Enterprise-grade cyber threat intelligence platform that turns scattered security data into actionable insights using STIX2 standards - think Bloomberg terminal but for cybersecurity teams

Security teams are drowning in threat data from dozens of sources - MISP feeds, MITRE ATT&CK, incident reports, IOCs from various tools. OpenCTI solves this by creating a unified knowledge graph where every piece of threat intelligence connects to form a complete picture. Instead of analysts jumping between 15 different tools to understand an attack campaign, they get one comprehensive view with confidence levels, attribution timelines, and source tracking.

Built on STIX2 standards with a modern GraphQL API, OpenCTI automatically correlates threats, tracks TTPs, and maintains data lineage back to original sources. The platform integrates seamlessly with existing security tools like MISP and TheHive, while its inference engine discovers hidden relationships between seemingly unrelated indicators. With 8,472 stars and enterprise deployments worldwide, it’s become the de facto standard for structured threat intelligence management.

Perfect for SOC teams, threat researchers, and any organization tired of manual threat correlation. The Docker-based setup gets you running in minutes, and the active 3K+ member community provides extensive connector libraries for popular security tools.

⭐ Stars: 8472
💻 Language: TypeScript
🔗 Repository: OpenCTI-Platform/opencti