zoom_in Click to enlarge

OpenCTI

▲ ▼

language

description OpenCTI Overview

OpenCTI is an open-source platform for managing and analyzing cybersecurity intelligence. It offers a graph database to store, query, and visualize threat intelligence data. Key features include customizable dashboards, real-time alerts, and integration with various security tools.

Ideal for organizations needing robust threat intelligence management.

help OpenCTI FAQ

What kind of data does OpenCTI store?

OpenCTI stores structured cyber-threat intelligence such as threat actors, malware, campaigns, indicators, vulnerabilities, and relationships between them. It uses the STIX 2 standard to represent much of this information.

What technology is used by OpenCTI for its graph data?

OpenCTI uses a graph-oriented data model and commonly relies on components such as Elasticsearch, Redis, RabbitMQ, and MinIO in its deployment architecture. The exact stack depends on the release and installation method.

Can OpenCTI import threat feeds automatically?

Yes. OpenCTI supports connectors for importing and exporting intelligence from external tools and feeds. Connectors can handle sources such as MISP, STIX/TAXII services, and security platforms when configured.

Who develops OpenCTI?

OpenCTI is an open-source project originally created by Filigran. Its interface and data model are designed for teams that need to investigate and relate threat-intelligence objects rather than store indicators in a flat list.

swap_horiz

Looking for OpenCTI alternatives? Compare top competitors ranked & scored

arrow_forward