Skip to content

Back to the catalog

OpenCTI-Platform/opencti
github.comrepo

OpenCTI-Platform/opencti

OpenCTI is an open source cyber threat intelligence platform for structuring, storing, and visualizing technical (TTPs, observables) and non-technical (attribution, victimology) threat data, built on the STIX2 standard with a GraphQL API and connector framework. It integrates with tools like MISP, TheHive, and MITRE ATT&CK, supports inferred relationships between data points, and offers both an Apache 2.0 Community Edition and a paid Enterprise Edition with additional features.

TL;DR Open source STIX2-based threat intelligence platform for organizing IOCs, TTPs, and CTI knowledge, with MISP/TheHive/MITRE ATT&CK integrations.
Open original ↗
Document

What it is

OpenCTI is a threat intelligence platform developed by the company Filigran. The README lists several practical details that the catalog summary leaves out.

Preconditions / Affected

  • Telemetry: the platform collects anonymous statistical data on usage and health. The README points to a "usage telemetry" documentation page for the details. Check it before deploying in a restricted or air-gapped environment. The README does not say whether telemetry can be disabled.
  • Enterprise Edition: the EE is enabled from the platform's settings, so it is a toggle inside the same install and not a separate download. CE is Apache 2.0. EE uses a separate Enterprise Edition license. Anyone planning to use EE features should read that license first. The README sends readers to the Filigran website for the EE feature list and does not give one.

What to do

  • Try the public demo instance before installing. It is open to everyone, resets every night, and runs on reference data maintained by the OpenCTI developers.
  • Choose a build from the GitHub releases page. A rolling release package built from the master branch is also available.
  • Follow the official documentation for installation. The README does not give install commands or system requirements.
  • For data exchange, the README names CSV and STIX2 bundles as export formats. MITRE ATT&CK data comes in through a dedicated connector. Users can also load their own datasets.
  • For help, use the community Slack (suggested for connector development and production deployments), GitHub issues, or contact@filigran.io.

Caveats

The README calls the project "under heavy development". It gives no version numbers, hardware sizing or security guidance, and no list of which connectors exist.

Organisations named here

  • STIX2

Technologies named here

  • OpenCTI
  • MISP
  • TheHive
  • MITRE ATT&CK
  • GraphQL

Related in Threat Intel