Integrate OpenCTI with Google SecOps

This integration enables you to create, enrich, and manage threat intelligence objects in OpenCTI directly from Google SecOps SOAR playbooks.

Integration parameters

Use the following parameters to configure the integration:

Parameter name	Type	Default value	Is mandatory	Description
API Root	String	https://demo.opencti.io	Yes	OpenCTI API root URL.
API Token	Password	N/A	Yes	OpenCTI User Token. You can find it in your OpenCTI profile settings.
Verify SSL	Checkbox	Checked	No	If enabled, verifies that the SSL certificate for the connection to the OpenCTI server is valid.

For instructions about how to configure an integration in Google SecOps, see Configure integrations.

You can make changes at a later stage, if needed. After you configure an integration instance, you can use it in playbooks. For more information about how to configure and support multiple instances, see Supporting multiple instances.

Actions

For more information about actions, see Respond to pending actions from Your Workdesk and Perform a manual action.

Ping

Tests connectivity to the OpenCTI instance and verifies that the API token is valid.

Parameters

No parameters are required.

Action results

Script result name	Value options	Example
is_success	True or False	is_success:True

---

Enrich Observable

Full enrichment of an Observable (SCO) in OpenCTI. Looks up the entity value as a STIX Cyber Observable, retrieves its metadata (score, labels, description, created_by) and all relationships. Marks the entity suspicious when the x_opencti_score exceeds the configured threshold.

Parameters

Parameter name	Type	Default value	Is mandatory	Description
Threshold	String	50	No	The minimum OpenCTI score (x_opencti_score) required to mark a Google SecOps entity as suspicious.
Create Insight	Checkbox	Checked	No	If enabled, the action will create an insight containing all retrieved information about the observable and its relationships.

Action results

Script result name	Value options	Example
is_success	True or False	is_success:True

---

Enrich Indicator

Full enrichment of an Indicator (SDO) in OpenCTI. Searches for an Indicator whose name matches the entity value, retrieves its metadata (score, confidence, kill chain, validity window) and all relationships (Malware, TTPs, Campaigns, Threat Actors, etc.). Marks the entity suspicious when the x_opencti_score exceeds the configured threshold.

Parameters

Parameter name	Type	Default value	Is mandatory	Description
Threshold	String	50	No	The minimum OpenCTI score (x_opencti_score) required to mark a Google SecOps entity as suspicious.
Create Insight	Checkbox	Checked	No	If enabled, the action will create an insight containing all retrieved information about the indicator and its relationships.

Action results

Script result name	Value options	Example
is_success	True or False	is_success:True

---

Create Observable

Create a new STIX Cyber Observable in OpenCTI.

Parameters

Parameter name	Type	Default value	Is mandatory	Description
Observable Value	String	N/A	Yes	Value of the observable.
Observable Type	DDL	Domain Name	Yes	Type of the observable. Possible values: Domain Name, URL, Hostname, Email Subject, Email Addr, IP, Hash.
Description	String	N/A	No	Observable description.
Score	String	N/A	No	Threat score. Allowed values are integers between 0 and 100 (inclusive).
Labels	String	N/A	No	Comma-separated list of labels.
Marking	DDL	TLP:AMBER	No	Marking definition to apply. Possible values: TLP:CLEAR, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, TLP:RED.
Create Indicator	Checkbox	Unchecked	No	Create an indicator from this observable.

Action results

Script result name	Value options	Example
is_success	True or False	is_success:True

---

Create Observables

Create STIX Cyber Observables in OpenCTI from the action's target entities (bulk creation).

Parameters

Parameter name	Type	Default value	Is mandatory	Description
Description	String	N/A	No	Observable description.
Score	String	50	No	Threat score. Allowed values are integers between 0 and 100 (inclusive).
Labels	String	N/A	No	Comma-separated list of labels.
Marking	DDL	TLP:AMBER	No	Marking definition to apply. Possible values: TLP:CLEAR, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, TLP:RED.
Create Indicator	Checkbox	Unchecked	No	Create an indicator from each observable.

Action results

Script result name	Value options	Example
is_success	True or False	is_success:True

---

Create Indicator

Create an indicator in OpenCTI.

