 |
Previous Next Sheriff CSM Connecting to AlienVault Open Threat Exchange® AlienVault Open Threat Exchange® (OTX™) is an open information sharing and analysis network, created to put effective security measures within the reach of all organizations. Unlike invitation-only threat sharing networks, OTX provides real-time, actionable information to all who want to participate. Enabling AlienVault OTX in your installation will allow you to automatically share anonymous threat information with the OTX community. In return you will receive crowd-sourced threat updates every 30 minutes. The image below shows a sample of the data being sent from a AlienVault USM installation to OTX. The following data are collected
- The source and/or destination IP address of an event.
- The name of the event.
- The number of times such event occurred.
After you finish installing and configuring AlienVault USM (with OTX enabled), you will be able to quickly see which alarms indicate malicious activity from a known bad actor on the Alarms page. For more information, see Using OTX in AlienVault USM.
To enable OTX in your AlienVault USM installation, you must enter the OTX key and connect to your OTX account. If you do not have an OTX account and would like to sign up for it, you can do so from the Getting Started Wizard.
To join OTX from the Getting Started Wizard -
On the Join OTX screen, click Sign Up Now.
A popup takes you to the sign-up page on https://otx.alienvault.com/accounts/signup/.
-
Fill out the information (username, email address, and password) and click Sign Up.
A page appears informing you that a verification email with a link to OTX was sent to the email address you provided.
-
After you receive the email, click the link and, on the confirmation page for logged-in AlienVault USM users, click Login.
An AlienVault USM key page appears, displaying your OTX key and stating that the username you used to register for OTX is logged in.
- Copy the OTX key and paste it into the Enter OTX Key field shown in the following illustration.
-
Click Next.
The Thank You for Joining the Open Threat Exchange page appears.
-
Click Finish.
Important: After you click Finish, you cannot run the Getting Started Wizard again.
