An open-source cyber threat intelligence management platform (by Filigran) that structures and visualizes CTI data using STIX2 standards. It links threat actors, TTPs, IOCs, and reports into a knowledge graph integrated with MITRE ATT&CK.
What is OpenCTI?
OpenCTI is an open-source cyber threat intelligence management platform developed by Filigran, designed to help organizations structure, store, and operationalize their threat intelligence using the STIX2 standard. It provides a knowledge graph that links threat actors, their tactics, techniques and procedures, associated malware families, campaign timelines, and indicators of compromise into a navigable, interconnected dataset. OpenCTI integrates natively with MITRE ATT&CK, allowing organizations to map observed adversary behavior to the framework and understand which defensive gaps exist in their detection coverage. The platform ingests threat intelligence from multiple sources simultaneously, including MISP, AlienVault OTX, and commercial feeds, deduplicating and merging overlapping data into a unified knowledge base. It also supports collaborative workflows where multiple analysts can contribute to and validate intelligence entries.
How does OpenCTI work with Qevlar?
Qevlar integrates with OpenCTI to enrich investigation findings with structured threat intelligence. When an investigation surfaces an IOC or a behavioral pattern, Qevlar can query OpenCTI to determine whether it is associated with a known threat actor, a specific campaign, or a malware family, adding strategic context to what might otherwise be a purely technical finding.
Want to help your analysts focus on the most critical alerts?
Frequently asked questions
What is OpenCTI?
OpenCTI is an open-source cyber threat intelligence platform by Filigran that structures threat actors, TTPs, IOCs and reports into a STIX2-based knowledge graph, integrated with MITRE ATT&CK.
What can you do with OpenCTI in Qevlar?
Qevlar can query OpenCTI to enrich investigation findings with structured threat intelligence — determining whether an IOC or behavior is linked to a known threat actor, campaign or malware family, and adding strategic context to a technical finding.
Does Qevlar use my own threat intelligence?
Yes. By connecting to your OpenCTI instance, Qevlar grounds its investigations in the intelligence your team already curates and trusts.
Can Qevlar map findings to MITRE ATT&CK with OpenCTI?
Yes. OpenCTI's ATT&CK integration lets Qevlar place observed behavior in the context of known adversary techniques during an investigation.
Other integrations
