OpenCTI: Organise Threat Intelligence as a Knowledge Graph (GitHub, Scanned)

OpenCTI is where a threat intelligence team keeps what it knows. Every report, threat actor, intrusion set, malware family, vulnerability, attack pattern, indicator and observable is stored as a STIX 2.1 object and linked to the others, with confidence levels, first and last seen dates and a pointer back to the source. Analysts browse it as a graph, write their own reports and cases, and let inference rules add relationships the data implies. Connectors pull in MITRE ATT&CK, MISP events, TAXII, RSS and CSV feeds and commercial sources, and push indicators out to SIEMs and EDRs.

It is built by Filigran, a French company founded by the project's creators, as a GraphQL API in Node.js with a React front end, backed by Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible storage. With about 10,200 stars, 217 contributors and more than 14,800 commits since 2018, it is one of the most widely deployed open intelligence platforms, and it releases constantly: 418 releases so far, the latest, 7.261026.0, on 26 October 2026.

Two editions share the repository. The Community Edition is Apache 2.0; Enterprise Edition features sit in the same codebase under a separate Filigran licence, marked file by file, and switch on from the settings page. A public demo instance resets every night.

• Repository: github.com/OpenCTI-Platform/opencti
• Licence: custom (Other)
• Language: TypeScript. Stars: 10.2K. Forks: 1,493. Last push: Oct 28, 2026.
• Scan: safe, Oct 28, 2026, commit 1a77bde

Who it is for

CTI analysts and SOC teams who need a structured, shared memory of threats, CERTs and ISACs exchanging intelligence with members, and researchers who want MITRE ATT&CK, MISP and feed data linked in one searchable graph.

Getting started

1. Clone Filigran's Docker deployment repository (needs Docker with the Compose plugin)

git clone https://github.com/OpenCTI-Platform/docker.git && cd docker

2. Create your settings from the sample, then set the passwords and a UUID admin token (uuidgen)

cp .env.sample .env

3. Raise the memory map limit Elasticsearch needs

sudo sysctl -w vm.max_map_count=1048575

4. Start the stack, then log in at http://localhost:8080

docker compose up -d

This is a heavy stack: Elasticsearch defaults to 4 GB of memory and the platform's Node process to 8 GB, so plan a server rather than a laptop. The Compose file now also starts XTM One, Filigran's AI assistant, with its own PostgreSQL. OPENCTI_ADMIN_TOKEN must be a valid UUID or the container will not start.

Safety scan

We cloned OpenCTI-Platform/opencti at commit 1a77bde on Oct 28, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• The secret hits are docstrings, documentation and test fixtures: pycti's data_to_temp_file example shows a placeholder BEGIN PRIVATE KEY line, the authentication and troubleshooting docs show which key header format to use, and the SSO provider tests use XXX as the key body. The curl | bash hit is the devcontainer Dockerfile installing Node.js, and the very long lines are an email template and a MISP mapping test fixture. The pastebin URL is test data for the TAXII ingester.
• The 1 critical advisory, in seroval, does not reach the running app. seroval comes in through solid-js, used by Filigran's embedded chatbot widget, and solid-js only calls it in its server-side rendering build; OpenCTI's front end is a client-side React app. The flaw is in deserialising untrusted JSON, which the browser bundle never does.
• Several of the 11 high advisories do ship in the backend: undici (through the Elasticsearch client) has TLS validation and denial-of-service issues, node-forge has a signature-verification flaw, and @graphql-tools/utils, under Apollo Server, has prototype pollution. Others, such as the glob CLI one, are build tooling. With Renovate enabled and releases most weeks, staying on the latest version is the fix.
• Usage telemetry is documented in the README: counts of users, connectors, entities and features enabled, sent to telemetry.filigran.io, with no intelligence content and no IP addresses, according to the docs. The source honours a telemetry_manager:enabled setting, so it can be switched off.
• 21 workflows. Two use pull_request_target, but only to label pull requests and check titles and commit signatures through the API; neither checks out fork code. All 18 third-party actions are pinned to commits. Security policy, Dependabot, Renovate, CodeQL, contributing guide and code of conduct are present; the one committed binary is the ANTLR parser generator JAR used at build time.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: TypeScript 749.8K, JavaScript 164.2K, JSON 110.4K, Python 72.5K, Markdown 30.7K, YAML 5,732.

Questions

Is OpenCTI free?

The Community Edition is Apache 2.0 and free to self-host for any purpose, commercial included. Enterprise Edition features, such as some AI, automation and audit tools, need a paid Filigran licence; Filigran also sells a hosted version. Connectors are free, but many commercial feeds they connect to need their own subscription.

Is it legal to collect threat intelligence in OpenCTI?

Storing indicators, reports and public research about threats is ordinary defensive work. Respect the sharing terms of every feed, such as Traffic Light Protocol markings and licence limits on commercial data, and check data protection rules before storing personal data such as names or email addresses that appear in incident data.

How is OpenCTI different from MISP?

They are often run together. MISP is built for sharing indicators and events between organisations and syncing instances; OpenCTI is built for analysis, modelling who did what with which tools as a STIX knowledge graph. A MISP connector feeds MISP events into OpenCTI, and many teams use MISP for exchange and OpenCTI for the analyst's view.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.