OpenCTI

概要

The OpenCTI tool acts as a comprehensive Model Context Protocol (MCP) server, designed to extend the capabilities of OpenCTI threat intelligence platforms. It unlocks advanced querying and exploration features, exposing over 26 specialized tools for deep dives into cyber threat intelligence. Users can perform detailed sector analysis, map Tactics, Techniques, and Procedures (TTPs), conduct temporal queries, and traverse complex relationships between various threat entities.

主な機能

• Navigate intricate relationships between entities to understand connections
• 1 GitHub stars
• Search across STIX entities like Malware, Threat Actors, and Attack Patterns
• Analyze and retrieve Tactics, Techniques, and Procedures (TTPs)
• Perform sector-based analysis to identify targeted industries
• Conduct deep-dive profiling of specific threat actors

ユースケース

• Retrieve all TTPs associated with a particular threat group like 'APT28' or 'APT29'.
• Identify top threat actors targeting a specific economic sector, such as 'Financial Sector'.
• Generate a comprehensive profile of a threat actor, detailing malware, campaigns, and exploited vulnerabilities.