README

Note: Building connectors, contributing to the platform, or running OpenCTI in production?

 Join us on the
 Community Slack to ask questions, talk through a PR before you open it, or compare notes on integrations.

 Introduction

OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. It has been created in order to structure, store, organize and visualize technical and non-technical information about cyber threats.

The structuration of the data is performed using a knowledge schema based on the STIX2 standards. It has been designed as a modern web application including a GraphQL API and a UX-oriented frontend. Also, OpenCTI can be integrated with other tools and applications such as MISP, TheHive, MITRE ATT&CK, etc.

!Screenshot

 Objective

The goal is to create a comprehensive tool allowing users to capitalize technical (such as TTPs and observables) and non-technical information (such as suggested attribution, victimology etc.) while linking each piece of information to its primary source (a report, a MISP event, etc.), with features such as links between each information, first and last seen dates, levels of confidence, etc. The tool is able to use the MITRE ATT&CK framework (through a dedicated connector) to help structure the data. The user can also choose to implement their own datasets.

Once data has been capitalized and processed by the analysts within OpenCTI, new relations may be inferred from existing ones to facilitate the understanding and the representation of this information. This allows the user to extract and leverage meaningful knowledge from the raw data.

OpenCTI not only allows imports but also exports of data under different formats (CSV, STIX2 bundles, etc.). Connectors are currently developed to accelerate interactions between the tool and other platforms.

 Editions of the platform

OpenCTI platform has 2 different editions: Community (CE) and Enterprise (EE). The purpose of the Enterprise Edition is to provide additional and powerful features which require specific investments in research and development. You can enable the Enterprise Edition directly in the settings of the platform.

 OpenCTI Community Edition, licensed under the Apache 2, Version 2.0 license.
 OpenCTI Enterprise Edition, licensed under the Enterprise Edition license.

To understand what OpenCTI Enterprise Edition brings in terms of features, just check the Enterprise Editions page on the Filigran website. You can also try this edition by enabling it in the settings of the platform.

 Documentation and demonstration

If you want to know more on OpenCTI, you can read the documentation on the tool. If you wish to discover how the OpenCTI platform is working, a demonstration instance is available and open to everyone. This instance is reset every night and is based on reference data maintained by the OpenCTI developers.

 Releases download

The releases are available on the Github

Top issues

Discussions

Latest release

Enhancements:

- 19195 feat(graph): Run an enrichment connector from the investigation graph’s right-click menu

 Bug Fixes:

- 19610 perf(engine): drop redundant clauses from the access filters added to every search
- 18298 fix(background-task): Avoid creating large query background tasks without filters
- 19702 fix(public-dashboards): widgets of a public dashboard are shorter than in the dashboard they were laid out in
- 19676 fix(scope): activity log improvements
- 19629 fix(cache): an edit that lands while the cache is loading is lost, so a started playbook may never run
- 18075