-c2"],
  "pulse_attack_ids": ["T1071.001"]
}
```