Threat intelligence · open-source OSINT project
OpenCTI
A mature platform for organizing, correlating, and sharing cyber-threat intelligence.
View on GitHub ↗ Project homepage ↗
Before you use it
Threat reports and case data may be sensitive. Self-host securely, configure access controls and retention, and do not treat correlation as proof of attribution.
At a glance
| Category | Threat intelligence |
|---|---|
| Provider | OpenCTI-Platform |
| Accepted input | indicator, threat report, case data |
| Access | Free |
| Privacy sensitivity | Moderate |
| Maintenance status | Active |
| Operating mode | Defensive enrichment and threat research |
| License | NOASSERTION |
| GitHub stars | 9,883 |
| Repository last updated | 2026-09-01 |
| Last verified by OSINTCompass | 2026-09-01 |
Access and privacy
Access: Free
Open-source repository on GitHub. Local or self-hosted use may require API keys, accounts, models, or other third-party services.
Privacy sensitivity: Moderate
Infrastructure, case, or research queries may be logged by GitHub, APIs, model providers, or target services. Minimize identifiers and review scope.
Responsible use
- Uploading a file to a public scanner can make it visible to others — avoid sensitive files.
- Correlate indicators across several sources before acting on them.
- Record indicator sources and timestamps for later review.