## 1. Project Overview & Quickstart (OpenCTI-Platform/opencti) ## File: README.md

[](https://opencti.io)

## Introduction OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. It has been created in order to structure, store, organize and visualize technical and non-technical information about cyber threats. The structuration of the data is performed using a knowledge schema based on the [STIX2 standards](https://oasis-open.github.io/cti-documentation/). It has been designed as a modern web application including a [GraphQL API](https://graphql.org) and a UX-oriented frontend. Also, OpenCTI can be integrated with other tools and applications such as [MISP](https://github.com/MISP/MISP), [TheHive](https://github.com/TheHive-Project/TheHive), [MITRE ATT&CK](https://github.com/mitre/cti), etc. ## Objective The goal is to create a comprehensive tool allowing users to capitalize technical (such as TTPs and observables) and non-technical information (such as suggested attribution, victimology etc.) while linking each piece of information to its primary source (a report, a MISP event, etc.), with features such as links between each information, first and last seen dates, levels of confidence, etc. The tool is able to use the [MITRE ATT&CK framework](https://attack.mitre.org) (through a [dedicated connector](https://github.com/OpenCTI-Platform/connectors)) to help structure the data. The user can also choose to implement their own datasets. Once data has been capitalized and processed by the analysts within OpenCTI, new relations may be inferred from existing ones to facilitate the understanding and the representation of this information. This allows the user to extract and leverage meaningful knowledge from the raw data. OpenCTI not only allows [imports](https://docs.opencti.io/latest/usage/import-automated/) but also [exports of data](https://docs.opencti.io/latest/usage/feeds/) under different formats (CSV, STIX2 bundles, etc.). [Connectors](https://hub.filigran.io/cybersecurity-solutions/open-cti-integrations) are currently developed to accelerate interactions between the tool and other platforms. ## Editions of the platform OpenCTI platform has 2 different editions: Community (CE) and Enterprise (EE). The purpose of the Enterprise Edition is to provide [additional and powerful features](https://filigran.io/offering/subscribe) which require specific investments in research and development. You can enable the Enterprise Edition directly in the settings of the platform. * OpenCTI Community Edition, licensed under the [Apache 2, Version 2.0 license](LICENSE). * OpenCTI Enterprise Edition, licensed under the [Enterprise Edition license](LICENSE). To understand what OpenCTI Enterprise Edition brings in terms of features, just check the [Enterprise Editions page](https://filigran.io/offering/subscribe) on the Filigran website. You can also try this edition by enabling it in the settings of the platform. ## Documentation and demonstration If you want to know more on OpenCTI, you can read the [documentation on the tool](https://docs.opencti.io). If you wish to discover how the OpenCTI platform is working, a [demonstration instance](https://demo.opencti.io) is available and open to everyone. This instance is reset every night and is based on reference data maintained by the OpenCTI developers. ## Releases download The releases are available on the [Github releases page](https://github.com/OpenCTI-Platform/opencti/releases). You can also access the [rolling release package](https://releases.opencti.io) generated from the master branch of the repository. ## Installation All you need to install the OpenCTI platform can be found in the [official documentation](https://docs.opencti.io). For installation, you can: * [Use Docker](https://docs.opencti.io/latest/deployment/installation/#using-docker) * [Install manually](https://docs.opencti.io/latest/deployment/installation/#install-manually) * [Use Terraform (community)](https://docs.opencti.io/latest/deployment/installation/#terraform) * [Use Helm charts (community)](https://docs.opencti.io/latest/deployment/installation/#helm-charts) ## Contributing ### Code of Conduct OpenCTI has adopted a [Code of Conduct](CODE_OF_CONDUCT.md) that we expect project participants to adhere to. Please read the [full text](CODE_OF_CONDUCT.md) so that you can understand what actions will and will not be tolerated. ### Contributing Guide Read our [contributing guide](CONTRIBUTING.md) to learn about our development process, how to propose bugfixes and improvements, and how to build and test your changes to OpenCTI. ### Beginner friendly issues To help you get familiar with our contribution process, we have a list of [beginner friendly issues](https://github.com/OpenCTI-Platform/opencti/labels/beginner%20friendly%20issue) which are fairly easy to implement. This is a great place to get started. ### Development If you want to actively help OpenCTI, we created a [dedicated documentation](https://docs.opencti.io/latest/development/environment_ubuntu/) about the deployment of a development environment and how to start the source code modification. ## Community ### Status & bugs Currently OpenCTI is under heavy development, if you wish to report bugs or ask for new features, you can directly use the [Github issues module](https://github.com/OpenCTI-Platform/opencti/issues). ### Discussion If you need support or you wish to engage a discussion about the OpenCTI platform, feel free to join us on our [Slack channel](https://community.filigran.io). You can also send us an email to contact@filigran.io. ## About ### Authors OpenCTI is a product designed and developed by the company [Filigran](https://filigran.io). [](https://filigran.io) ### Data Collection #### Usage telemetry To improve the features and the performances of OpenCTI, the platform collects anonymous statistical data related to its usage and health. You can find all the details on collected data and associated usage in the [usage telemetry documentation](https://docs.opencti.io/latest/reference/usage-telemetry/). #### OpenStreetMap server To provide OpenCTI users with cartography features, the platform uses a dedicated OpenStreetMap server (https://map.opencti.io). To monitor usage and adapt service performance, Filigran collects access