IBM X-Force Exchange is a cloud-based threat intelligence platform for researching security threats, gathering intelligence, and collaborating with peers. Its reports provide context on IP addresses, URLs, malware hashes, web applications, signatures, and vulnerabilities. Logged-in users can search, comment, create collections, and share research. Collections may be public or private and can hold reports, comments, IP or URL data, and other research content. A QRadar plug-in supports IP and URL lookups from events and lets users submit information from searches, offenses, and rules to collections. API documentation covers IP and URL category feeds, reports, vulnerability feeds, and TAXII feeds, with JSON and STIX/TAXII formats. API access requires a purchased premium subscription; freemium API keys no longer provide API access. The listed free plan offers limited portal access, and guests cannot use all website features. The GUI requires a supported browser and a direct internet connection. API connections must use HTTPS with TLS 1.2 or newer. IBM says users can sign up for a 30-day trial of either dedicated Premium Threat Intelligence feed product.
Who it is for
X-Force Exchange may suit security teams researching indicators and sharing threat intelligence. IBM describes its API Enterprise license as suitable for security operations centers and managed security service providers.
What is good
- Reports cover indicators, malware, and vulnerabilities
- Collections can be public or private
- QRadar plug-in supports lookups and submissions
- API supports JSON and STIX/TAXII
What to know first
- Free plan has limited portal access
- Freemium API keys no longer access the API
- API use requires a purchased premium subscription
- Guests cannot use all website features
Verdict
X-Force Exchange combines threat research, collections, and QRadar-related workflows, while API access requires a paid premium subscription. The free portal plan is limited, so check that its access level fits your needs.
IBM X-Force Exchange plans and pricing
All plansCompared on threat intelligence platforms
- Free plan
- Yes
- Indicator enrichment
- Yes
- STIX/TAXII support
- Yes
- Report management
- Yes
- Workflow automation
- Yes
- Case management
- Yes
- Deployment
- cloud
