OpenCTI
by Filigran
French open-source cyber threat intelligence platform based on STIX 2.1.
- Category
- IT, Security & Monitoring
- Type
- Threat intelligence
- Interface
- GraphQL API
- Built with
- Connect Any API
- Credentials
- Access token
- Docs
- OpenCTI API docs
02Data
What you can sync.
- Indicators
- Reports
- Threat actors
- Observables
- Incidents
Keep OpenCTI indicators in your own Lake, on your servers, and report on it with the rest of IT.
Need more? Name any other OpenCTI data the API returns, and the AI adds it to the connector.
03Credentials
Credentials you will need.
- An access token
OpenCTI uses an access token. You add the credentials once, when the AI asks for them, and it tells you where to create them in Filigran if you need help.
04How it works
How it works in DataMind.
-
Pick OpenCTI.
Open Lake, pick OpenCTI in the source picker and name the connection. Connect Any API opens with a ready prompt that points the AI at the OpenCTI API docs.
-
Answer a few questions.
The AI reads the OpenCTI documentation, then asks which credentials you will use, which data to sync (for example indicators and reports), whether you want a one-time load or a recurring sync, and which accounts or filters apply.
-
Your data lands in Lake.
It builds the connector, tests it and shows you sample rows. Then OpenCTI data loads into your Lake on your schedule, ready for the Warehouse, DataPrism BI and AI Minds.
