OpenCTI Threat Intel Enrichment

introduction this guide tells you how to authenticate the opencti threat intel enrichment connector in swimlane using an api key you will generate an opencti api key, collect the required endpoint url, and configure the connector in swimlane prerequisites opencti access requirements you must have access to an opencti instance permission to generate and use api keys access to the opencti graphql api required credentials during setup, you will collect api url api key opencti setup take the following steps to generate an api key log in to your opencti instance click your user profile in the upper right corner select settings (or profile , depending on your opencti version) locate the api token or personal access token section click generate token (or regenerate token if one already exists) copy and securely save the generated api key this value will be used in swimlane the api key is displayed only when it is generated store it securely before leaving the page take the following steps to identify the api url the api url is the url of your opencti instance examples https //opencti company com https //opencti example com use your organization's opencti server url as the url value in swimlane connector configuration in swimlane log in to turbine from the left hand navigation pane, click orchestration and click assets asset homepage opens click the plus icon to open the configure your connector asset window select opencti threat intel enrichment from the asset type list fill in the asset settings and asset input as shown field description required/optional url opencti instance url required apikey opencti api key required verify ssl enable/disable ssl verification optional http proxy optional proxy configuration optional fields with marks are required click create troubleshooting if authentication fails verify that the api key is valid and has not been revoked ensure the url points to your opencti instance confirm that the account associated with the api key has permission to access the required opencti apis verify that https access to the opencti server is not blocked by a firewall or proxy if using a self signed certificate, disable verify ssl only if permitted by your organization's security policy result you have successfully authenticated the opencti threat intel enrichment connector in swimlane sources opencti documentation https //docs opencti io/ https //docs opencti io/ opencti api documentation https //docs opencti io/latest/reference/api/ https //docs opencti io/latest/reference/api/ opencti authentication documentation https //docs opencti io/latest/deployment/security/ https //docs opencti io/latest/deployment/security/