Open source OSINT automation tool that gathers data on IPs, domains, emails and more from 200+ sources for threat intelligence and attack surface mapping.
24.4K+231 this week4KPythonMITUpdated 7 months ago
OpenCTI-Platform/opencti
Open-source cyber threat intelligence platform for structuring, storing and visualizing threat knowledge and observables, built on the STIX2 standard.
- Stars
- 10,276
- Forks
- 1,502
- Open issues
- 2,270
- Last commit
- 45 minutes ago
What is it?
OpenCTI is a platform that lets organizations manage their cyber threat intelligence knowledge and observables. It structures, stores, organizes and visualizes technical and non-technical information about cyber threats, such as TTPs, observables, attribution suggestions and victimology.
The data follows a knowledge schema based on the STIX2 standards. The platform is a web application with a GraphQL API and a frontend. Each piece of information can be linked to its primary source, such as a report or a MISP event, and carries attributes like first and last seen dates and confidence levels. Analysts can also have new relations inferred from existing ones.
OpenCTI supports importing and exporting data in formats such as CSV and STIX2 bundles. It can be integrated with tools including MISP, TheHive and the MITRE ATT&CK framework through connectors. It is available in a Community Edition under Apache 2.0 and an Enterprise Edition, and can be deployed with Docker or manually.
Key features
- 01Stores threat intelligence using the STIX2 knowledge schema.
- 02Links each piece of information to its primary source with dates and confidence levels.
- 03Provides a GraphQL API and a web frontend for analysts.
- 04Imports and exports data in formats such as CSV and STIX2 bundles.
- 05Integrates with MISP, TheHive and MITRE ATT&CK through connectors.
Use cases
- Centralizing threat intelligence reports, indicators and observables within a security team.
- Mapping adversary TTPs to the MITRE ATT&CK framework.
- Sharing structured STIX2 threat data with other platforms.
Quick start
- 1
Install with Docker, following the official docs
- 2
Or install manually, following the official docs
- 3
Or download a release from the GitHub releases page
Things to know
- The platform is under heavy development, so expect changes.
- Enterprise Edition features are licensed separately from the Apache 2.0 Community Edition.
- Self-hosting requires setting up a multi-component deployment, which takes effort.
In collections
Topics
FAQ
- What is opencti?
- Open-source cyber threat intelligence platform for structuring, storing and visualizing threat knowledge and observables, built on the STIX2 standard. OpenCTI is a platform that lets organizations manage their cyber threat intelligence knowledge and observables. It structures, stores, organizes and visualizes technical and non-technical information about cyber threats, such as TTPs, observables, attribution suggestions and victimology.
- Is opencti free to use? What license does it have?
- opencti is open source under the Other license. Check the license terms before using it in commercial products.
- Is opencti still maintained?
- Actively maintained. The last commit to opencti was on Nov 7, 2026.
- What can I use opencti for?
- Centralizing threat intelligence reports, indicators and observables within a security team. Mapping adversary TTPs to the MITRE ATT&CK framework. Sharing structured STIX2 threat data with other platforms.
- How do I install opencti?
- Install with Docker, following the official docs Or install manually, following the official docs Or download a release from the GitHub releases page
- Where can I get opencti?
- The source code and installation instructions are on GitHub: https://github.com/OpenCTI-Platform/opencti
Summary generated by AI from the project's README. GitHub stats refresh daily.
Related projects
A command-line OSINT tool that searches for a username across 400+ social networks and reports where accounts exist.
100.1K+4.8K this week11.8KPythonMITUpdated 14 hours ago
Open-source graph-based OSINT investigation platform that links entities like domains, IPs, emails and wallets through automated enrichers.
10.1K+50 this week1.2KTypeScriptApache-2.0Well maintainedUpdated 20 days ago
MCP server that gives AI agents access to the Shodan API and CVEDB for internet device search, host recon, DNS and CVE intelligence.
188+2 this week31TypeScriptMITUpdated 3 days ago
A self-hosted web app that extracts IoCs from raw text and checks their reputation across many threat intelligence services.
69878PythonMITWell maintainedUpdated 19 days ago
A C#-based NPC framework that simulates realistic user activity on computers and networks for cyber training, exercises, and research.
744+9 this week102C#OtherWell maintainedUpdated 4 days ago