Integration

OpenCTI Connector

Internal enrichment for threat intelligence

Enrich your OpenCTI observables with real-time threat intelligence from isMalicious. Automatic risk scoring, threat categorization, and geolocation data for IPs and domains.

IPv4/IPv6
IP Support
Domains
Domain Support
0-100
Risk Score
Docker
Deployment

Key Features

Everything you need to protect your infrastructure and users

Multi-Type Enrichment

Enrich IPv4, IPv6 addresses, and domain names with threat intelligence data.

Risk Scoring

Get a 0-100 risk score based on multi-source threat analysis.

Threat Labels

Automatic threat categorization: phishing, malware, C2, botnet, ransomware, spam, scam.

External References

Links to original detection sources and isMalicious detailed reports.

Geolocation Data

Country location entities with sighting relationships when available.

Docker Ready

Easy deployment with Docker and docker-compose. Production-ready container.

Use Cases

How security teams use this tool

Automated Observable Enrichment

Enable auto mode to automatically enrich new observables as they enter OpenCTI.

Investigation Support

Manually enrich observables during investigations to get instant threat context.

Threat Correlation

Use threat labels and risk scores to correlate related malicious infrastructure.

TLP-Aware Processing

Respect TLP markings with configurable maximum TLP level for enrichment.

OpenCTI Internal Enrichment Connector

The isMalicious OpenCTI connector is an internal enrichment connector that automatically adds threat intelligence data to your OpenCTI observables. When an IPv4, IPv6, or domain observable is processed, the connector queries the isMalicious API and enriches the observable with risk scores, threat labels, and external references. This integration is perfect for security teams using OpenCTI as their threat intelligence platform who want to augment their data with real-time reputation information from multiple threat intelligence sources.

Configuration & Deployment

Deploy the connector using Docker for production environments. The connector requires your OpenCTI URL and token, plus an isMalicious API key. Key configuration options include: - OPENCTI_URL: Your OpenCTI platform URL - OPENCTI_TOKEN: Authentication token for OpenCTI - ISMALICIOUS_API_KEY: Your isMalicious API key - CONNECTOR_AUTO: Enable automatic enrichment (true/false) - ISMALICIOUS_MAX_TLP: Maximum TLP level to process - ISMALICIOUS_MIN_SCORE: Minimum score threshold for reporting The connector runs as a standalone service that connects to both OpenCTI and isMalicious, processing enrichment requests in real-time.

Enrichment Data Details

When an observable is enriched, the connector adds comprehensive threat intelligence data: **Risk Score (0-100)**: A confidence-weighted score based on analysis from multiple threat intelligence sources. Higher scores indicate higher risk. **Threat Labels**: Automatic categorization including malicious, phishing, malware, command-and-control, botnet, ransomware, spam, and scam labels. **External References**: Direct links to the isMalicious report and original detection sources for further investigation. **Geographic Data**: When available, country location entities are created with sighting relationships to the observable. This enrichment data integrates seamlessly with OpenCTI's data model, enabling correlation, analysis, and reporting workflows.

Frequently Asked Questions

What observable types does the OpenCTI connector support?
The connector supports IPv4-Addr, IPv6-Addr, and Domain-Name observable types for enrichment.
How do I deploy the OpenCTI connector?
You can deploy using Docker with docker-compose, or manually by installing the Python dependencies and running main.py. Docker is recommended for production deployments.
Does the connector work with OpenCTI auto mode?
Yes, you can enable automatic enrichment by setting CONNECTOR_AUTO=true in your configuration. This will automatically enrich new observables as they enter the platform.
What TLP levels are supported?
The connector respects TLP markings and supports up to TLP:AMBER by default. You can configure MAX_TLP to TLP:RED if needed.
What data is added during enrichment?
The connector adds: risk score (0-100), threat category labels, external references to detection sources, description summaries, and geographic location with sighting relationships.
Can I filter which observables get enriched?
Yes, you can configure ENRICH_IPV4, ENRICH_IPV6, and ENRICH_DOMAIN to enable/disable enrichment for specific types. You can also set MIN_SCORE to only report results above a threshold.

Ready to Get Started?

Join thousands of security teams using isMalicious to protect their infrastructure.