OpenCTI: what it is and how to use it

What is OpenCTI?

OpenCTI (Open Cyber Threat Intelligence) is an open source platform to collect, organize, correlate and share threat intelligence. Developed by Filigran, it stores information following the STIX 2.1 standard: threat actors, campaigns, malware, MITRE ATT&CK techniques, indicators (IOCs), observables, reports and the relationships between all of them. The result is a knowledge graph where you can answer questions like "which groups use this malware and which techniques do they rely on?".

The community platform is free and open source. Filigran also offers an Enterprise edition and commercial services; check its website for what each option includes.

What OpenCTI is used for

Centralizing threat intelligence: bringing open feeds, vendor reports and your own intelligence into one place.
Enriching SOC alerts: given a suspicious IP or hash, seeing whether it is tied to a known campaign.
Mapping threats to MITRE ATT&CK: learning which techniques the actors targeting your sector use and prioritizing defenses.
Sharing intelligence: exporting STIX or integrating with MISP, TAXII and other platforms.
Feeding detection tools: pushing indicators to SIEM, EDR or firewalls through connectors.

How to install OpenCTI

The easiest way is Docker Compose using the official OpenCTI-Platform/docker repository. OpenCTI depends on several services (Elasticsearch or OpenSearch, Redis, RabbitMQ and S3 storage such as MinIO), so you need a machine with plenty of RAM; check the requirements in the official documentation.

git clone https://github.com/OpenCTI-Platform/docker.git opencti-docker
cd opencti-docker
cp .env.sample .env
# Edit .env: admin credentials, passwords and UUIDs/tokens
# You can generate UUIDs with:
cat /proc/sys/kernel/random/uuid

sudo sysctl -w vm.max_map_count=1048575
docker compose up -d

Once all containers are up, go to http://localhost:8080 and log in with the admin email and password you set in .env.

Practical OpenCTI examples

1. Load knowledge with connectors

An empty instance isn't much use. Connectors are services (usually containers) that import or enrich data. The first ones almost everyone enables:

MITRE ATT&CK: imports tactics, techniques, groups and software.
OpenCTI Datasets: reference sectors, countries and organizations.
Open IOC feeds (for example from abuse.ch or AlienVault OTX).
Enrichment with services such as VirusTotal or Shodan (they need their own API key).

Each connector is added as another service in docker-compose.yml with its token and configuration.

2. Investigate an indicator

Search for the IP, domain or hash in the global search bar.
Open the observable and review the knowledge tab: related reports, malware and intrusion sets.
Use the graph view to explore relationships and trigger a manual enrichment if you have connectors configured.

3. Automate with the Python API

OpenCTI exposes a GraphQL API and an official Python client, pycti (install the version that matches your platform):

pip install pycti

from pycti import OpenCTIApiClient

api = OpenCTIApiClient("http://localhost:8080", "YOUR_API_TOKEN")
for ind in api.indicator.list(first=10):
    print(ind["name"], ind["pattern"])

You'll find your API token in your user profile inside the platform.

Pro tips

Start with a few well-chosen connectors: importing everything blindly fills the database with noise.
Use TLP markings on reports to control what can be shared and with whom.
Set confidence levels per source to separate verified data from dubious feeds.
Monitor resource usage: Elasticsearch is usually the first thing to run out of memory.
Integrate OpenCTI with your SIEM so indicators turn into detections, not just a pretty database.

OpenCTI pros and cons

Pros	Cons
Free and open source	Needs significant server resources
Standard STIX 2.1 data model	Deployment and maintenance are not trivial
Large connector catalog	Learning curve for the STIX model
Native MITRE ATT&CK integration	Some advanced features belong to the Enterprise edition

OpenCTI alternatives

MISP: an open IOC sharing platform, very widespread and compatible with OpenCTI.
Maltego: visual link analysis for OSINT investigations.
NetworkMiner: to pull from network captures the indicators you then investigate.
CyberChef: to decode and defang IOCs before importing them.

Frequently asked questions

Is OpenCTI free?

Yes, the OpenCTI community platform is free and open source. Filigran also offers an Enterprise edition and paid services; check prices and terms on its website.

What is the difference between OpenCTI and MISP?

MISP focuses on sharing indicators between organizations; OpenCTI focuses on modeling the full knowledge picture (actors, campaigns, techniques and relationships). Many teams run both, connected.

How much RAM does OpenCTI need?

It depends on data volume and connectors. A modest server is fine for testing, but production will need much more memory. Check the up-to-date requirements in the official documentation.

How do I start using OpenCTI?

Deploy it with Docker, enable the MITRE ATT&CK connector, import a public campaign report and explore its entities and relationships in the graph view.

If you want to strengthen your defensive skills with hands-on exercises, there is content in the Hackers en Acción Academy.

OpenCTI

// DESCRIPTION