OpenCTI-Platform/opencti
Opencti
OpenCTI is a cyber threat intelligence platform and knowledge base used to store, manage, and analyze technical security data. It functions as a threat intelligence visualization tool and an enterprise security data orchestrator that maps relationships between threat actors, malware, and vulnerabilities.
The platform utilizes the STIX and TAXII standards for data representation and exchange, allowing for the sharing and receiving of standardized intelligence bundles. It distinguishes itself by converting complex security information into visual relationship diagrams and geographic maps to identify threat patterns and the physical origin of threats.
The system covers broad capability areas including real-time threat streaming, automated data feed generation, and cybersecurity infrastructure orchestration. It also provides access control features such as FIPS compliance enforcement and the configuration of public, unauthenticated data feeds.
Features
- Threat Entity Relationship Graphs - Maps disparate threat entities through a network of edges to visualize complex attack patterns.
- Threat Intelligence Platforms - Provides a comprehensive platform for managing and analyzing cyber threat intelligence using STIX and TAXII standards.
- Threat Intelligence Platforms - Stores technical threat data using standardized schemas to organize intelligence for detailed security analysis.
- Standardized Threat Intelligence Exports - Serves standardized threat intelligence bundles to external systems via secure TAXII API endpoints.
- Graph Data Models - Employs a graph-based data model following STIX standards to represent cyber threat intelligence and relationships.
- Real-Time Data Streaming - Implements real-time data streaming for the delivery of live threat intelligence updates and entity changes.
- Cyber Threat Intelligence Maps - Converts complex security information into visual diagrams and maps to reveal threat patterns.
- Security Data Orchestrators - Automates the collection, streaming, and distribution of threat feeds across cloud infrastructure.
- Standardized Threat Intelligence Exchange - Facilitates the exchange of standardized threat intelligence bundles with external systems via secure APIs.
- Threat Relationship Visualizations - Converts complex security information into visual diagrams to reveal relationships and patterns between different threat entities.
- Distributed Document Indexing - Utilizes Elasticsearch for high-performance full-text searching and retrieval of structured intelligence data.
- Container Orchestrators - Uses container orchestrators to manage the lifecycle and resource allocation of isolated microservices.
- Container Stack Management - Manages related container services as a single logical unit to simplify resource scaling.
- Distributed Task Workers - Offloads heavy processing and feed generation to distributed task workers to maintain API responsiveness.
- Infrastructure Orchestrators - Automates the lifecycle and state management of the security platform's multi-cloud resource stacks.
- Kubernetes Deployments - Deploys and scales application components using standardized Helm charts on Kubernetes clusters.
- Real-Time Intelligence Push - Maintains persistent WebSocket connections to push real-time threat intelligence updates to clients.
- Message Brokers - Implements a Redis-based message broker for asynchronous task queuing and decoupled service communication.
- Threat Intelligence - Platform for managing cyber threat intelligence.
- Security Lab Environments - Platform for managing and sharing cyber threat intelligence.
