OpenCTI Threat Intel Enrichment

The OpenCTI connector provides actionable threat intelligence enrichment capabilities, enabling automated incident creation and indicator management within the Swimlane platform.

OpenCTI is an open-source platform that specializes in the analysis and sharing of cyber threat intelligence. The OpenCTI Threat Intel Enrichment connector for Swimlane Turbine allows users to create and manage threat intelligence incidents and indicators directly within the Swimlane ecosystem. By integrating with OpenCTI, users can enrich their security automation workflows with detailed threat intelligence, enabling more informed decision-making and proactive defense strategies. This connector facilitates the retrieval and filtering of threat indicators, incident management, and the searching of observables for precise threat intelligence matching, enhancing the overall security posture of organizations.

Prerequisites

To utilize the OpenCTI Threat Intel Enrichment connector, ensure you have the following:

Custom API Key Authentication with the necessary parameters:

URL: The endpoint URL for the OpenCTI API.

API Key: A valid API key to authenticate requests to the OpenCTI platform.

Capabilities

The OpenCTI Threat Intel Enrichment Connector has the following capabilities:

Create Incidents

Create Indicators

Filter Indicators

Get Incidents

Search Observables

Notes

More information on OpenCTI Threat Intel Enrichment can be found here

Configurations

OpenCTI Threat Intel Enrichment Authentication

Authenticates using an API Key

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
apikey	API key	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Create Incidents

Create new incidents in OpenCTI to bolster threat intelligence, requiring an incident name for execution.

Input

Argument Name	Type	Required	Description
name	string	Required	Name of the resource
description	string	Optional	Parameter for Create Incidents
first_seen	string	Optional	Parameter for Create Incidents
confidence	string	Optional	Unique identifier
severity	string	Optional	Parameter for Create Incidents

Input Example

{"name":"C2 server of the new campaign","description":"This is the C2 server of the campaign","first_seen":"2019-12-01"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
standard_id	string	Unique identifier
entity_type	string	Type of the resource
parent_types	array	Type of the resource
createdById	object	Unique identifier

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"5f6e3a41-beed-46e0-b397-bd9c2bdc48bc","standard_id":"incident--4b522d08-2880-51aa-8153-0f68454a7303","entity_type":"Incident","parent_types":["Basic-Object","Stix-Object","Stix-Core-Object"],"createdById":null}}

Create Indicators

Creates an Indicator object in OpenCTI using details such as name, pattern, pattern type, and main observable type for monitoring malicious activities.

Input

Argument Name	Type	Required	Description
name	string	Required	Name of the resource
description	string	Optional	Parameter for Create Indicators
pattern_type	string	Required	Type of the resource
pattern	string	Required	Parameter for Create Indicators
x_opencti_main_observable_type	string	Required	Type of the resource
valid_from	string	Optional	Unique identifier

Input Example

{"name":"C2 server of the new campaign","description":"This is the C2 server of the campaign","pattern_type":"stix","pattern":"[domain-name:value = 'www.5z8.info']","x_opencti_main_observable_type":"IPv4-Addr","valid_from":"2019-12-01"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
standard_id	string	Unique identifier
entity_type	string	Type of the resource
parent_types	array	Type of the resource
observables	array	Output field: observables
createdById	string	Unique identifier
observablesIds	array	Unique identifier

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"2ca5deca-79a6-486f-80c6-df4a52510d71","standard_id":"indicator--6378a591-75f1-5dd8-910a-6c1b835af84f","entity_type":"Indicator","parent_types":["Basic-Object","Stix-Object","Stix-Core-Object"],"observables":[{}],"createdById":"","observablesIds":[""]}}

Filter Indicators

Retrieve targeted threat intelligence indicators from OpenCTI based on specified criteria for focused analysis.

