Share What You See.
Protect Everyone.
When your organisation detects a threat, the entire Alliance blocks it within minutes. Contribute IoCs via API or F3D Agent, earn OFA Coins per verified submission, and collectively eliminate threats before they spread.
How Contribution Works
Members retain full control over their submissions. Data is managed entirely on-premises — you decide what to share, when to pause, and what to delete.
Detect on Your Network
Your SIEM, IDS, firewall, or F3D Agent identifies a malicious indicator — an IP, domain, URL, or file hash — during live operations or incident investigation.
Submit via Contribution API
Send the IoC as a JSON payload to OneFirewall's HTTPS API endpoint, including a timestamp, confidence score (0.0–1.0), source appliance tag, and optional STIX v2.0 bundle. Batches submit every 60 seconds.
Alliance Validation
OneFirewall cross-correlates your submission against existing data, validates confidence, and applies trust weighting based on your member tier and historical accuracy. Accepted IoCs update the Crime Score.
Earn OFA Coins, Protect Everyone
Your accepted IoC earns OFA Coins credited to your account. Simultaneously, all 180+ Alliance members receive the enriched, anonymised intelligence — blocking the threat across the entire ecosystem.
[
{
"source": "edge-fw-01",
"ip": "203.0.113.99",
"confidence": 0.87,
"notes": "SSH brute-force",
"tags": "brute-force,ssh"
},
{
"source": "web-waf-prod",
"ip": "198.51.100.12",
"confidence": 0.93,
"notes": "SQLi attempt",
"tags": "sqli,web-attack"
}
]
# Response
{
"accepted": 2,
"coins_credited": 6,
"status": "queued"
}
Privacy & GDPR Guarantees
Contribution never compromises your privacy or your users'. The Alliance is designed from the ground up for enterprise compliance.
Anonymised Identity
Other members see only updated Crime Scores — never the identity of the contributing member. Your threat observations remain confidential.
No PII in Transit
Submissions contain no personally identifiable information. Raw threat data — IPs, domains, hashes — never include user-linked attributes.
Full On-Prem Control
Data collection and sharing is managed entirely on your premises via the F3D Agent. Pause, stop, or delete submissions at any time — no lock-in.
GDPR Compliant
Alliance data handling is designed to meet GDPR requirements. Threat indicators are technical network data, not personal data — legally sound to share.
Start Contributing Today
Join the Alliance as a Consumer-and-Contributor member. Every IoC you share earns coins and protects 180+ organisations worldwide. Talk to our team to set up your account.