Skip to content
Install MCP

Threat feed

AlienVault Reputation

Last fetched

Reputation · refreshed hourly · last verified

AlienVault Reputation is a Reputation threat-intelligence feed, refreshed hourly, indexed by WhisperGraph.

What is AlienVault Reputation

AlienVault Reputation is a community-driven IP reputation feed published by AT&T Cybersecurity (formerly Open Threat Exchange). It aggregates indicators from honeypots, security researchers, and OTX pulse contributors into a single deny-list of IPs observed engaging in scanning, brute-force authentication attempts, and other low-level abuse. Each address carries a confidence score derived from the number of independent sightings; entries fall off the list when reports stop arriving. Network defenders use it as a low-false-positive overlay for outbound proxy filtering and SIEM enrichment; threat hunters use it as a starting point for pivoting on observed scanners.

Source
https://otx.alienvault.com/
Refresh cadence
hourly

Category drift. The curated category for this feed is Reputation, while WhisperGraph currently files it under reputation.

Indicators currently listed

No indicator in WhisperGraph currently links to AlienVault Reputation. That is not the same as the feed being empty — the graph indexes a subset of every feed’s published entries.

Related pages

Pivot from AlienVault Reputation into the indicators it lists.

Queries

Resolves the feed's categories.


MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categories
Run yourself →

The indicator-kind rollup and sample listed above.


MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESC
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.