OpenCTI

OpenCTI is a cyber threat intelligence platform for managing knowledge and observables. It structures, stores, organizes, and visualizes technical and non-technical threat information, including TTPs, observables, attribution, victimology, and source-linked context.

Everything sits on a STIX2-based knowledge schema, served through a web app with a GraphQL API. Analysts link findings to primary sources, record first and last seen dates, set confidence levels, map MITRE ATT&CK, import data, export CSV and STIX2 bundles, and infer new relationships from existing ones.

Connectors integrate it with MISP, TheHive, MITRE ATT&CK, and many other tools to ingest and push intelligence automatically. It is self-hosted and deploys via Docker, manual install, Terraform, or Helm, with the Community Edition under an Apache 2.0 license.