opencti-platform/opencti

★ 9,278TypeScriptAudience · ops devopsComplexity · 4/5LicenseSetup · hard

Mindmap

mindmap
  root((repo))
    What It Does
      Manage threat intel
      Link threats together
      Infer connections
    Standards
      STIX2 format
      MITRE ATT&CK
      MISP integration
    Setup
      Docker install
      Helm or Terraform
      Enterprise edition
    Use Cases
      Track threat actors
      Share intelligence
      Visualize attack chains
    Audience
      Security analysts
      SOC teams

mindmap root((repo)) What It Does Manage threat intel Link threats together Infer connections Standards STIX2 format MITRE ATT&CK MISP integration Setup Docker install Helm or Terraform Enterprise edition Use Cases Track threat actors Share intelligence Visualize attack chains Audience Security analysts SOC teams

Click or tap to explore — scroll the page freely

Things people build with this

USE CASE 1

Set up a central hub where your security team can store and link threat actor profiles, malware samples, and attack techniques.

USE CASE 2

Import threat intelligence from MISP or ATT&CK-tagged reports and visualize how everything connects.

USE CASE 3

Export structured threat data in STIX2 format to share with partner organizations or feed into other security tools.

USE CASE 4

Use the inference engine to automatically surface hidden connections between threats that were not explicitly recorded.

Tech stack

TypeScriptDockerSTIX2

Getting it running

Difficulty · hard Time to first run · 1day+

Requires Docker and multiple interconnected services, Enterprise Edition features require a paid Filigran subscription.

Community Edition is free to use and modify under Apache 2.0, Enterprise Edition adds extra features and requires a paid subscription from Filigran.

In plain English

OpenCTI is an open source platform for managing information about cyber threats. Security teams use it to collect, organize, and visualize what they know about the threat actors, malware, attack patterns, and vulnerabilities that are relevant to their organization. The idea is to bring all of that scattered knowledge into one place where analysts can see how things connect. The platform structures its data using an international standard called STIX2, which is a common format for sharing threat intelligence. This means information imported from other tools or sources arrives in a consistent shape, and information exported from OpenCTI can be read by other compatible systems. It connects with tools like MISP (a threat sharing platform) and supports the MITRE ATT&CK framework, which is a widely used catalog of adversary tactics and techniques. Analysts can tag their findings with ATT&CK categories to make reports easier to compare and search. The web interface lets you link pieces of information together, for example connecting a particular piece of malware to a threat actor to a set of observed attack techniques. You can record confidence levels, first- and last-seen dates, and trace every claim back to its original source document or report. The platform can also infer new relationships from existing ones, which can surface connections that were not explicitly recorded. OpenCTI comes in two editions. The Community Edition is open source under the Apache 2 license. The Enterprise Edition adds extra features and is available through a paid subscription from Filigran, the company that develops OpenCTI. The Enterprise Edition can be activated directly inside the platform settings. Installation is done via Docker, manual setup, or community-maintained Terraform and Helm configurations. A live demonstration instance is publicly available and resets nightly. The project is actively developed and accepts community contributions.

Copy-paste prompts

Prompt 1

How do I import a MISP event into OpenCTI and tag it with MITRE ATT&CK techniques?

Prompt 2

Walk me through linking a threat actor to a piece of malware and a set of attack patterns in OpenCTI.

Prompt 3

Set up OpenCTI using Docker and connect it to an existing MISP instance for threat intelligence sharing.

Prompt 4

What STIX2 object types does OpenCTI support and how do I create a relationship between two indicators?

Prompt 5

How do I activate the OpenCTI Enterprise Edition from within the platform settings after deployment?

Open on GitHub → Explain another repo

← opencti-platform on gitmyhub — every repo by this author, as a profile.

Verify against the repo before relying on details.