Input

Argument Name	Type	Required	Description
id	string	Optional	The ID of the Threat Actor Group.
filters	object	Optional	Parameter for Filter Indicators
filters.mode	string	Optional	Parameter for Filter Indicators
filters.filters	array	Optional	Parameter for Filter Indicators
filters.filters.key	array	Required	Parameter for Filter Indicators
filters.filters.values	array	Required	Value for the parameter
filters.filters.operator	string	Required	Parameter for Filter Indicators
filters.filterGroups	array	Optional	Parameter for Filter Indicators

Input Example

{"id":"2ca5deca-79a6-486f-80c6-df4a52510d71","filters":{"mode":"and","filters":[{"key":["id"],"values":["2ca5deca-79a6-486f-80c6-df4a52510d71"],"operator":"eq"}],"filterGroups":[]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
standard_id	string	Unique identifier
entity_type	string	Type of the resource
parent_types	array	Type of the resource
spec_version	string	Output field: spec_version
created_at	string	Output field: created_at
updated_at	string	Output field: updated_at
creators	array	Output field: creators
creators.id	string	Unique identifier
creators.name	string	Name of the resource
createdBy	object	Output field: createdBy
objectOrganization	array	Output field: objectOrganization
objectMarking	array	Output field: objectMarking
objectLabel	array	Output field: objectLabel
externalReferences	array	Output field: externalReferences
revoked	boolean	Output field: revoked
confidence	number	Unique identifier
created	string	Output field: created
modified	string	Output field: modified
pattern_type	string	Type of the resource
pattern_version	object	Output field: pattern_version
pattern	string	Output field: pattern
name	string	Name of the resource

Output Example

{"id":"12345678-1234-1234-1234-123456789abc","standard_id":"string","entity_type":"string","parent_types":["string"],"spec_version":"string","created_at":"string","updated_at":"string","creators":[{"id":"12345678-1234-1234-1234-123456789abc","name":"Example Name"}],"createdBy":{},"objectOrganization":[],"objectMarking":[],"objectLabel":[],"externalReferences":[],"revoked":true,"confidence":123}

Get Incidents

Retrieves the first set of incidents from OpenCTI with optional filtering by ID or custom filters, and supports fetching all records.

Input

Argument Name	Type	Required	Description
id	string	Optional	Incident ID to fetch a single incident. If set, other list options are ignored.
filters	object	Optional	OpenCTI filter group (mode, filters, filterGroups) to narrow results.
custom_attributes	string	Optional	Custom GraphQL attributes to return.
top	number	Optional	Max number of incidents to return when listing (no id). Default 10.
get_all	boolean	Optional	If true, return all incidents (paginated). Ignored when id is set.

Input Example

{"id":"12345678-1234-1234-1234-123456789abc","filters":{},"custom_attributes":"string","top":10,"get_all":true}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
standard_id	string	Unique identifier
entity_type	string	Type of the resource
parent_types	array	Type of the resource
spec_version	string	Output field: spec_version
created_at	string	Output field: created_at
updated_at	string	Output field: updated_at
createdBy	object	Output field: createdBy
objectOrganization	array	Output field: objectOrganization
objectMarking	array	Output field: objectMarking
objectLabel	array	Output field: objectLabel
externalReferences	array	Output field: externalReferences
revoked	boolean	Output field: revoked
confidence	number	Unique identifier
created	string	Output field: created
modified	string	Output field: modified
name	string	Name of the resource
description	string	Output field: description
aliases	object	Output field: aliases
first_seen	string	Output field: first_seen
last_seen	string	Output field: last_seen
objective	string	Output field: objective
incident_type	object	Unique identifier

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"cf272350-eb4f-4fb5-a32f-11e0ac7f03e2","standard_id":"incident--ee744d5b-a875-5f72-aed0-3af3e4a43b5e","entity_type":"Incident","parent_types":["Basic-Object","Stix-Object","Stix-Core-Object"],"spec_version":"2.1","created_at":"2024-06-24T07:46:04.364Z","updated_at":"2024-06-24T07:46:04.364Z","createdBy":null,"objectOrganization":[],"objectMarking":[],"objectLabel":[],"externalReferences":[],"revoked":false,"confidence":100,...

Search Observables

Search OpenCTI for exact match observables like IP, domain, URL, or file hash and return results only if an exact match is found.

Endpoint

URL: graphql

Method: POST

Input

Argument Name	Type	Required	Description
observable	string	Required	The observable value to search for (e.g., IP, domain, URL, or file hash).

Input Example

{"observable":"string"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
error	string	Error message if any
found	boolean	Output field: found
description	string	Output field: description
entity_type	string	Type of the resource
observable_value	string	Value for the parameter
labels	string	Output field: labels
raw_object	object	Output field: raw_object

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"error":"No search item provided","found":false}}

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT