ClickHouse
Automatic deploy
Supported by community
Detection & Response Enablement
Overview
Stream OpenCTI events (create/update/delete) to a ClickHouse table for analytics and hunting.
The OpenCTI ClickHouse connector streams OpenCTI knowledge to a ClickHouse database in real time. Leveraging OpenCTI live streams, every create, update and delete event is written to a ClickHouse table (created automatically) so that threat intelligence can be correlated, hunted and visualised alongside detection telemetry in a high-performance analytics backend.