66

GitHub - OpenCTI-Platform/opencti: Open Cyber Threat Intelligence Platform

 4 years ago
source link: https://github.com/OpenCTI-Platform/opencti
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.

README.md

OpenCTI

68747470733a2f2f696d672e736869656c64732e696f2f62616467652f776562736974652d6f70656e6374692e696f2d626c75652e737667 68747470733a2f2f696d672e736869656c64732e696f2f62616467652f446f63756d656e746174696f6e2d5254464d2d6f72616e67652e737667 68747470733a2f2f736c61636b2e6c75617469782e6f72672f62616467652e737667    68747470733a2f2f636972636c6563692e636f6d2f67682f4f70656e4354492d506c6174666f726d2f6f70656e6374692e7376673f7374796c653d736869656c64 DeepScan grade    68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f72656c656173652f4f70656e4354492d506c6174666f726d2f6f70656e6374692e737667 68747470733a2f2f696d672e736869656c64732e696f2f646f636b65722f70756c6c732f6f70656e6374692f706c6174666f726d

Introduction

OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. It has been created in order to structure, store, organize and visualize technical and non-technical information about cyber threats.

The structuration of the data is performed using a knowledge schema based on the STIX2 standards. It has been designed as a modern web application including a GraphQL API and an UX oriented frontend. Also, OpenCTI can be integrated with other tools and applications such as MISP, TheHive, MITRE ATT&CK, etc.

Screenshot

Objective

The goal is to create a comprehensive tool allowing users to capitalize technical (such as TTPs and observables) and non-technical information (such as suggested attribution, victimlogy etc.) while linking each piece of information to its primary source (a report, a MISP event, etc.), with features such as links between each information, first and last seen dates, levels of confidence etc. The tool is able to use the MITRE ATT&CK framework (through a dedicated connector) to help structure the data. The user can also chose to implement its own datasets.

Once data has been capitalized and processed by the analysts within OpenCTI, new relations may be inferred from existing ones to facilitate the understanding and the representation of this information. This allow the user to extract and leverage meaningful knowledge from the raw data.

OpenCTI not only allows imports but also exports of data under different formats (CSV, STIX2 bundles, etc.). Connectors are currently developped to accelerate interactions between the tool and other platforms.

Documentation and demonstration

If you want to know more on OpenCTI, you can read the documentation on the tool. If you wish to discover how the OpenCTI platform is working, a demonstration instance is available and open to everyone. This instance is reset every night and is based on reference data maintened by the OpenCTI developers.

Releases download

The releases are available on the Github releases page. You can also access to the rolling release package generated from the mater branch of the repository.

Installation

All you need to install the OpenCTI platform can be found in the official documentation. For installation, you can:

Contributing

Code of Conduct

OpenCTI has adopted a Code of Conduct that we expect project participants to adhere to. Please read the full text so that you can understand what actions will and will not be tolerated.

Contributing Guide

Read our contributing guide to learn about our development process, how to propose bugfixes and improvements, and how to build and test your changes to OpenCTI.

Beginner friendly issues

To help you get you familiar with our contribution process, we have a list of beginner friendly issues which are fairly easy to implement. This is a great place to get started.

Development

If you want to actively help OpenCTI, we created a dedicated documentation about the deployment of a development environement and how to start the source code modification.

Community

Status & bugs

Currently OpenCTI is under heavy development, if you wish to report bugs or ask for new features, you can directly use the Github issues module.

Discussion

If you need support or you wish to engage a discussion about the OpenCTI platform, feel free to join us on our Slack channel. You can also send us an email to [email protected].

About

OpenCTI is a product powered by the collaboration of the French national cybersecurity agency (ANSSI), the CERT-EU and the Luatix non-profit organization.


report

Recommend

About Joyk


Aggregate valuable and interesting links.
Joyk means Joy of geeK