Extend and scale your XTM Platform

Run DNSlytics domain searches stored as Indicators and ingest the matching domains with their IPs, AS and hosting provider.

Lamis Network connector enriches IPv4 and IPv6 observables with ASN, geolocation, infrastructure classification, and fraud risk scores.

Enriches domains, IP addresses, and certificates in OpenCTI with Censys data, including host services, open ports, and certificate details for infrastructure visibility.

Imports HoneyLabs honeypot indicators (exploitation sources, CVE probers, malware infrastructure) into OpenCTI over TAXII 2.1, each linked to its captured evidence.

Import DDoSIA targets from witha.name

Honeypot threat intelligence from GreedyBear.

Derives Intrusion Sets and `indicates` relationships from Malanta's `apt:` attribution labels on indicators.

Palo Alto Cortex XDR Intel connector synchronizes OpenCTI indicators to Palo Alto Cortex XDR, keeping your EDR detection base continuously aligned with your threat intelligence.

More complete Dashboard than the Default one giving details on qualified Intelligence in the platform and letting experiment with more widgets and data sources.

A dashboard to monitor ransomware activity sighted in your network.

A dashboard for monitoring vulnerability exploitation. It provides an overview of new vulnerabilities, exploitation volume, threats involved, associated TTPs, and more.

Imports threat intelligence from the AlienVault OTX community platform into OpenCTI via the DirectConnect API, retrieving IOCs, threat actors, and campaigns from subscribed pulses.

Automated Indicator Sharing (AIS) is a CISA service that allows real-time exchange of machine-readable cyber threat indicators and defenses between public and private sectors, helping organizations enhance security and reduce attacks.

Assess vulnerabilities that could affect your assets, with a view of criticality/severity, evaluate who is exploiting these vulnerabilities and how, and finally, project into the future with a view of the vulnerabilities.

Imports vulnerabilities actively exploited in the wild from the CISA Known Exploited Vulnerabilities (KEV) catalog into OpenCTI as STIX Vulnerability objects.

Monitor your Security Operations in the context of Incident management. Requires integrations with security systems able to feed OpenCTI with alerts and incidents.