OpenCTI connector
Native enrichment for threat intelligence
Enrich your OpenCTI observables with real-time threat intelligence from isMalicious. Automatic risk scoring, threat categorization, and geolocation data for IPs and domains.
STIX 2.1 observables · risk score · confidence · source count
Key features.
Available signals and integration options.
Multi-Type Enrichment
Enrich IPv4, IPv6 addresses, and domain names with threat intelligence data.
Risk Scoring
Get a 0-100 risk score based on multi-source threat analysis.
Threat Labels
Automatic threat categorization: phishing, malware, C2, botnet, ransomware, spam, scam.
External References
Links to original detection sources and isMalicious detailed reports.
Geolocation Data
Country location entities with sighting relationships when available.
Docker Ready
Easy deployment with Docker and docker-compose. Production-ready container.
Use cases.
Workflows to evaluate with your existing tools.
Automated Observable Enrichment
Enable auto mode to automatically enrich new observables as they enter OpenCTI.
Investigation Support
Manually enrich observables during investigations to get instant threat context.
Threat Correlation
Use labels, risk scores, external references, and relationships to correlate malicious infrastructure in the OpenCTI graph.
TLP-Aware Processing
Respect TLP markings with configurable maximum TLP level for enrichment.
Do you need an OpenCTI alternative — or just the feed?
If your goal is to import external indicators into tools you already operate, evaluate a TAXII 2.1 feed alongside your existing sources. IsMalicious provides feeds and an API. OpenCTI provides its own investigation and data management workflows. Compare indicator relevance, import behavior and maintenance effort in your configuration before choosing an integration. Feed access requires Pro or Enterprise. TAXII polling is outside the API lookup quota.
Feeding OpenCTI over TAXII
OpenCTI can read TAXII 2.1 collections from https://api.ismalicious.com/taxii2/ using your API credentials. On 8 October 2026, a local OpenCTI 6.9.13 test persisted 18 indicators and one organization from a captured sample. It created no observables, and OpenCTI changed valid_until on all 18 indicators. This test does not establish a complete polling cycle or a customer deployment. The collection reconstruction schedule and your client polling interval are separate. Review pagination and field mapping in the STIX/TAXII documentation, then verify them in your own instance.
OpenCTI Native Enrichment Connector
The isMalicious OpenCTI connector automatically adds threat intelligence data to your OpenCTI observables. When an IPv4, IPv6, or domain observable is processed, the connector queries the isMalicious API and enriches the observable with risk scores, threat labels, and external references. This integration is perfect for security teams using OpenCTI as their threat intelligence platform who want to augment their data with real-time reputation information from multiple threat intelligence sources.
OpenCTI data model: observables, entities, and relationships
The connector maps reputation results back into the OpenCTI data model instead of leaving enrichment as a flat note. IPv4, IPv6, and domain observables receive threat labels, external references, and descriptive context. When location context is available, the connector creates country entities and sighting relationships so analysts can pivot from one observable to related infrastructure during investigations.
Enrichment Data Details
When an observable is enriched, the connector adds comprehensive threat intelligence data: **Risk Score (0-100)**: A confidence-weighted score based on analysis from multiple threat intelligence sources. Higher scores indicate higher risk. **Threat Labels**: Automatic categorization including malicious, phishing, malware, command-and-control, botnet, ransomware, spam, and scam labels. **External References**: Direct links to the isMalicious report and original detection sources for further investigation. **Geographic Data**: When available, country location entities are created with sighting relationships to the observable. This enrichment data integrates directly with OpenCTI's data model, enabling correlation, analysis, and reporting workflows.
Deployment
Deploy the connector using Docker for production environments. The official image is available on Docker Hub at opencti/connector-ismalicious.
# Pull from Docker Hub docker pull opencti/connector-ismalicious:latest # Or using docker-compose docker compose up -d
Configuration Variables
The connector requires your OpenCTI URL and token, plus an isMalicious API key. You can fine-tune enrichment behavior with the following environment variables:
| Parameter | Docker envvar | Mandatory | Description |
|---|---|---|---|
| OpenCTI URL | OPENCTI_URL | Yes | The URL of the OpenCTI platform |
| OpenCTI Token | OPENCTI_TOKEN | Yes | The token of the OpenCTI user |
| API Key | ISMALICIOUS_API_KEY | Yes | Your isMalicious API key |
| Auto Mode | CONNECTOR_AUTO | No | Enable automatic enrichment (default: false) |
| Max TLP | ISMALICIOUS_MAX_TLP | No | Max TLP to process (default: TLP:AMBER) |
| Min Score | ISMALICIOUS_MIN_SCORE | No | Minimum risk score to report (default: 0) |
Frequently asked questions.
Is isMalicious an alternative to OpenCTI?
Can OpenCTI ingest the isMalicious feed over TAXII?
What observable types does the OpenCTI connector support?
How do I deploy the OpenCTI connector?
Does the connector work with OpenCTI auto mode?
What TLP levels are supported?
What data is added during enrichment?
Can I filter which observables get enriched?
Ready to get started?
Test the available signals in your workflow. Review the sources and limits before integrating.
No credit card required · Free API key