OpenCTI Graphql

opencti is an open source platform that facilitates the management and analysis of cyber threat intelligence opencti is a comprehensive threat intelligence platform that centralizes and analyzes cyber threat data the opencti graphql connector enables swimlane turbine users to execute graphql queries and mutations directly against the opencti api, facilitating seamless retrieval and analysis of threat intelligence data by integrating with opencti graphql, users can automate the extraction of valuable threat insights, enhancing their security operations and decision making processes limitations none to date supported versions this connector targets the opencti graphql api as documented at https //docs opencti io/latest/reference/api/ https //docs opencti io/latest/reference/api/ additional docs opencti api documentation https //docs opencti io/latest/reference/api/opencti graphql playground https //docs opencti io/latest/reference/api/#graphql playground configuration prerequisites before you can use the opencti graphql connector for turbine, you'll need access to the opencti api this requires the following http bearer authentication using the following parameters url the endpoint url for accessing the opencti api api key a valid api key to authenticate requests to the opencti api authentication methods to use the opencti graphql connector within the swimlane turbine platform, ensure you have bearer token (api key) authentication url the base url of your opencti instance api key your opencti api key, used as a bearer token capabilities this opencti graphql connector provides the following capabilities execute graphql query execute graphql query execute an arbitrary graphql query or mutation against the opencti /graphql endpoint and return the json response click here https //docs opencti io/latest/reference/api/ notes more information on opencti can be found here https //docs opencti io/latest/ configurations opencti graphql bearer authentication authenticates to the opencti api using a bearer token (api key) configuration parameters parameter description type required url base url of the opencti instance (for example, https //opencti example com https //opencti example com ) string required token opencti api key used as a bearer token in the authorization header string required verify ssl verify ssl certificate boolean optional http proxy a proxy to route requests through string optional actions execute graphql query execute a graphql query or mutation against the opencti /graphql endpoint and return the json response requires a json body with a query endpoint url graphql method post input argument name type required description query string optional graphql query or mutation string to execute against the opencti api variables object optional optional variables object to pass to the graphql query operationname string optional optional operation name required when the query string contains multiple operations input example {"json body" {"query" "query stixcyberobservables($search string) {\n stixcyberobservables(search $search) {\n edges {\n node {\n id\n entity type\n observable value\n }\n }\n }\n}","variables" {"search" "8 8 8 8"}}} output parameter type description status code number http response status code returned by the opencti api reason string http reason phrase ok indicates success data object graphql response data shape depends on the executed query errors array list of graphql errors returned for the request, when present errors message string response message errors path array error message if any errors extensions object error message if any output example {"status code" 200,"response headers" {},"reason" "ok","json body" {"data" {"stixcyberobservables" {}}}} response headers header description example content type the media type of the resource application/json date the date and time at which the message was originated thu, 01 jan 2024 00 00 00 gmt