After successfully logging in, OTX displays the OTX Home page as shown below.
The OTX Home page provides a top row of main menu selections, Home (), Browse, Create Pulse, and Search ( ). On the far-right side of the menu bar, the OTX UI displays your username and two additional menu choices, Settings ( ) and Help ( ).
Main Activity Feed
The main, middle portion of the display provides an activity feed or stream of OTX pulses. At the top of this stream, the OTX user interface provides three main tab selections to display results for Pulses, Activity, and Suggested Edits.
Default selection. Displays current pulses based on selected filter criteria:
SUBSCRIBED — Displays pulses to which you’ve already subscribed. (See Note below.) You are automatically subscribed to all pulses contributed by AlienVault.
ALIENVAULT — Displays only pulses contributed by AT&T Alien Labs™.
NEW — Latest pulses added to the threat activity feed (from all contributors).
UPDATED — Latest updates to all pulses previously reported to OTX.
TOP PROMOTED — Top promoted pulses added to the system by all contributors. Promotion or demotion indicates relative popularity and value of pulses, as voted on by OTX members.
Displays updates and events related to your pulse activities:
• Comments by an OTX member on one of your pulses.
• Creation of a new pulse by an OTX member you subscribe to or follow.
• New comments by a subscriber to one of your pulses.
|SUGGESTED EDITS||Displays suggested edits on pulses you’ve contributed and suggested edits on other members’ pulse contributions.|
By default, OTX displays all OTX pulses and contributions from members you’ve already been following or have subscribed to, plus those originating from the Alien Labs, AlienVault’s internal threat research team. Besides the short results displayed for each pulse, you can click on a specific pulse in the results list, to view more detailed information about the pulse, additional attributes, and indicators of compromiseAn artifact observed with some degree of confidence to be an indication of a threat or intrusion. (IOCs) for the pulse.
Note: The Home page activity feed displays pulses both for contributors you are following, as well as pulses you are subscribing to. When you subscribe to a contributor’s pulse contributions, all of the subscribed contributors’ pulses and IOCs are also downloaded into your local security monitoring environment, such as USM Appliance or AlienVault OSSIM (when you have configured the OTX API for such integration). See OTX Data with External Security Monitoring Systems for more information on integrating OTX with specific USM Appliance, AlienVault OSSIM, or other third-party security platforms using the AlienVault DirectConnect API.
Home Page — Left Side Panel
A left side panel provides a summary of your current user profile including basic statistics on pulses you are monitoring, OTX members and groups whose contributions you have subscribed to or are following, members who are following your contributions, and so on.
In this panel, you can click the Find a Group link or the Plus ( ) button to find and join other groups of OTX users that you may share interests with. You can choose options to Join an Existing Group, Join a Private Group, or Create a Group.
Note: Joining groups means you will get alerts when pulses are added, and you can retrieve pulses more easily into a SIEM solution using the OTX DirectConnect API. Some groups are private, so pulses contributed from those groups can only be viewed if you are a member.
In the left-side panel, you can click the Profile ( ) button to view pulses sorted, in order, by different categories.
By default, the result list shows pulses across all categories. From the tab menu bar, you can select to view pulses by categories such as by Groups (N), Followers (N), Following (N), Subscribers (N), and Subscribing (N).
Home Page — Right Side Panel
The right-side of the main display provides some quick selection options to display pulses for either top or recommended OTX contributors.
You can mouse over the contributor avatar icons to see the name of individual contributors. Clicking on any avatar brings up a display of the pulses submitted by the contributor you selected.