OpenCTI and MISP integration
Two-way exchange between OpenCTI and MISP: the MISP import and MISP feed connectors into OpenCTI, the MISP Intel stream connector back to MISP, and filtering so each platform keeps its role.
OpenCTI integrations
Filigran-published OpenCTI connectors that import from or stream to other security tools, documented in the OpenCTI connectors repository.
OpenCTI and Microsoft Sentinel integration
Streaming OpenCTI indicators to Microsoft Sentinel with the Upload Indicators API and importing Sentinel incidents back, including Entra app registration or managed identity and the minimum OpenCTI version.
OpenCTI and Splunk integration
Feeding OpenCTI indicators into the Splunk KV Store with the stream connector for lookups and correlation searches, choosing entity types and sizing the consumer.
OpenCTI and Elastic Security integration
Syncing OpenCTI observables and indicators to Elastic Security's threat intelligence index and generating detection rules, plus importing Elastic Security incidents back into OpenCTI.
OpenCTI and TheHive integration
Importing TheHive cases, alerts and observables into OpenCTI as incidents so investigations enrich the knowledge graph, with TLP filters and severity mapping.
OpenCTI MITRE ATT&CK and vulnerability connectors
Loading MITRE ATT&CK, CAPEC, CVE and the CISA KEV catalog into OpenCTI as the reference layer that reports, indicators and vulnerability prioritization link to.
