opencti

OpenCTI is an open source platform designed to help organizations manage their cyber threat intelligence knowledge and observables. It structures, stores, organizes, and visualizes both technical and non-technical information about cyber threats. The data schema is based on STIX2 standards, and the platform includes a modern web application with a GraphQL API and a user-friendly frontend. It can integrate with other tools such as MISP, TheHive, and MITRE ATT&CK. The platform aims to capitalize technical information (like TTPs and observables) and non-technical information (such as attribution and victimology), linking each piece to its primary source. It supports features like relationships between data points, first and last seen dates, confidence levels, and can leverage the MITRE ATT&CK framework through dedicated connectors. Users can also implement custom datasets. OpenCTI supports both import and export of data in various formats (CSV, STIX2 bundles, etc.), and connectors are developed to facilitate integration with other platforms. The platform is available in two editions: Community (CE) under Apache 2.0 license, and Enterprise (EE) with additional features requiring a subscription. The Enterprise Edition can be enabled in the platform settings. Documentation is available at docs.opencti.io, and a demonstration instance is accessible at demo.opencti.io. Installation options include Docker, manual installation, Terraform, and Helm charts. The project encourages contributions and has a code of conduct and contributing guide. It is developed by Filigran and collects anonymous usage telemetry to improve features and performance.