IBM X-Force Exchange
- 1Runs onAPI, Web
- 2CostsFree plan · free trial
- 3Indicator enrichmentYes
- 4STIX/TAXII supportYes
- 5Report managementYes
- 6Workflow automationYes
- 7Case managementYes
- 8Deploymentcloud
Overview
IBM X-Force Exchange is a cloud-based threat intelligence platform for researching security threats, collecting intelligence, and collaborating with peers. Its reports provide context for IP addresses, URLs, malware hashes, web applications, signatures, and vulnerabilities. Logged-in users can search, comment, share research, and create public or private collections containing indicators, reports, and other research content. A QRadar plug-in looks up IP and URL information from events and lets users send data from searches, offenses, and rules to collections. The API documentation covers IP and URL category feeds, reports, vulnerability feeds, and TAXII feeds, with JSON and STIX/TAXII formats. However, API use requires a purchased premium subscription; freemium API keys no longer have API access. The free plan provides limited portal access, and guest users cannot use every website feature. The GUI requires a supported browser and a direct internet connection. IBM describes API Enterprise as suitable for security operations centers and managed security service providers.
Who it is for
The portal suits security teams researching indicators and organizing threat intelligence collaboratively. IBM identifies its API Enterprise license for security operations centers and managed security service providers.
What is good
- Reports cover indicators, malware hashes, and vulnerabilities.
- Collections can be public or private.
- QRadar plug-in supports IP and URL lookups.
- API supports JSON and STIX/TAXII.
What to know first
- Freemium API keys no longer access the API.
- API access requires a purchased premium subscription.
- Guest users cannot use every website feature.
- GUI requires a supported browser and direct internet.
Verdict
X-Force Exchange combines threat research, collections, and QRadar lookups, with broader feed access through its API. The free portal is limited, and API access requires a purchased premium subscription.
IBM X-Force Exchange plans and pricing
All plansCompared on threat intelligence platforms
- Free plan
- Yesexchange.xforce.ibmcloud.com
- Indicator enrichment
- Yesexchange.xforce.ibmcloud.com
- STIX/TAXII support
- Yesexchange.xforce.ibmcloud.com
- Report management
- Yesexchange.xforce.ibmcloud.com
- Workflow automation
- Yesexchange.xforce.ibmcloud.com
- Case management
- Yesexchange.xforce.ibmcloud.com
- Deployment
- cloudexchange.xforce.ibmcloud.com
Facts
- Purpose
- IBM X-Force Exchange is a cloud-based threat intelligence platform for researching security threats, aggregating actionable intelligence and collaborating with peers.ibm.com · 30 Sept 2026
- Threat lookup
- The QRadar plug-in can search Exchange information for IP addresses, URLs, CVEs and web applications found in QRadar.ibm.com · 30 Sept 2026
- Collections
- Collections can hold IP or URL data, reports, comments and other research content, and can be public or private.ibm.com · 30 Sept 2026
- Collaboration
- The platform includes searching, commenting, collections and sharing for logged-in users.xfe-integration.xforce.ibm.com · 30 Sept 2026
- API capabilities
- The API documentation describes access to IP and URL category feeds and reports, vulnerability feeds, and TAXII feeds.xfe-development.xforce.ibm.com · 30 Sept 2026
- API access
- Using the API requires purchasing a premium subscription through an IBM sales representative or the X-Force Threat Intelligence page.xfe-development.xforce.ibm.com · 30 Sept 2026
- API security
- The API accepts HTTPS connections supporting TLS 1.2 or newer and rejects other connections.xfe-development.xforce.ibm.com · 30 Sept 2026
- API credentials
- API keys and passwords are specific to the user's ID, do not expire, and the password is shown only when generated.xfe-development.xforce.ibm.com · 30 Sept 2026
- QRadar integration
- The Exchange plug-in lets QRadar users look up IP and URL data from events and submit data from searches, offenses and rules to collections.ibm.com · 30 Sept 2026
- Feed integration
- The Advanced Threat Protection Feed provides machine-readable indicators for integration with security tools such as firewalls, intrusion prevention systems and SIEMs through open standards.ibm.com · 30 Sept 2026
- Limits
- Guest users cannot use all features of the X-Force Exchange website.ibm.com · 30 Sept 2026
- Support
- Customers with a commercial ATP feed or Commercial API license can open IBM Support tickets; other inquiries can be emailed to [email protected].ibm.com · 30 Sept 2026
- Availability
- IBM identifies X-Force Exchange as platform independent, and its documented GUI requirements include a workstation or mobile device with a supported browser and a direct internet connection.ibm.com · 30 Sept 2026
- Threat data
- X-Force Exchange reports include context for IP addresses, URLs, malware hashes, web applications, signatures and vulnerabilities.ibm.com · 30 Sept 2026
- API formats
- The API supports JSON and STIX/TAXII for accessing and integrating threat intelligence.ibm.com · 30 Sept 2026
- Trial
- IBM Support says users can sign up for a 30-day trial of either dedicated Premium Threat Intelligence feed product.ibm.com · 30 Sept 2026
- API limit
- IBM says Freemium API keys no longer have access to the X-Force API.ibm.com · 30 Sept 2026
- Platform requirements
- The Exchange GUI requires a workstation or mobile device with a supported browser and a direct internet connection; the Commercial API requires a compatible third-party application.ibm.com · 30 Sept 2026
- Audience
- IBM describes the API Enterprise license as suitable for security operations centers and managed security service provider use cases.ibm.com · 30 Sept 2026
Best IBM X-Force Exchange alternatives
See all 20
Where it ranks on Specifiction
Is IBM X-Force Exchange yours?
Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.
Sources
- ibm.com/support/pages/x-force-exchange-tutorial· checked 30 Sept 2026
- ibm.com/docs/SSKMKU/com.ibm.qradar.doc/c_IBM_xf· checked 30 Sept 2026
- xfe-integration.xforce.ibm.com/activity/map· checked 30 Sept 2026
- xfe-development.xforce.ibm.com/api/doc/· checked 30 Sept 2026
- ibm.com/docs/en/qradar-common· checked 30 Sept 2026
- ibm.com/docs/en/qsip/7.5· checked 30 Sept 2026
- ibm.com/support/pages/node/550527· checked 30 Sept 2026
- ibm.com/docs/en/announcement_archive/ENUSA16-03· checked 30 Sept 2026
- ibm.com/docs/en/cloud-pak-sec-aas· checked 30 Sept 2026
- ibm.com/support/pages/qradar-siem-x-force-api-a· checked 30 Sept 2026
- ibm.com/docs/en/announcement_archive/ENUSLP18-0· checked 30 Sept 2026