OpenCTI playbooks and automation
Designing OpenCTI playbooks that label, score, enrich and route data or open cases automatically, what the Enterprise Edition license requirement means, and how to test playbooks with execution traces.
OpenCTI features
OpenCTI capabilities beyond ingestion, noting which ones need the proprietary Enterprise Edition license.
OpenCTI case management for incident response
Using OpenCTI incident response, RFI and takedown cases with tasks and templates, and where this fits next to a dedicated incident response platform.
OpenCTI TAXII collections, live streams and CSV feeds
Publishing OpenCTI intelligence to partners and tools through TAXII 2.1 collections, live streams and CSV feeds, with filters, public access and visibility controls.
OpenCTI audit logs and data segregation
Activity monitoring, audit logs, organization segregation and authorized members in OpenCTI Enterprise Edition, and when a team needs them for shared or regulated deployments.
