OpenCTI-Platform/opencti

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

9854 stars · 1438 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

OpenCTI is an open-source platform for managing cyber threat intelligence knowledge, including observables, TTPs, and threat actor information. It structures data using a STIX2-based knowledge schema and provides a GraphQL API with a modern web frontend, integrating with tools like MISP, TheHive, and MITRE ATT&CK.

Use cases

• manage cyber threat intelligence knowledge in one place
• structure threat data using STIX2 standards
• visualize relationships between threat actors, malware, and indicators
• integrate threat feeds from MISP and MITRE ATT&CK
• share threat intelligence across a SOC team
• track IOCs and observables with confidence levels and first/last seen dates
• infer new relations from existing threat intelligence data

When to choose

• you need a self-hosted threat intelligence platform with a STIX2 data model
• you want to aggregate and correlate CTI from multiple sources like MISP and ATT&CK
• your SOC needs to visualize and disseminate threat knowledge to analysts
• you want an open-source alternative to commercial TIPs

When to avoid

• you only need simple IOC list storage without knowledge graph relationships
• you need a lightweight SIEM or log analysis tool rather than a CTI platform
• you cannot operate a multi-service Docker deployment with Elasticsearch and Redis dependencies

Facets

application · maturity active

search-engine graphql api-framework web-framework data-visualization security osint analytics security osint self-hosted self-hosted cross-platform threat-intelligence stix2 cti mitre-attack misp knowledge-graph cyber-threat-intelligence connectors docker web-server nodejs

Member repositories

For agents

markdown · JSON · MCP: product_card(name="OpenCTI-Platform/opencti")