Skip to main content
LevelBlue Labs™ is a threat data platform that provides open access for all, allowing you to collaborate with a worldwide community of threat researchers and security professionals. On the OTX page, you can connect the deployed USM Anywhere to your OTX account. Once connected, the sensor starts to receive raw pulse data from OTX and USM Anywhere correlates that data. When it detects Indicators of Compromise () interacting with in your environment, USM Anywhere generates related and -related and . The platform consists of these two chief components:
  • Pulses: Collections of , reported by the OTX community, which other community members review and comment on. Pulses provide you with a summary of the threat, a view into the software targeted, and the related IOCs, reported by the OTX community worldwide. See About OTX Pulses and IOCs.
  • IP Reputation: Provides of communication between known malicious and your assets. See About OTX IP Reputation.

​
About OTX Pulses and IOCs

The OTX community reports on and receives threat data in the form of pulses. A pulse consists of at least one, but more often multiple, Indicators of Compromise (IOCs). An IOC is an artifact observed on a network or in an end point, judged with a high degree of confidence to be a threat vector. Examples of threat vectors include campaigns or infrastructures used by an . This table provides a list of IOC types: Indicator of compromise (IOC) types

​
About OTX IP Reputation

OTX IP Reputation identifies IP addresses and domains worldwide that are submitted by the OTX community. IP Reputation verifies them as either malicious or, at least, suspicious until more data comes in to increase their threat ranking. Through its incoming IP data from all of these sources, IP Reputation supplements OTX data with valuable data about actively or potentially malicious activity appearing worldwide that can affect your systems.

​
IP Reputation Data Sources

IP Reputation receives data from a variety of sources:
  • Open-source intelligence: Public and private security research organizations.
  • USM Anywhere : Consists of users who have voluntarily agreed to anonymously share information about external traffic into their network with LevelBlue.
Note: LevelBlue ensures that none of the data shared with OTX can be traced to the contributor or their USM Anywhere deployment.

​
Who Has Access to IP Reputation?

All USM Anywhere users receive the benefit of IP Reputation data whether or not they sign up for an OTX account. When you open an OTX account, you may elect to share IP Reputation data with other OTX users. Any data you contribute are anonymous and secure.
Note: You can configure USM Anywhere to stop sharing IP Reputation data with OTX at any time by visiting the Open Threat Exchange Configuration page.

​
IP Reputation Ranking Criteria

IP Reputation uses ranking criteria based on IP Reliability and IP Priority that OTX updates on an ongoing basis to calculate changing assessments to risk level. This helps prevent .

​
IP Reliability

IP Reputation data derives from many data sources of differing reliability. Ranking in this case is based on the relative number of reports regarding a malicious IP in relation to others reported. If, for example, OTX receives 10 reports on a given IP address versus 20 on another, it gives the IP with 10 reports a lower reliability ranking than the IP with 20 reports.

​
IP Priority

OTX ranks IP address priority, based on the behavior associated with each IP address listed. For example, an IP address used as a scanning host receives a lower priority than an IP address known to have been used as a Botnet server.

​
Ongoing Ranking Reassessment

OTX constantly updates its IP Reputation data as new information emerges, affecting IP reliability or priority criteria. Each update re-prioritizes IP reliability and priority values and the threat level of an IP accordingly.