OpenCTI

Name: OpenCTI
Author: jhuntinfosec

•

Provides a Model Context Protocol (MCP) server for querying and exploring OpenCTI threat intelligence platforms.

The OpenCTI tool acts as a comprehensive Model Context Protocol (MCP) server, designed to extend the capabilities of OpenCTI threat intelligence platforms. It unlocks advanced querying and exploration features, exposing over 26 specialized tools for deep dives into cyber threat intelligence. Users can perform detailed sector analysis, map Tactics, Techniques, and Procedures (TTPs), conduct temporal queries, and traverse complex relationships between various threat entities.

Key Features

01Navigate intricate relationships between entities to understand connections

021 GitHub stars

03Search across STIX entities like Malware, Threat Actors, and Attack Patterns

04Analyze and retrieve Tactics, Techniques, and Procedures (TTPs)

05Perform sector-based analysis to identify targeted industries

06Conduct deep-dive profiling of specific threat actors

Use Cases

01Retrieve all TTPs associated with a particular threat group like 'APT28' or 'APT29'.

02Identify top threat actors targeting a specific economic sector, such as 'Financial Sector'.

03Generate a comprehensive profile of a threat actor, detailing malware, campaigns, and exploited vulnerabilities.