DOCSEARCHbyAlgolia
Submit Docs

OpenCTI Connectors

repository·master·Indexed 20 days ago

https://github.com/opencti-platform/connectors

A central hub for OpenCTI connectors providing integrations between the OpenCTI platform and external cybersecurity tools, feeds, and applications. Includes the connectors-sdk for building custom connectors using predefined models to create and link OpenCTI objects, as well as specific connector implementations such as AbuseIPDB IP Blacklist, Accenture ACTI, and the deprecated Abuse.ch SSL Blacklist.

Tokens
1.1M
Snippets
1.8K
Records
3.1K
Agent score
69%

What's inside opencti-platform-connectors

  1. Introduction to SentinelOne Intel Stream Connector

    master

    The SentinelOne Intel Stream Connector provides real-time synchronization of threat intelligence indicators from OpenCTI to SentinelOne as Indicators of Compromise (IOCs).

    When an Indicator is created in OpenCTI, the connector evaluates its STIX pattern and, if compatible, pushes it to a SentinelOne instance.

    Supported IOC Types:

    • File Hashes: SHA-256, SHA-1, MD5
    • Network Indicators: URLs, Domain names, IPv4 addresses

    Pattern Requirements:

    • The connector only supports single-element patterns (e.g., file:hashes.'SHA-256' = '<hash>').
    • Compound patterns containing logical operators (AND, OR, FOLLOWEDBY, etc.) or multiple observables are not supported and will be ignored.

  2. Introduction to the OpenCTI PromptIntel Connector

    master

    The PromptIntel connector imports adversarial AI prompt intelligence—specifically Indicators of Prompt Compromise (IoPC)—from the PromptIntel platform into OpenCTI. It tracks real-world prompt injections, jailbreaks, and other LLM attacks.

    Data Modeling in OpenCTI:

    • AI-Prompt observables: Contains the raw adversarial prompt text.
    • STIX Indicators: Uses pattern_type=stix with patterns like [ai-prompt:value = '...'].
    • Relationships: Uses based-on to link indicators to their corresponding observables.
    • Nova Indicators: Uses pattern_type=nova when a Nova detection rule is available, including a Sighting at the PromptIntel organization.

    Enrichment Details:

    • Labels: Derived from categories (manipulation, abuse, patterns, outputs), threat types (e.g., Jailbreak), and tags.
    • Score: A 0–100 value based on severity and community rating.
    • External references: Links to PromptIntel pages and author URLs.
    • Author identity: Classified as an individual or an organization.

  3. Overview of the Vulnerability Lookup Connector

    master

    The Vulnerability Lookup Connector imports CVE records from the Vulnerability Lookup API (provided by CIRCL) into OpenCTI. It maps this data to STIX Vulnerability objects.

    Key data imported includes:

    • CVSS v3.1 and v4.0 scoring
    • CWE references
    • External references (NVD, Mitre, advisories)

    The connector supports incremental imports based on the last update date to ensure efficient synchronization.

  4. Overview of the OpenCTI Import Document Connector

    master

    The OpenCTI Import Document Connector extracts threat intelligence from uploaded document files and feeds it into the OpenCTI platform. It supports parsing files in formats such as PDF, DOCX, TXT, HTML, Markdown, and CSV.

    It performs two primary functions:

    1. Entity Extraction: Matches text within documents against existing entities in the OpenCTI knowledge base (e.g., threat actors, malware, campaigns).
    2. Observable Extraction: Uses regex patterns and the ioc_finder library to extract Indicators of Compromise (IOCs) like IP addresses, domains, URLs, and hashes.

    The connector operates in two modes:

    • File Import: Parses uploaded files to create or update entities.
    • Internal Analysis: Analyzes files or entity fields to return structured analysis results.

  5. Overview of the RST Report Hub Connector

    master

    The RST Report Hub Connector automates the integration of APT reports, security blogs, and articles from various sources (government bodies, research groups, etc.) into OpenCTI.

    Key capabilities include:

    • Automated STIX 2.1 Conversion: RST Cloud converts human-readable text into structured STIX 2.1 bundles.
    • Rich Data Import: Imports PDF reports along with summaries, key ideas, and facts.
    • Entity Mapping: Automatically extracts and maps relationships between Intrusion Sets, campaigns, malware, TTPs, tools, geographic data, sectors, CVEs, and indicators.
    • Smart Indicator Handling: 'Noisy' or benign indicators (e.g., public DNS, CDNs) are created as Observables rather than Indicators to prevent false positives.
    • Entity Tracking: Uses cloud-level alias tracking to map objects with multiple names (like malware or adversaries) to a single entity across different taxonomies.

