What problem it solves

Organizations need to structure, store, organize, and visualize technical and non-technical cyber threat information while linking it to primary sources. They also need to relate that information, infer useful connections, and exchange data with other platforms and tools.

Key features

• Structured threat intelligence — Organize technical and non-technical information through a knowledge schema based on STIX2 standards. Users can also implement their own datasets.

  Source: README, docs

• Source-aware knowledge model — Link each piece of information to its primary source and capture relationships, dates, and confidence levels. This provides context for analysis across reports, events, TTPs, and observables.

  Source: README, opencti-platform/opencti-graphql

• Relationship-based analysis — Infer new relationships from information processed by analysts to support understanding and representation of threat knowledge. The investigation graph provides a way to explore and enrich this information.

  Source: README, opencti-platform/opencti-front

• Data exchange — Import and export threat intelligence data in formats including CSV and STIX2 bundles. This supports movement of information into and out of the platform.

  Source: README, scripts

• Platform integrations — Use connectors to accelerate interactions with other platforms and applications. The project also provides a GraphQL API and a UX-oriented frontend as parts of the web application.

  Source: README, opencti-platform/opencti-graphql, opencti-platform/opencti-front

Who it may suit

This platform may suit cyber threat intelligence teams, analysts, and organizations that need to structure, relate, and exchange threat knowledge across technical and non-technical sources.

Topics to discuss

• Which knowledge schema extensions would help teams represent their threat intelligence more effectively?

• How should connectors balance automatic enrichment with analyst-controlled investigation workflows?

• Which import, export, and data-sharing workflows should receive the most community attention?

Written by ReadmeX AI from the project's README, source and public GitHub data; it may contain mistakes.

Read the original README https://github.com/OpenCTI-Platform/opencti#readme

ReadmeX opened this community for a trending project; it is not run by the project. Maintainers can claim it from the community page.