What it does
OpenCTI is an open-source threat-intelligence platform using STIX 2.1 to standardize information from feeds and internal security tools.
OpenCTI standardizes feeds and internal intelligence using STIX 2.1. Analysts can correlate actors, malware, techniques and indicators in a knowledge graph, then share prioritized intelligence with operational teams or partners. Choose a specific intelligence question before connecting every feed. The Community Edition is Apache 2.0; Enterprise capabilities use a separate Filigran license even though they are distributed in the same codebase. Check that distinction when an evaluation depends on the advertised automation or AI features.
Strengths
- STIX-based intelligence standardization
- Integration and visualization workflows
Best for
- Threat-intelligence teams consolidating several sources