  6. Overview of the OpenCTI Stream Connector

    master

    The OpenCTI Stream connector subscribes to an OpenCTI live stream (via Server-Sent Events) and forwards each create or update event as a single STIX 2.1 bundle. It is designed to be lightweight by leveraging the standard OpenCTIConnectorHelper for output dispatching.

    Common Use Cases

    • Data Replication: Replicating data between OpenCTI instances via a unidirectional diode (using the diode-import connector on the target).
    • Air-gapped Synchronization: Using S3 as an intermediate buffer for cross-region or air-gapped environments.
    • In-platform Fan-out: Republishing a stream via RabbitMQ with proper applicant attribution for worker impersonation.

  7. Introduction to the OpenCTI UnpacMe Connector

    master

    The OpenCTI UnpacMe Connector integrates with UnpacMe, an automated malware unpacking service. It submits file artifacts to UnpacMe for analysis and imports the resulting data into OpenCTI.

    Key capabilities include:

    • Automated malware unpacking and sample extraction.
    • Malware family identification.
    • YARA rule matching.
    • Automatic creation of relationships between original packed samples and their unpacked counterparts.

  8. Overview of the OpenCTI PRODAFT USTA Connector

    master

    The USTA connector is an External Import connector that periodically fetches threat intelligence data from the USTA Threat Stream v4 API and converts it into STIX 2.1 bundles for OpenCTI.

    Key Capabilities:

    • Incremental Import: Uses per-feed cursors to ensure data is never re-imported.
    • Data Types: Imports malicious URLs, phishing sites, malware hashes, compromised credentials, credit card fraud tickets, and Deep Sight intelligence tickets.
    • Resilience: Features graceful degradation (one failing feed doesn't stop others), automatic batch splitting, rate limiting, and exponential-backoff retries.
    • Security: Raw passwords are not stored by default (must opt-in via USTA_STORE_CREDENTIAL_PASSWORD=true). Credit card numbers are automatically masked to BIN + last 4 digits.

  10. Overview of Email Intel Microsoft Connector

    master

    The Email Intel Microsoft Connector ingests cyber-threat-intelligence (CTI) reports from e-mail into the OpenCTI platform. It uses the Microsoft Graph API to poll a specific Microsoft 365 / Exchange Online mailbox.

    Key Behaviors:

    • Read-only: Messages remain untouched in the mailbox.
    • Report Creation: Each message is transformed into an OpenCTI Report where the subject is the name, the type is threat-report, the published date is the message date, and the body is the content.
    • Attachment Handling: Files are uploaded if their MIME type is in the configured allow-list.
    • TLP Marking: Applies a configurable default TLP (e.g., amber+strict).
    • Stateful: Persists last_run to track progress and supports a relative look-back window for the initial import.

  11. Overview of the OpenCTI AssemblyLine Connector

    master

    The OpenCTI AssemblyLine Connector is an internal-enrichment connector that integrates the AssemblyLine malware-analysis platform with OpenCTI.

    How it works: When an analyst or playbook requests enrichment for a StixFile or Artifact observable, the connector:

    1. Downloads the file from OpenCTI storage.
    2. Submits it to an AssemblyLine instance.
    3. Polls for completion.
    4. Ingests results back into OpenCTI.

    Data Ingested:

    • Malware-Analysis SDO: Records submission ID, profile, verdict, and score.
    • Note: Summarizes the verdict, indicator count, and provides the AssemblyLine portal link.
    • Indicators & Malware: Optionally creates STIX Indicator objects (domains, IPs, URLs) and Malware SDOs for attributed families.
    • Observables: Optionally creates Observable objects linked to indicators via based-on relationships (if ASSEMBLYLINE_CREATE_OBSERVABLES=true).
    • Attack Patterns: Optionally creates Attack-Pattern objects for MITRE ATT&CK techniques observed at runtime (if ASSEMBLYLINE_CREATE_ATTACK_PATTERNS=true).
    • External Reference: Adds a link back to the AssemblyLine submission on the enriched observable.

  12. Overview of the OpenCTI Import File MISP Connector

    master

    The OpenCTI Import File MISP connector is an internal import connector designed to parse MISP (Malware Information Sharing Platform) JSON export files and convert them into STIX 2.1 entities within OpenCTI.

    Key capabilities include:

    • Converting MISP events into OpenCTI Reports.
    • Creating Indicators and Observables from MISP attributes.
    • Mapping MISP objects to STIX observables.
    • Preserving MISP tags as OpenCTI labels.
    • Threat guessing (identifying malware, intrusion sets, etc.) from MISP tags when enabled.
    • Galaxy cluster mapping to STIX entities.

    This connector allows organizations to ingest threat intelligence from MISP exports without requiring a live network connection to the MISP instance.