OpenCTI-Platform/opencti

OpenCTI is an open-source web platform for managing cyber threat intelligence and observables. It is aimed at organizations that need a shared, source-linked knowledge base for threat data rather than a one-off feed reader: analysts store technical and non-technical information, connect it to the report or event it came from, and use that structure to reason about threats.

What it does

The platform's core mechanism is a knowledge schema based on STIX2, which gives threat objects (indicators, TTPs, relationships and so on) a common structure. On top of that schema, OpenCTI links each piece of information to its primary source, and records first/last-seen dates and confidence levels. Once analysts have processed the data, new relations can be inferred from existing ones, which the project describes as extracting meaningful knowledge from raw data. A web UI supports visualization, and a GraphQL API exposes the platform to other tools README.

Working with other tools

Integration is a major part of the documented workflow. OpenCTI can connect to MISP and TheHive, uses the MITRE ATT&CK framework through a dedicated connector to help structure data, and supports user-provided datasets. Imports are documented, as are exports in formats such as CSV and STIX2 bundles. A connector ecosystem exists for further platform integrations README; setup and usage details live in the official documentation OpenCTI documentation.

Trying it and deploying it

A public demonstration instance, reset nightly and populated with reference data, lets people explore the platform before deploying demo instance. For real use, the project documents four installation paths — Docker, manual installation, community Terraform, and community Helm charts — with the specifics in the deployment documentation installation options. Platform releases are published separately, alongside a rolling package built from the master branch README.

Edition and other conditions

Two editions are offered. The Community Edition is under Apache 2.0; the Enterprise Edition has its own license and adds features described on Filigran's subscription page, and it is enabled from the platform settings README. Because the repository license is reported as NOASSERTION, anyone planning to redistribute or build a product on the code should read both license files rather than assume a single license covers everything. The platform also collects anonymous usage and health telemetry; the collected data and its use are documented separately telemetry documentation. The README notes that the project is under heavy development, so expect ongoing change rather than a frozen feature set.