OpenCTI Guide
Master OpenCTI, the open source threat knowledge management platform for centralizing and analyzing cyber threat information.
Key features
Threat management
Centralize cyber threat information
Graph visualization
Visual representation of relationships between entities
Collaboration
Sharing and collaboration between analysts
Integrations
Connect with MISP, STIX and other platforms
Real-time alerts
Automatic notifications and alerts
Timeline analysis
Track threats over time
Data types
Observables
Indicators of compromise and artifacts
Examples:
Entities
Actors, groups and organizations
Examples:
Incidents
Security events and campaigns
Examples:
Malwares
Malware and its families
Examples:
Vulnerabilities
Security flaws and exploits
Examples:
Rapports
Documentation and analysis
Examples:
Installation and setup
System requirements
Minimum requirements
- Docker and Docker Compose
- 8 GB RAM minimum
- 50 GB of disk space
- Ports 8080, 4000, 5432 available
Docker installation
Deploy with Docker Compose
# Clone the repository git clone https://github.com/OpenCTI-Platform/docker.git opencti-docker cd opencti-docker # Configure environment variables cp .env.sample .env # Set at least OPENCTI_ADMIN_EMAIL, OPENCTI_ADMIN_PASSWORD, # OPENCTI_ADMIN_TOKEN (a UUIDv4) and the service passwords nano .env # Start OpenCTI docker compose up -d
Initial setup
Basic settings
- Open http://localhost:8080
- Sign in with the OPENCTI_ADMIN_EMAIL / OPENCTI_ADMIN_PASSWORD set in .env
- Change the password
- Configure the basic settings
Available integrations
MISP
MISP synchronization
STIX/TAXII
STIX/TAXII standard support
Connectors
External connectors
SIEM
SIEM integration
API usage examples
Authentification
Connecting to the GraphQL API
# Every GraphQL request authenticates with the API token
# (shown in the user profile)
curl -X POST http://localhost:8080/graphql \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{"query": "{ me { name user_email } }"}'Create an observable
Add an indicator
mutation {
stixCyberObservableAdd(
type: "IPv4-Addr"
IPv4Addr: { value: "203.0.113.50" }
x_opencti_score: 80
) {
id
entity_type
observable_value
}
}Search entities
Search query
query {
stixCoreObjects(types: ["Malware"], first: 10) {
edges {
node {
id
entity_type
... on Malware {
name
labels
}
}
}
}
}Best practices
Data management
Organize information efficiently
- Use a consistent taxonomy
- Validate data sources
- Maintain data quality
- Document your processes
Threat analysis
Analysis methodology
- Correlate indicators
- Analyze patterns over time
- Identify campaigns
- Assess confidence
Collaboration
Better teamwork
- Share knowledge
- Use comments
- Assign responsibilities
- Maintain traceability
Quick start
Installation
Deploy OpenCTI with Docker and configure the services
Data import
Import your first threat intelligence data
Analysis
Explore the data with the visualization tools
Automation
Configure connectors and automation
STIX 2.1 compatibility
OpenCTI is fully compatible with the STIX 2.1 standard, ensuring maximum interoperability with other threat intelligence platforms.
Ready to put it into practice?
CyberXTEL is our free platform to train hands-on: certifications, CTFs and a dedicated cyber awareness space.