Welcome to the OpenCTI repository!
This project provides a collaborative platform for managing, analyzing, and sharing Cyber Threat Intelligence (CTI).
OpenCTI aims to centralize and structure cyber threat information, making it easier for security teams, analysts, and partners to leverage intelligence.
- Collection: Integrate multiple data sources (connectors).
- Analysis: Visualize and correlate threats.
- Sharing: Distribute indicators and reports to stakeholders.
The project uses Docker Compose to orchestrate the following services:
- OpenCTI: Main platform (Node.js)
- Elasticsearch: Search and indexing engine
- Redis: Cache and queue management
- MinIO: S3-compatible object storage
- RabbitMQ: Message broker for connectors
- Connectors: Import/export and enrichment modules (CrowdSec, STIX, CSV, TXT, etc.)
-
Clone the repository
git clone https://github.com/BasicOneCruisider/opencti.git cd opencti -
Configure environment variables
Edit the.envfile to set passwords, tokens, and API keys for your environment. -
Start the platform
docker compose up -d
-
Access the interface
Open http://localhost:8080 in your browser.
- CrowdSec: Enrich IP addresses with CrowdSec CTI
- Export STIX/CSV/TXT: Export data in various formats
- Import STIX/Document: Import structured and unstructured files
- Worker: Asynchronous task processing
- Set passwords and tokens in the
.envfile - Docker volumes ensure data persistence
- Exposed ports allow access to web interfaces and APIs
Contributions are welcome!
Feel free to open an issue or pull request to suggest improvements or report bugs.
- Change all default passwords and tokens before production
- Use a dedicated Docker network to isolate services
- Regularly back up your data volumes
This project is distributed under the MIT license.
Thanks to all contributors and the OpenCTI community!
For any questions, contact us via GitHub.