domains / families / security / modeling-threats-with-opencti

modeling-threats-with-opencti

separate

Deploy OpenCTI (Filigran) via Docker Compose and use the pycti Python client to model threat actors, intrusion sets, campaigns, and indicators as a STIX 2.1 knowledge graph with relationships (uses, attributed-to, targets). Use when building a centralized threat-intel knowledge base, correlating IOCs from multiple feeds into one adversary graph, or producing STIX bundles for detection engineering.

When to use

• Building a centralized, STIX-native knowledge base of threat actors, campaigns, and TTPs
• Correlating IOCs and reports from multiple feeds into a single adversary graph
• Mapping observed activity to MITRE ATT&CK techniques for coverage and gap analysis
• Producing structured intelligence (STIX bundles) for downstream detection engineering
• Tracking attribution: which intrusion sets are attributed to which threat actors and campaigns
• Automating CTI ingestion via connectors and the pycti API

Skill page

Source