logs to this server (including IP addresses). By using this server, you authorize Filigran to collect this information. Otherwise, you are free to deploy your own OpenStreetMap server and modify the platform configuration accordingly. If you have started using the Filigran server and change your mind, you have the right to access, limit, rectify, erase and receive your data. To exercise your rights, please send your request to privacy@filigran.io. --- ## File: docs/README.md # OpenCTI Documentation Space [](https://opencti.io) [](https://community.filigran.io) ## Introduction This is the main repository of the OpenCTI Documentation space. The online version is available directly on [docs.opencti.io](https://docs.opencti.io). ## Install and display the documentation locally Clone the repository: ```sh git clone git@github.com:OpenCTI-Platform/opencti.git cd docs ``` Install dependencies ```sh pip install -r requirements.txt ``` Run local server with hot-reload: ```sh mkdocs serve ``` It should display the following output in the terminal: ``` > Starting server at http://localhost:8000/ ``` ⚠️ Make sure to always build the documentation locally before submitting a pull request, and check for errors and warnings in the terminal output,as they can indicate issues with the formatting of the documentation. ```sh mkdocs build ``` ## Contribute You can contribute to the documentation by submitting a pull request on GitHub. Please make sure to follow the [contribution guidelines](https://github.com/OpenCTI-Platform/opencti?tab=contributing-ov-file#contributing-to-opencti). ### Caveats The following notable issues have been identified in the past and should be checked before submitting a pull request. #### Bullet or ordered lists not rendered properly ```md Some text - Item 1 - Item 2 ``` Will not be rendered properly, and displayed as a paragraph. To fix this, make sure to add a blank line before the first item in the list: ```md Some text - Item 1 - Item 2 ``` #### Anchored links not working When linking to a section in the same page, make sure to use the correct anchor link. For instance: ```md ## My (super) section ``` Will be accessible with the following link: `#my-super-section` (all lowercase, spaces replaced by dashes, and special characters removed). #### Documentation page not accessible from the sidebar Make sure to add new documentation pages in the `mkdocs.yml` file under the `nav` section. Then, make sure to build the documentation locally and check for errors and warnings in the terminal output. ## Deploy the documentation The deployment relies on `mike`. ### Check existing versions List existing versions with: ```sh mike list ``` ### Deploy and update the current version With the right version number (eg. 5.7.X): ```sh mike deploy --push [version] ``` ### Deploy a new stable version With the right version number (eg. 5.7.X), update the `latest` tag: ```sh mike deploy --push --update-aliases [version] latest ``` ## 2. Official Technical Reference & Guides (OpenCTI-Platform/docs) ## File: README.md # This repository has been archived You can find all OpenCTI documentation in the `docs` directory of [OpenCTI repository](https://github.com/OpenCTI-Platform/opencti) ## About OpenCTI is a product designed and developed by the company [Filigran](https://filigran.io). [](https://filigran.io) --- ## File: docs/index.md --- hide: - navigation - toc --- # OpenCTI Documentation Space Welcome to the OpenCTI Documentation space. Here you will be able to find all documents, meeting notes and presentations about the platform. !!! info "Release notes" Please, be sure to also take a look at the [OpenCTI releases notes](https://github.com/OpenCTI-Platform/opencti/releases), they may contain important information about releases and deployments. ## Introduction OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. It has been created in order to structure, store, organize and visualize technical and non-technical information about cyber threats. !!! tip "Docker deployment of the full XTM suite (OpenCTI - OpenAEV - OpenGRC)" If you're looking for information about the deployment of the full eXtended Threat Management (XTM) suite using Docker, please refer [to this repository and documentation](https://github.com/FiligranHQ/xtm-docker). ## Getting started - :material-rocket-launch-outline:{ .lg .middle } __Deployment & Setup__ --- Learn how to deploy and configure the platform as well as launch connectors to get the first data in OpenCTI. [:octicons-arrow-right-24:{ .middle } Deploy now](deployment/overview.md) - :fontawesome-regular-compass:{ .lg .middle } __User Guide__ --- Understand how to use the platform, explore the knowledge, import and export information, create dashboard, etc. [:octicons-arrow-right-24:{ .middle } Explore](usage/getting-started.md) - :material-tune-vertical:{ .lg .middle } __Administration__ --- Know how to administrate OpenCTI, create users and groups using RBAC / segregation, put retention policies and custom taxonomies. [:octicons-arrow-right-24:{ .middle } Customize](administration/introduction.md) !!! info "Need more help?" We are doing our best to keep this documentation complete, accurate and up to date. If you still have questions or you find something which is not sufficiently explained, join the [Filigran Community on Slack](https://community.filigran.io). ## Blog posts - :material-newspaper-variant-outline:{ .lg .middle } __Resources and content__ --- Discover tutorials, best practices and deep dives on OpenCTI features on our Filigran blog. [:octicons-arrow-right-24:{ .middle } Read now](https://blog.filigran.io) ## Additional resources Below, you will find external resources which may be useful along your OpenCTI journey. [**:material-package-variant-closed:{ .middle } OpenCTI Ecosystem**](https://filigran.notion.site/OpenCTI-Ecosystem-868329e9fb734fca89692b2ed6087e76) List of available connectors and integrations to expand platform usage. [**:material-school-outline:{ .middle } Training Courses**](https://academy.filigran.io) Training courses for analysts and administrators in the Filigran Academy. [**:material-youtube:{ .middle } Video materials**](https://www.youtube.com/@Filigran/videos) Set of video illustrating the implementation of use cases and platform capabilities.