OpenCTI for structuring and analyzing cyber threat intelligence

OpenCTI is an open source platform that lets security teams structure, store, and visualize cyber threat intelligence and observables using STIX2 standards for defensive analysis.

Tool	OpenCTI-Platform/opencti — open source cyber threat intelligence management platform
Category	Threat intelligence platform / knowledge graph
Primary Use	Structuring, storing, and visualizing threat intelligence — TTPs, observables, attributions, victimology — in a STIX2-based knowledge schema for analyst workflows
Safe Use	Intended for authorized defensive operations: CTI teams, SOC analysts, and researchers correlating threat data within their organization or lab environments
Telemetry Note	The platform itself collects anonymous usage and health telemetry, documented in its usage telemetry docs; as a defensive knowledge base it leaves no footprint on third-party systems

OpenCTI, developed by the French company Filigran, is one of the most mature open source projects in the threat intelligence space, and the repository's roughly ten thousand stars and TypeScript codebase reflect a serious, production-grade engineering effort rather than a weekend experiment. The platform's core purpose is to give organizations a place to structure, store, organize, and visualize both technical and non-technical information about cyber threats. What distinguishes it from a simple indicator database is its knowledge-graph approach: every piece of information — from a file hash to a suggested attribution to a victimology pattern — is a node that can be linked to other nodes and, critically, to its primary source, whether that source is a vendor report, a MISP event, or an internal investigation note.

The data model is built on the STIX2 standards from OASIS, which is the right architectural decision for anyone who needs interoperability in the CTI ecosystem. STIX2 provides the vocabulary for entities like threat actors, malware, attack patterns, indicators, and observables, and the relationships between them. OpenCTI's implementation layers analyst-friendly semantics on top of this: first-seen and last-seen dates on relationships, confidence levels on assertions, and the ability to attach sourcing to every claim. This last point deserves emphasis for professionals who have to defend their intelligence product to stakeholders — being able to trace any conclusion in the graph back to the original reporting is what separates defensible intelligence from aggregated rumor.

Under the hood, the platform is designed as a modern web application with a GraphQL API as its primary interface and a UX-focused frontend. The GraphQL choice is significant operationally: everything the UI can do, an automation pipeline can do through the same API, which makes OpenCTI a plausible backbone for programmatic enrichment, feeding detection systems, or building custom analyst tooling without scraping web interfaces. The API-first design also underpins the connector ecosystem, which the README highlights as a first-class mechanism for interoperation with tools like MISP, TheHive, and the MITRE ATT&CK corpus through a dedicated connector.

The MITRE ATT&CK integration is worth dwelling on because it shapes how analysts actually work inside the platform. Through the connector, ATT&CK's matrices of tactics, techniques, and procedures become navigable entities in the graph, so a piece of reporting about a technique can be tied directly to the canonical framework definition. This supports the stated goal of capitalizing technical information such as TTPs and observables alongside softer intelligence like suggested attribution. Users are not locked into ATT&CK either — the README explicitly notes that custom datasets can be implemented, which matters for organizations tracking threats specific to their sector or region that generic frameworks underrepresent.

A capability that elevates OpenCTI beyond passive storage is inference of new relations from existing ones. Once analysts have capitalized and processed data, the platform can derive additional relationships automatically, which the README positions as a way to facilitate understanding and representation of the information. For a working analyst, this is the difference between maintaining a filing cabinet and having an assistant that occasionally surfaces a connection you had not drawn yourself — a report linking a malware family to an infrastructure cluster, combined with another report linking that cluster to an actor, can yield the actor-to-malware edge without anyone asserting it manually.

Data flows both ways. On the import side, the documentation describes automated import pipelines; on the export side, OpenCTI supports feeds in multiple formats including CSV and STIX2 bundles. This export capability is the practical glue for defensive automation — curated intelligence inside the platform can be pushed out to detection engineering workflows, SIEM deployments, or partner organizations in standard formats. The connector hub, hosted by Filigran, catalogs integrations that accelerate interactions with other platforms, and the ecosystem around MISP in particular makes OpenCTI a natural companion rather than a competitor to existing sharing communities.

Deployment flexibility is solid for an operationally sensitive system. The documentation offers four installation paths: Docker, manual installation, community-maintained Terraform configurations, and community Helm charts for Kubernetes. For a platform that typically ends up handling sensitive intelligence, the availability of Helm charts signals that real deployments are containerized and scaled, and Docker images are published under the opencti organization on Docker Hub. A rolling release package is also generated from the master branch for those who want to track development closely, alongside standard GitHub releases.

Licensing follows a dual-edition model that professionals should understand before committing. The Community Edition (CE) is licensed under Apache 2.0, while an Enterprise Edition (EE) exists under a separate license, providing additional features that Filigran says require dedicated research and development investment. The EE can be enabled directly in the platform settings, which suggests a single codebase with feature gating rather than a fork. For most defensive teams starting out, the CE covers the documented core: the knowledge schema, GraphQL API, connectors, inference, and import/export. Organizations evaluating long-term should read the Filigran offering page to know exactly where the CE boundary sits.

The project's operational maturity shows in its surrounding signals. The README points to a public demonstration instance at demo.opencti.io, reset nightly and seeded with reference data maintained by the developers — a low-friction way to evaluate the platform before deploying anything. A Slack community of over six thousand members, a documented code of conduct, beginner-friendly issues for new contributors, and dedicated development environment documentation round out the picture. Continuous integration via Drone, code coverage tracking through Codecov, and automated dependency updates via Renovate indicate that the codebase is actively maintained and tested.

One transparency item deserves attention from a governance perspective: OpenCTI collects anonymous statistical data related to usage and health, documented in the usage telemetry section of the official docs. This is disclosed openly in the README, and organizations with strict data-handling requirements should review exactly what is collected before production deployment, as with any self-hosted platform that phones home. This is not hidden behavior, but it belongs in your deployment checklist.

In terms of where OpenCTI fits in an authorized defensive workflow, it occupies the analyst-facing layer of a mature security operation: upstream of raw telemetry collection and SIEM correlation, downstream of feed ingestion, and adjacent to case management tools like TheHive. It is not an attack tool and does not facilitate offensive activity — it is the knowledge infrastructure that helps defenders understand adversaries. For teams drowning in unstructured vendor PDFs and scattered indicators, converting that material into a queryable, sourced, confidence-scored graph is precisely the problem this platform exists to solve, and the STIX2 foundation means the investment survives vendor churn.

The bottom line for evaluation purposes: OpenCTI is a defensive platform with a substantial community, a documented and standards-based architecture, and deployment paths ranging from a single Docker host to Kubernetes. Its strengths are the knowledge schema, the GraphQL automation surface, and the connector ecosystem; its considerations are the dual-licensing model and the anonymous telemetry. For an authorized CTI program of almost any size, it remains one of the default answers to the question of where structured threat knowledge should live.

Official project repository for OpenCTI-Platform/opencti.

Download Tool

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.