Data & Analytics · IBM X-Force Exchange + Claude
IBM X-Force Exchange MCP with Claude: Faster Threat Research for Security Teams
The short answer
Claude works with IBM X-Force Exchange through the Model Context Protocol (MCP), an open standard that lets Claude securely use other software with permissions the organisation controls. Once connected, Claude can search threat intelligence, enrich indicators of compromise and manage collections when a team member asks in plain language. Sign-in uses an API key.
What is IBM X-Force Exchange?
IBM X-Force Exchange is a threat intelligence sharing platform. Security teams use it to research emerging cyber threats, look up malicious files, domains and IP addresses, and collaborate on the latest cybersecurity insights. It brings together information from many sources so analysts can understand what a threat is, how it behaves and how serious it might be. Security operations centres, threat researchers and incident response teams are its typical users, along with IT and risk leaders who need clear, current threat context.
How Claude connects to IBM X-Force Exchange through MCP
The Model Context Protocol is an open standard that acts like a universal adapter between Claude and other software. It lets Claude read information from a tool and take actions in it, using a defined and secure connection. For IBM X-Force Exchange, the connection can be made through an MCP server or through the platform's direct API, depending on what suits the organisation best.
Once connected, Claude can typically search for threats, enrich indicators such as file hashes, domains and IP addresses, analyse threat intelligence and manage collections. A team member might ask, in ordinary language, for everything known about a suspicious domain, and Claude retrieves and summarises the relevant context from the platform.
Permissions and approvals keep people in charge. Access uses an API key and is limited to the actions the organisation allows. Consequential steps, such as changing or sharing collections, can be set to require a person's approval before they happen, and every request can be logged for review.
What you can automate
Rapid indicator enrichment
When an analyst receives a suspicious file hash or IP address, Claude can look it up in X-Force Exchange and return a clear summary of reputation, associated threats and related context. This shortens the time spent switching between screens and copying results, so analysts can reach a decision sooner during an active alert.
Threat research briefings
Threat researchers often need to understand a new campaign or malware family quickly. Claude can search the platform for a named threat, pull together the key findings and draft a briefing for the security leadership team. The researcher reviews the draft before it is shared, keeping expert judgement at the centre.
Collection management
Teams that group related indicators into collections can ask Claude to create, update or review them using natural language. For example, a team might gather indicators linked to a particular phishing campaign into one collection for ongoing monitoring, with changes reviewed before they take effect.
Analyst onboarding and knowledge support
Newer analysts can ask Claude to explain unfamiliar threat terms, walk through how an indicator was assessed or summarise past research on a topic. This helps junior staff learn faster while senior analysts spend less time answering routine questions.
Weekly threat landscape reporting
Security managers often prepare regular reports on the threats most relevant to their sector. Claude can gather recent intelligence from the platform on agreed topics and produce a structured first draft, which the security team checks and refines before it reaches executives.
An end-to-end workflow: Phishing alert triage and case update
TriggerThe email security system flags a suspicious message containing a link and an attachment.
The alert is passed to Claude, which extracts the domain, file hash and sender address.
Claude queries IBM X-Force Exchange to enrich each indicator and summarises known reputation and associated threats.
Claude checks the findings against the organisation's existing records in the ticketing system and notes any matching past incidents.
Claude drafts a triage summary and a recommended action, such as blocking the domain.
A security analyst reviews the summary and approves or edits the recommended action before anything is changed.
The approved outcome and supporting evidence are recorded in the ticket for the audit trail.
OutcomeAnalysts typically spend less time on initial enrichment and documentation, so suspicious messages are triaged faster and each decision is recorded with its supporting evidence.
How we set it up
Free automation audit
We begin with a no-cost review of your security and threat research workflows to identify where faster intelligence lookups and clearer reporting would help most.
Secure connection design
We connect Claude to IBM X-Force Exchange through an MCP server or the direct API, using API key sign-in and the minimum access your team needs.
Workflow design across your systems
We map the end-to-end process across the platform and your other systems, such as Microsoft 365, ticketing or your SIEM, with people approving consequential actions.
Testing and launch
We test the workflow against real past cases, then launch with monitoring and audit logs so every action can be reviewed.
Team training
We train your analysts and managers on how to use Claude with the platform, what it can and cannot do, and when human approval is required.
Who benefits
- Security operations analysts
- Faster enrichment of alerts and indicators, with summaries that are ready to review.
- Threat researchers
- Quicker access to related intelligence and first-draft briefings to refine.
- Incident response leads
- Clearer, documented evidence trails for each decision made during an incident.
- CISOs and security managers
- Regular, structured threat landscape reporting with less manual preparation.
Security and control
- Access uses an API key with least-privilege permissions limited to the actions your team needs.
- Consequential actions, such as changing or sharing collections, can require named human approval.
- Every request and response can be logged for audit and review.
- Claude is configured to present findings and recommendations rather than act autonomously on security decisions.
- Credentials are stored securely and rotated according to your organisation's policy.
For teams in the US, UK, India and the Middle East
Organisations in the United States and the United Kingdom can host the connection and any custom application on Claude in their chosen region to meet local expectations on data handling. Indian organisations are subject to the Digital Personal Data Protection Act, 2023, and can choose India-based hosting where appropriate. Businesses in the Middle East, including the UAE and Saudi Arabia, must consider local data protection laws, and we select a hosting region that meets those requirements for each engagement.
Learn more about Claude and MCP
Anthropic's AI model and assistant.
Secure links between Claude and business tools.
How engineers build and change software with Claude.
Hosted agents that run multi-step work.
The open standard Claude uses to connect to tools.
Frequently asked questions
What does the IBM X-Force Exchange MCP server do?
It gives Claude a secure way to work with IBM X-Force Exchange. Through it, Claude can search threat intelligence, enrich indicators such as hashes, domains and IP addresses, analyse findings and manage collections, all based on requests written in plain language. The server acts as a controlled connection, so Claude only reaches the actions your organisation has permitted.
Is connecting Claude to IBM X-Force Exchange secure?
Security is designed in from the start. Access uses an API key with least-privilege permissions, and sensitive actions can require human approval. Requests can be logged for audit, and credentials are stored and rotated securely. We review the setup with your security team before launch, so you can confirm it fits your policies.
What can Claude actually do with IBM X-Force Exchange?
Typically, Claude can search for threats, look up and enrich indicators, summarise threat intelligence, help draft briefings and manage collections when asked. It works through the connection you approve, so the exact capabilities depend on how the workflow is designed for your team.
How long does setup take?
Timescales depend on how many workflows you want to automate and how your systems are arranged. A focused connection with one or two workflows is often ready within a few weeks, including testing and team training. We confirm a realistic timeline during the free automation audit.
Which plan or permissions do I need?
In general, you need an IBM X-Force Exchange account that can generate an API key, along with the permissions your team requires for the actions you want Claude to take. Because access levels vary by account, we review your current setup during the audit and confirm what is needed before any connection is made.