Introduction to OpenDXL

The goal of the Open Data Exchange Layer (OpenDXL) is to enable security devices to share intelligence and orchestrate security operations in real time.

What is OpenDXL?

OpenDXL lets developers join an adaptive system of interconnected services that communicate and share information to make real-time, accurate security decisions. OpenDXL leverages the Data Exchange Layer (DXL), which many vendors and enterprises already utilize, and delivers a simple, open path for integrating security technologies regardless of vendor.


Designed to improve the context of analysis, shorten workflows of the threat defense lifecycle, reduce complexities across security products and vendors, and increase the value of previously deployed applications, OpenDXL enables unprecedented collaboration in an open, real-time system. By attaching to a common application framework, each participant enters into a unified ecosystem, one that gains value and capability as the network effect activates.

DXL Evolution

DXL has expanded over time to allow an increasing number of products to integrate with the fabric.

  • McAfee Products

    Initially DXL was used solely by McAfee products.

  • SIA Partner Products

    The next step in the DXL evolution was to provide the opportunity for Security Innovation Alliance (SIA) partner products to integrate with the fabric.

  • OpenDXL

    OpenDXL allows anyone to develop (and share) integrations using "OpenDXL" clients, services, and brokers.