opencti

This project is a SIEM with SIRP and Threat Intel, all in one.

🚌 Threat Bus – A threat intelligence dissemination layer for open-source security tools.

🦊 DISINFOX is a threat intelligence exchange platform for disinformation implementing the DISARM framework at its core.

A highly available AWS deployment of the Threat Intelligence platform, OpenCTI using Terraform. Native AWS resources are used where feasible.

Helm chart for Open Cyber Threat Intelligence Platform

ThreatCheck - Select any indicator of compromise on any web page - or highlight an entire paragraph from a threat report - and instantly extract and look up every IOC across multiple platforms. No copy-pasting between tabs.

Maltego local and server integration for OpenCTI

Natural language interface to OpenCTI threat intelligence. Built with Claude Code for $22. Part of Cooper Cyber Coffee.

A repository dedicated to deliver a comprehensive set of tools for integration and convenient use of Kaspersky Threat Intelligence services

OpenCTI–Wazuh connector looking for indicators in Wazuh and creating sightings

Welcome to my Cybersecurity Homelab, where I experiment with ethical hacking, penetration testing, network security, AI Agent automation and system hardening. This repo documents the architecture, software stack, configurations, and automation scripts used in my self-hosted cybersecurity lab.

Defensive engagement & threat intelligence research laboratory. Converts inbound scam emails into actionable IOCs through controlled, policy-driven AI engagement. Multi-agent LLM architecture with adaptive strategy selection.

Wazuh extension looking up alert data against indicators in OpenCTI threat intel

Unofficial OpenCTI Golang Client

Automated threat intelligence collector built with Python and GitHub Actions — fetches recent IOCs from open sources, normalizes and enriches them (IP, URL, hash, CVE), and publishes ready-to-use feeds in CSV, JSON, and STIX formats.

A command line tool that turns NVD CVE records into STIX 2.1 Objects.

A custom Wazuh integration that enriches alerts with threat intelligence from OpenCTI. It features indicator lookups, command-line IoC extraction, and expanded Sysmon coverage.

Newsletter hebdomadaire sur les menaces cyber du moment à partir de cluster OpenCTI auto-hebergé

Behavioral similarity engine for APT groups and TTP profiles. Powered by MITRE ATT&CK® and OpenCTI.

Watcher is a solution that integrates with security products using IoC (Indicator of Compromise) information gathered through the OpenCTI platform. This integration makes it possible to detect and respond to threats faster.