OpenCTI: Open-Source Threat Intelligence Platform Guide

OpenCTI is an open-source platform for managing cyber threat intelligence (CTI) knowledge and observables. It structures, stores, organizes and visualizes threat data, is developed by Filigran, and is published on GitHub under the OpenCTI-Platform organization. This guide is for researchers, security staff and research-computing teams who need to install it, run a first session and read what the interface shows. All installation commands below follow the project’s own documentation (read 2026-11-07).

What OpenCTI is used for in research

The documentation describes OpenCTI as a platform “designed as a knowledge graph”. Its getting-started page lists four use cases: CTI knowledge bases, detection-as-code feeds, incident response case management and vulnerability management. Its data model is based on STIX2 standards, and it can import and export CSV and STIX2 bundles. According to the project README, it integrates with MISP, TheHive and MITRE ATT&CK, and a connector ecosystem is maintained in the OpenCTI-Platform/connectors repository.

Each item in the knowledge base can be linked to its primary source, with first-seen and last-seen times and a confidence value. For research teams that study malware families or intrusion activity, that provenance model is the practical reason to use a platform rather than a spreadsheet. A GraphQL API is available for programmatic access.

Community Edition and Enterprise Edition

The Community Edition is licensed under Apache 2.0. An Enterprise Edition exists under a separate license; consult Filigran for its terms. This page does not cover pricing.

Install or access (official source only)

The installation documentation lists four deployment methods: Docker, manual, Terraform and Helm. For production, it recommends containers or Kubernetes. Use only the official sources: docs.opencti.io and the OpenCTI-Platform GitHub organization.

Pre-install checklist

• Kernel setting: the Docker instructions set vm.max_map_count with sudo sysctl -w vm.max_map_count=1048575, and say to persist it in /etc/sysctl.conf.
• Admin token must be a UUID: OPENCTI_ADMIN_TOKEN must be a valid UUID (generate one with uuidgen), otherwise the container will not start.
• Node.js 22 or later for a manual install, with corepack.
• No Windows release package: the documentation states there is no Windows release package for the manual install.

Step-by-step: first run with Docker

1. Clone the official Docker repository: git clone https://github.com/OpenCTI-Platform/docker.git
2. Set the kernel parameter: sudo sysctl -w vm.max_map_count=1048575
3. Create the environment file by copying .env.sample to .env, then fill in the values. Key variables named in the documentation include OPENCTI_ADMIN_EMAIL, OPENCTI_ADMIN_PASSWORD, OPENCTI_ADMIN_TOKEN, OPENCTI_HOST, OPENCTI_PORT, OPENCTI_EXTERNAL_SCHEME, OPENCTI_HEALTHCHECK_ACCESS_KEY and OPENCTI_ENCRYPTION_KEY. The dependency services use MINIO_ROOT_USER, MINIO_ROOT_PASSWORD, RABBITMQ_DEFAULT_USER, RABBITMQ_DEFAULT_PASS, SMTP_HOSTNAME, OPENSEARCH_ADMIN_PASSWORD and ELASTIC_MEMORY_SIZE.
4. Start the stack: sudo docker compose up -d
5. Open http://localhost:8080 and log in with the admin credentials you configured.

For Docker Swarm, the documentation uses sudo docker swarm init, copies the .env content to /etc/environment, and deploys with sudo docker stack deploy --compose-file docker-compose.yml opencti.

Manual installation

On Debian-based systems the documentation lists build-essential nodejs npm python3 python3-pip python3-dev as prerequisites, and a release archive is used (the _musl build on Alpine). For the platform (opencti-graphql): cp config/default.json config/production.json; then cd src/python && pip3 install -r requirements.txt; then yarn install, yarn build and yarn serv. For the worker: pip3 install -r requirements.txt, cp config.yml.sample config.yml (add the token), then python3 worker.py. A manual install serves the interface at http://localhost:4000. The documentation sets NODE_OPTIONS=--max-old-space-size=8096 (8 GB default) for the platform process. Behind a reverse proxy with a context path, set APP__BASE_PATH=/opencti; WebSocket support is required.

Output and how to read it

After login, the welcome dashboard shows number panels for Intrusion sets, Malware, Reports and Indicators, plus charts: Most active threats (last three months), Most targeted victims, Relationships created, Most active malware, Most active vulnerabilities, Targeted countries, Latest reports and Most active labels. The number panels are counts of the objects held in the platform; the documentation gives no further definition for them.

To explore, use the left menu under User Guide > Explore knowledge > Explore by entity types in the documentation. The sections it lists are:

Menu section	Source
Analysis	Documentation, getting-started page
Cases	Documentation, getting-started page
Events	Documentation, getting-started page
Observations	Documentation, getting-started page
Threats	Documentation, getting-started page
Arsenal	Documentation, getting-started page
Techniques	Documentation, getting-started page
Entities	Documentation, getting-started page
Locations	Documentation, getting-started page

The same documentation section also covers “Search for knowledge”, “Insights and summaries”, “Priority Intelligence Requirements”, “Work with graphs” and “Pivot and investigate”.

Importing a first file

1. Open the “Data” tab of an entity, or the panel “Data import and analyst workbenches” (database icon with a small gear, top right). You need the “Upload knowledge files” capability.
2. Click the cloud-with-arrow icon next to “Uploaded files” and upload the file.
3. For a STIX bundle, the ImportFileStix connector starts automatically. For CSV, click the upward-arrow icon, then select the connector and a CSV mapper; CSV mappers are created in the administration interface.

STIX and other connector imports do not enter the knowledge base immediately: they go to a draft (the default) or a workbench, depending on validation mode, and wait for analyst review. The documentation warns that connectors can misidentify object types or create “unknown” entities, so review before validating. CSV mapper imports create no workbench and write directly to the platform. The ImportDocument connector no longer accepts CSV files.

Troubleshooting

• Container exits at start: check that OPENCTI_ADMIN_TOKEN is a valid UUID.
• Interface unreachable behind a proxy: confirm WebSocket support and, for a sub-path, APP__BASE_PATH.
• Imported data not visible: STIX imports wait in a draft or workbench until validated.
• Manual install on Windows: not supported by a release package; use Docker.

Free alternatives

Tool	What its own site says	Source
OpenCTI Community Edition	Open-source platform to manage CTI knowledge and observables; Apache 2.0	github.com/OpenCTI-Platform/opencti
MISP	“Open source software solution for collecting, storing, distributing and sharing cyber security indicators and threats”	misp-project.org (read 2026-11-07)

The two are not exclusive: the OpenCTI README lists MISP among its integrations. Related CASRAI pages on threat data sources: MalwareBazaar and MITRE ATLAS, plus the insider threat program under NSPM-33 for research-security context.

FAQ

Is OpenCTI free?

The Community Edition is released under Apache 2.0. An Enterprise Edition is under a separate license.

How do I install OpenCTI with Docker?

Clone the official docker repository, set vm.max_map_count, create .env from .env.sample, then run sudo docker compose up -d and open port 8080. Full steps are above.

What is OpenCTI built on?

Its data model is based on STIX2 standards, per the project README.

Where are the OpenCTI connectors?

In the OpenCTI-Platform/connectors repository on GitHub, which the documentation also points to for automated import.

Sources

• OpenCTI documentation: Installation (read 2026-11-07)
• OpenCTI documentation: Getting started (read 2026-11-07)
• OpenCTI documentation: Import files (read 2026-11-07)
• OpenCTI-Platform/opencti README (read 2026-11-07)
• MISP project (read 2026-11-07)