# Subscribed Pulses

Fetches subscribed threat-intelligence pulses from AlienVault OTX, including inline IOC indicators.

**Sync Type: Incremental**

## Overview

The AlienVault OTX Subscribed Pulses input retrieves threat-intelligence pulses that your OTX account subscribes to, along with all embedded Indicators of Compromise (IOCs). Each pulse record includes metadata such as TLP classification, attributed adversary, targeted industries and countries, and the full list of indicators (IP addresses, domains, URLs, file hashes, CVEs, and more) inline — no additional API call per pulse is required. The connector syncs incrementally using the `modified_since` query parameter, advancing a watermark after every complete page run so that only newly modified pulses are fetched on subsequent runs.

## Requirements

### 1. AlienVault OTX Account

You need a free or commercial AlienVault OTX account at [https://otx.alienvault.com](https://otx.alienvault.com).

**Important:** The API key is not visible in your account settings until you have subscribed to at least one pulse. Subscribe to any public pulse before attempting to retrieve your key.

### 2. Obtain an API Key

1. Log in to [https://otx.alienvault.com](https://otx.alienvault.com).
2. Click your username in the top-right corner and select **Settings**.
3. In the left navigation, click **API Integration**.
4. Copy the key shown under **Your OTX Key**.

The key is a plain string — no Bearer prefix or Base64 encoding is needed. Keep it secret; it grants access to all endpoints your account is entitled to.

## Configuration

The following configuration defines the input parameters. Each field's specifications, such as type, requirements, and descriptions, are detailed below.

#### Settings

| Setting | Type | Required | Default | Description |
|---------|------|----------|---------|-------------|
| Backfill Start Time | string | No | — | RFC 3339 UTC timestamp (e.g. `2024-01-01T00:00:00Z`) that bounds the initial full fetch. When set, only pulses modified at or after this time are fetched on the first run. When left empty, all subscribed pulses are retrieved after the current date time. |
| Use Synthetic Data | boolean | No | `false` | When enabled, the connector generates demo data instead of calling the real OTX API. Useful for testing pipeline configuration without consuming API quota. |
| API Rate Limit | object | No | - | Optional limit on the connector's outbound request rate to the source API. Leave blank to use the connector's default behavior. See [API Rate Limiting](../../../guides/rate-limiting) for the field format, limits, and how to choose a value. |

#### Secrets

| Secret | Type | Required | Description |
|--------|------|----------|-------------|
| API Key | string | Yes | OTX API key sent as the `X-OTX-API-KEY` request header. Found at https://otx.alienvault.com → Settings → API Integration. |

## Rate Limits

AlienVault OTX allows **10,000 authenticated requests per hour** per API key. The limit is per-hour, not per-second, so bursty pagination during a backfill is generally fine within that envelope. If the limit is exceeded the API returns HTTP **429 Too Many Requests**. No `Retry-After` header is documented; the connector will surface the error and retry on the next scheduled run.

See [AT&T Cybersecurity Success Center — API requests limit](https://success.alienvault.com/s/question/0D53q0000ADUdhBCQT/api-requests-limit) for further details.

## Setup Walk-through

1. **Create or log into your OTX account** at [https://otx.alienvault.com](https://otx.alienvault.com).
2. **Subscribe to at least one pulse** so your API key becomes visible. Use the search bar to find public pulses and click **Subscribe**.
3. **Retrieve your API key**: navigate to **Settings → API Integration** and copy the key.
4. **Open Monad** and navigate to **Inputs**.
5. Click **Add Input** and search for **AlienVault OTX — Subscribed Pulses**.
6. Fill in the **Settings** form:
   - **Backfill Start Time** (optional): enter an RFC 3339 UTC timestamp if you want to limit the initial sync window (e.g. `2024-01-01T00:00:00Z`). Leave blank for a full historical sync.
   - **Use Synthetic Data** (optional): enable to generate synthetic data instead of calling the real API, useful for testing.
7. Under **Secrets**, paste your OTX API key into the **API Key** field.
8. Click **Save**. The connector will perform an initial sync on its next scheduled run, then continue incrementally.

## Related Articles

- [AlienVault OTX External API Documentation](https://otx.alienvault.com/assets/static/external_api.html)
- [AlienVault OTX Portal](https://otx.alienvault.com)

## Sample Record

```json
{
  "id": "58f15111d3bb0b0b8ac54662",
  "name": "FIN7 Phishing Campaign",
  "description": "Threat intelligence pulse describing C2 infrastructure used in targeted attacks.",
  "author_name": "apt_tracker",
  "public": false,
  "revision": 13,
  "TLP": "green",
  "adversary": "APT28",
  "tags": ["trojan", "education", "macos"],
  "references": [
    "https://blog.example.com/fin7-campaign",
    "https://www.example.org/reports/2025-q1"
  ],
  "industries": ["Finance", "Telecommunications"],
  "targeted_countries": ["United States", "Australia"],
  "created": "2026-05-02T13:28:06.026496",
  "modified": "2026-05-02T14:28:06.026511",
  "indicators": [
    {
      "id": 806179,
      "indicator": "208.199.62.171",
      "type": "IPv4",
      "title": "C2 server",
      "description": "Command and control server.",
      "created": "2026-05-02T05:28:06.026615",
      "is_active": 1,
      "expiration": "2026-05-02T23:28:06.026633",
      "access_type": "public",
      "access_groups": [],
      "access_reason": "group-member",
      "role": null,
      "content": "",
      "observations": 344
    },
    {
      "id": 3870646,
      "indicator": "phish.fakebrand.org",
      "type": "domain",
      "title": "Malicious domain",
      "description": "Hostname resolving to known bad IP.",
      "created": "2026-05-02T06:28:06.026749",
      "is_active": 1,
      "expiration": null,
      "access_type": "private",
      "access_groups": [],
      "access_reason": "",
      "role": "exfiltration",
      "content": "",
      "observations": 967
    }
  ]
}
```

## Sync frequency

By default this input polls approximately every 10 seconds, with each sync beginning after the previous one completes. A cron schedule configured on the pipeline overrides this cadence. See [Input Sync Frequency](../../guides/sync-frequency) for details.