Parameters

Parameter name	Type	Default value	Is mandatory	Description
Name	String	N/A	Yes	Specify indicator name.
Pattern	String	N/A	Yes	Specify STIX pattern (e.g. [ipv4-addr:value = '203.0.113.0']).
Description	String	N/A	No	Specify indicator description.
Valid From	String	N/A	No	Specify valid from date (ISO 8601 format).
Valid Until	String	N/A	No	Specify valid until date (ISO 8601 format).
Score	String	N/A	No	Specify indicator score (0-100).
Labels	String	N/A	No	Specify entity's labels.
Marking	DDL	TLP:AMBER	No	Specify marking for the indicator. Possible values: TLP:CLEAR, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, TLP:RED.

Action results

Script result name	Value options	Example
is_success	True or False	is_success:True

---

Create Incident

Create an incident in OpenCTI.

Parameters

Parameter name	Type	Default value	Is mandatory	Description
Name	String	N/A	Yes	Specify the name of the incident.
Description	String	N/A	No	Specify the description of the incident.
Created At	String	N/A	No	Specify the creation date of the incident (ISO 8601 format).
Severity	String	N/A	No	Specify the severity of the incident.
Type	String	alert	No	Specify the type of the incident.
Labels	String	N/A	No	Specify labels to apply, comma-separated (e.g. label1, label2).
Marking	DDL	TLP:AMBER	No	Specify the marking of the incident. Possible values: TLP:CLEAR, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, TLP:RED.

Action results

Script result name	Value options	Example
is_success	True or False	is_success:True

---

Create Incident Response

Create an Incident Response case in OpenCTI.

Parameters

Parameter name	Type	Default value	Is mandatory	Description
Name	String	N/A	Yes	Specify the name of the Incident Response.
Description	String	N/A	No	Specify the description of the Incident Response.
Created At	String	N/A	No	Specify the creation date of the Incident Response (ISO 8601 format).
Severity	String	N/A	No	Specify the severity of the Incident Response.
Priority	String	N/A	No	Specify the priority of the Incident Response.
Type	String	Alert	No	Specify the type of the Incident Response.
Labels	String	N/A	No	Specify labels to apply, comma-separated (e.g. label1, label2).
Marking	DDL	TLP:AMBER	No	Specify the marking of the Incident Response. Possible values: TLP:CLEAR, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, TLP:RED.

Action results

Script result name	Value options	Example
is_success	True or False	is_success:True

---

Create Report

Create a report in OpenCTI.

Parameters

Parameter name	Type	Default value	Is mandatory	Description
Name	String	N/A	Yes	Specify the name of the report.
Publication Date	String	N/A	Yes	Specify publication date (ISO 8601 format).
Description	String	N/A	No	Specify description of the report.
Report types	String	N/A	No	Specify report types as comma-separated values.
Labels	String	N/A	No	Specify entity's labels.
Marking	DDL	TLP:AMBER	No	Specify marking for the report. Possible values: TLP:CLEAR, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, TLP:RED.

Action results

Script result name	Value options	Example
is_success	True or False	is_success:True

---

Create Campaign

Create a campaign in OpenCTI.

Parameters

Parameter name	Type	Default value	Is mandatory	Description
Name	String	N/A	Yes	Specify campaign name.
Description	String	N/A	No	Specify campaign description.
First Seen	String	N/A	No	Specify first seen date (ISO 8601 format).
Last Seen	String	N/A	No	Specify last seen date (ISO 8601 format).
Labels	String	N/A	No	Specify labels as comma-separated values.
Marking	DDL	TLP:AMBER	No	Specify marking for the campaign. Possible values: TLP:CLEAR, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, TLP:RED.

Action results

Script result name	Value options	Example
is_success	True or False	is_success:True

---

Create Malware

Create a malware entry in OpenCTI.

Parameters

Parameter name	Type	Default value	Is mandatory	Description
Name	String	N/A	Yes	Specify malware name.
Description	String	N/A	No	Specify malware description.
Is Family	Checkbox	Checked	No	Specify whether malware is a family.
Malware Types	String	N/A	No	Specify malware types as comma-separated values.
Labels	String	N/A	No	Specify entity's labels.
Marking	DDL	TLP:AMBER	No	Specify marking for the malware. Possible values: TLP:CLEAR, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, TLP:RED.

Action results

Script result name	Value options	Example
is_success	True or False	is_success:True

---

Create Attack Pattern

Create an attack pattern in OpenCTI (MITRE ATT&CK technique).

