OpenCTI

Open-Source Cyber-Threat Intelligence Platform

OpenCTI is a platform that allows organizations to manage their cyber threat knowledge and information. It facilitates the structuring, storage, organization and visualization of technical and non-technical data related to cyber threats, such as TTPs, observables, suggested attributions and victimology. The tool allows you to link each piece of information to its primary source and use the MITER ATT&CK framework to structure the data. In addition, OpenCTI makes it easy to infer new relationships from existing data and allows you to import and export information in various formats, such as CSV and STIX2.

OpenCTI solves the problem of managing and organizing knowledge about cyber threats, allowing organizations to structure, store and visualize technical and non-technical information. It facilitates the understanding and representation of data, improving the ability to extract and leverage meaningful knowledge from raw information.

OpenCTI is an open source platform that enables organizations to manage their cyber threat intelligence knowledge. It structures, stores, and visualizes technical and non-technical threat information, linking each piece of information to its primary source. It uses the MITRE ATT&CK framework to structure data and allows importing and exporting information in various formats.

OpenCTI models all its objects as STIX 2 and exposes them through a GraphQL API; it also generates CSV feeds. Developers only need to understand STIX 2 to create connectors, reducing coupling with commercial sources and maintaining a coherent and open knowledge graph.