OpenCTI-Platform/opencti
Open Cyber Threat Intelligence Platform
Build with Backblaze B2
SDKs, agent skills, IDE extensions, and reference pipelines from Backblaze Labs. All open source.
Loading star history...
Where it stands
Rank, growth pace and release cadence relative to everything GStars tracks.
5 releases in the last 90 days, the latest 1 day ago, with 207 contributors on GitHub.
Use Cases & Benefits
- Provides an open source platform to manage, structure, and visualize cyber threat intelligence data using STIX2 standards and a GraphQL API.
- Enables integration with multiple cybersecurity tools and frameworks, facilitating comprehensive threat data correlation and analysis.
- Use for centralizing and organizing cyber threat intelligence from diverse sources to enhance security operations.
- Use for automating imports and exports of threat data in various formats to streamline intelligence sharing workflows.
- Use for leveraging MITRE ATT&CK framework integration to enrich threat analysis and improve detection strategies.
Should you depend on it?
License terms, project hygiene and risks, from GitHub metadata and GStars' snapshots.
License
Other
GitHub could not identify this license; read the LICENSE file before depending on it.
Community files
- README: present
- Contributing guide: present
- Code of conduct: present
Watch-outs
- License not identified by GitHub; read the LICENSE file before depending on it.
General guidance from repository metadata, not legal advice. How we score
From the README
OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. It has been created in order to structure, store, organize and visualize technical and non-technical information about cyber threats.
The structuration of the data is performed using a knowledge schema based on the STIX2 standards. It has been designed as a modern web application including a GraphQL API and an UX oriented frontend. Also, OpenCTI can be integrated with other tools and applications such as MISP, TheHive, MITRE ATT&CK, etc.
The goal is to create a comprehensive tool allowing users to capitalize technical (such as TTPs and observables) and non-technical information (such as suggested attribution, victimology etc.) while linking each piece of information to its primary source (a report, a MISP event, etc.), with features such as links between each information, first and last seen dates, levels of confidence, etc. The tool is able to use the MITRE ATT&CK framework (through a dedicated connector) to help structure the data. The user can also choose to implement their own datasets.
Daily snapshots
Stars gained per day, and how forks and open issues moved, from GStars' daily snapshots
Forks
1.5K+62
Open issues
2.3K+146
Compared with peers in Security
Fastest-growing repositories GStars tracks in this cohort for the week of Nov 8, by 7-day star growth
| Repository | Stars | +7d | Health | Last release |
|---|---|---|---|---|
| cloudflare/security-audit-skill | 69.3K | +10.7K | 75 | — |
| vxcontrol/pentagi | 33.9K | +719 | 75 | 36 days ago |
| GyulyVGC/sniffnet | 42.3K | +422 | 75 | 111 days ago |
| soxoj/maigret | 39.9K | +332 | 60 | 87 days ago |
| Asymptote-Labs/agent-beacon | 3.4K | +315 | 75 | 1 day ago |
| OpenCTI-Platform/opencti | 10.3K | — | 75 | 1 day ago |
| Category median | 39.9K | +422 | 75 | — |
Discover Repositories
Search across tracked repositories by name or description