AlienVault OTX Pulse Operation

The web format of this guide reflects the most current release.  Guides for older iterations are available in PDF format.  

This integration can be installed in the My Integration section of your ThreatQ instance. See the Adding an Integration topic for more details.

Query

The Query action queries AlienVault OTX for any metadata, related indicators, and related pulses.

GET https://otx.alienvault.com/api/v1/indicators/{{TYPE_MAP[indicator_type]}}/{{indicator}}/{{section}}

Sample Response:

    {
    "sections": [
        "general",
        "nids_list",
        "malware"
    ],
    "mitre_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39129",
    "nvd_url": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-39129",
    "indicator": "CVE-2022-39129",
    "type_title": "CVE",
    "base_indicator": {},
    "pulse_info": {
        "count": 0,
        "pulses": [],
        "references": [],
        "related": {
            "alienvault": {
                "adversary": [],
                "malware_families": [],
                "industries": []
            },
            "other": {
                "adversary": [],
                "malware_families": [],
                "industries": []
            }
        }
    },
    "false_positive": [],
    "cve": "CVE-2022-39129",
    "cvss": {},
    "cvssv2": {},
    "cvssv3": {
        "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6
    },
    "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
            {
                "children": [
                    {
                        "children": [],
                        "cpe_match": [
                            {
                                "cpe23Uri": "cpe:2.3:o:google:android:10.0:*:*:*:*:*:*:*",
                                "cpe_name": [],
                                "vulnerable": true
                            }
                        ],
                        "operator": "OR"
                    }
                ],
                "cpe_match": [],
                "operator": "AND"
            }
        ]
    },
    "cwe": "CWE-787",
    "products": [],
    "seen_wild": false,
    "references": [
        {
            "external_source": "MISC",
            "href": "https://www.unisoc.com/en_us/secy/announcementDetail/1599588060988411006",
            "type": null,
            "tags": [
                "Vendor Advisory"
            ],
            "name": "https://www.unisoc.com/en_us/secy/announcementDetail/1599588060988411006"
        }
    ],
    "description": "In face detect driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel.",
    "date_modified": "2022-12-07T15:57:00",
    "date_created": "2022-12-06T07:15:00",
    "exploits": [],
    "epss": null
}

ThreatQ provides the following default mapping for this action:

Type Mapping

The following table provides threat intelligence type mapping for the integration.  

PDF Guides