🌙
 

Subscribe to the Taegis™ XDR Documentation RSS Feed at .

Learn more about RSS readers or RSS browser extensions.

AlienVault OTX Integration Guide

cloud integrations alienvault threat intelligence byoti


The following instructions are for configuring AlienVault OTX to ingest threat indicators into Secureworks® Taegis™ XDR to generate alerts via the Bring Your Own Threat Intel Detector. Once this integration is setup, Taegis™ XDR imports indicators based on the user‘s subscribed AlienVault OTX pulses and polls for new indicators every hour.

AlienVault OTX Requirements

An AlienVault OTX account with at least one subscribed pulse is required to integrate with Taegis™ XDR.

Note

The Preview release is limited to 10,000 active indicators per tenant. When indicators reach the limit, the oldest indicators are deleted to remain under the limit.

Note

This integration imports indicators based on the user‘s subscribed AlienVault OTX pulses. After initial import, the integration polls every hour for new indicators.

Data Provided from Integration

Threat Indictor Lists contain the following data types:

Locate your OTX API Key

Find your OTX Key at the AlienVault OTX API Integration Page (login required).

Add Integration in Taegis™ XDR

  1. From the XDR left-hand side navigation, select Integrations → Cloud APIs → Add API Integration.
  2. Choose Set up AlienVault OTX.

Create a new AlienVault OTX Integration

Create a new AlienVault OTX Integration

  1. Enter the following fields:

    • Integration Name — Name that this integration will use in Taegis™ XDR
    • Severity — Default severity to use for alerts
    • AlienVault OTX API KeyObtained in the first step
  2. Select Done. The Cloud API Integrations page displays with the successfully added AlienVault OTX integration.

Once the preceding steps are completed, AlienVault OTX integration details are available on Cloud APIs. From the XDR left-hand side navigation, select Integrations → Cloud APIs.

Example Query Language Searches

To search for Bring Your Own Threat Intel Alerts from the last 24 hours:

from alert metadata.creator.detector.detector_id='app:detect:byoti' and EARLIEST=-24h

 

On this page: