Skip to content
The Python SDK for AlienVault OTX
Branch: master
Clone or download
Type Name Latest commit message Commit time
Failed to load latest commit information.
examples Add Domains to Pulse Example Jan 15, 2019
LICENSE Added Apache License Aug 26, 2015 Update Jan 15, 2019
howto_use_python_otx_api.ipynb Added PatchPulse object May 4, 2017
setup.cfg add setup.cfg (defines readme file for pypi), (added 'downlo… May 3, 2016 Fix filenames May 4, 2017

Build Status


Open Threat Exchange is an open community that allows participants to learn about the latest threats, research indicators of compromise observed in their environments, share threats they have identified, and automatically update their security infrastructure with the latest indicators to defend their environment.

OTX Direct Connect agents provide a way to automatically update your security infrastructure with pulses you have subscribed to from with Open Threat Exchange. By using Direct Connect, the indicators contained within the pulses you have subscribed to can be downloaded and made locally available for other applications such as Intrusion Detection Systems, Firewalls, and other security-focused applications.

OTX Direct Connect provides a mechanism to automatically pull indicators of compromise from the Open Threat Exchange portal into your environment. The DirectConnect API provides access to all Pulses that you have subscribed to in Open Threat Exchange (


You can install with pip install OTXv2 or alternatively:

  1. Clone this repo
  2. Run (from the root directory) pip install . or python install
  3. Integrate into your codebase (see Python Notebook example below)

For more information about the particular API calls see (Endpoint details on 'docs' tab)

Installation with Python Notebook

  1. Clone this repo
  2. Install pandas

pip install pandas

  1. Install python notebook (

pip install jupyter

  1. Run notebook

jupyter notebook howto_use_python_otx_api.ipynb


Reading contents from OTX:

from OTXv2 import OTXv2
from OTXv2 import IndicatorTypes
otx = OTXv2("API_KEY")
# Get all the indicators associated with a pulse
indicators = otx.get_pulse_indicators("pulse_id")
for indicator in indicators:
    print indicator["indicator"] + indicator["type"]
# Get everything OTX knows about
otx.get_indicator_details_full(IndicatorTypes.DOMAIN, "")

Adding content to OTX:

from OTXv2 import OTXv2
otx = OTXv2("API_KEY")
name = 'Test Pulse'
indicators = [
    {'indicator': '', 'type': 'IPv4'},
    {'indicator': '', 'type': 'Domain'}
response = otx.create_pulse(name=name ,public=True ,indicators=indicators ,tags=[] , references=[])
print str(response)

Additional Examples:

More examples are at

You can’t perform that action at this time.