Parameters

Parameter name	Type	Default value	Is mandatory	Description
Name	String	N/A	Yes	Specify attack pattern name.
Description	String	N/A	No	Specify attack pattern description.
External Id	String	N/A	No	Specify MITRE ATT&CK external id (e.g. T1059).
Labels	String	N/A	No	Specify entity's labels.
Marking	DDL	TLP:AMBER	No	Specify marking for the attack pattern. Possible values: TLP:CLEAR, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, TLP:RED.

Action results

Script result name	Value options	Example
is_success	True or False	is_success:True

---

Create Intrusion Set

Create an intrusion set in OpenCTI.

Parameters

Parameter name	Type	Default value	Is mandatory	Description
Name	String	N/A	Yes	Specify intrusion set name.
Description	String	N/A	No	Specify intrusion set description.
Labels	String	N/A	No	Specify entity's labels.
Marking	DDL	TLP:AMBER	No	Specify marking for the intrusion set. Possible values: TLP:CLEAR, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, TLP:RED.

Action results

Script result name	Value options	Example
is_success	True or False	is_success:True

---

Create Threat Actor Group

Create a threat actor group in OpenCTI.

Parameters

Parameter name	Type	Default value	Is mandatory	Description
Name	String	N/A	Yes	Specify threat actor group name.
Description	String	N/A	No	Specify threat actor group description.
Threat Actor Types	String	N/A	No	Specify threat actor types as comma-separated values.
Labels	String	N/A	No	Specify entity's labels.
Marking	DDL	TLP:AMBER	No	Specify marking for the threat actor group. Possible values: TLP:CLEAR, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, TLP:RED.

Action results

Script result name	Value options	Example
is_success	True or False	is_success:True

---

Create Tool

Create a tool entry in OpenCTI.

Parameters

Parameter name	Type	Default value	Is mandatory	Description
Name	String	N/A	Yes	Specify tool name.
Description	String	N/A	No	Specify tool description.
Tool Types	String	N/A	No	Specify tool types as comma-separated values.
Labels	String	N/A	No	Specify entity's labels.
Marking	DDL	TLP:AMBER	No	Specify marking for the tool. Possible values: TLP:CLEAR, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, TLP:RED.

Action results

Script result name	Value options	Example
is_success	True or False	is_success:True

---

Create Vulnerability

Create a vulnerability in OpenCTI.

Parameters

Parameter name	Type	Default value	Is mandatory	Description
Name	String	N/A	Yes	Specify vulnerability name (e.g. CVE-2024-1234).
Description	String	N/A	No	Specify vulnerability description.
Labels	String	N/A	No	Specify entity's labels.
Marking	DDL	TLP:AMBER	No	Specify marking for the vulnerability. Possible values: TLP:CLEAR, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, TLP:RED.

Action results

Script result name	Value options	Example
is_success	True or False	is_success:True

---

Create Relationship

Create a STIX Domain Object (SDO) relationship in OpenCTI between two entities.

Parameters

Parameter name	Type	Default value	Is mandatory	Description
Relationship Type	String	related-to	No	Specify relationship type (e.g. related-to, uses, targets, indicates).
Source Entity Id	String	N/A	Yes	Specify source entity id.
Target Entity Id	String	N/A	Yes	Specify target entity id.
Description	String	N/A	No	Specify relationship description.
First Seen	String	N/A	No	Specify first seen date (ISO 8601 format).
Last Seen	String	N/A	No	Specify last seen date (ISO 8601 format).
Marking	DDL	TLP:AMBER	No	Specify marking for the relationship. Possible values: TLP:CLEAR, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, TLP:RED.

Action results

Script result name	Value options	Example
is_success	True or False	is_success:True

---

Create Sighting

Create a sighting in OpenCTI, linking an observed entity to a threat.

Parameters

Parameter name	Type	Default value	Is mandatory	Description
From Object Id	String	N/A	Yes	Specify source object id.
To Object Id	String	N/A	Yes	Specify target object id.
Description	String	N/A	No	Specify sighting description.
First Seen	String	N/A	No	Specify first seen date (ISO 8601 format).
Last Seen	String	N/A	No	Specify last seen date (ISO 8601 format).
Labels	String	N/A	No	Specify entity's labels.
Marking	DDL	TLP:AMBER	No	Specify marking for the sighting. Possible values: TLP:CLEAR, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, TLP:RED.

Action results

Script result name	Value options	Example
is_success	True or False	is_success:True

---

Create Grouping

Create a grouping container in OpenCTI to group related objects.

Parameters

Parameter name	Type	Default value	Is mandatory	Description
Name	String	N/A	Yes	Specify the name of the grouping.
Context	String	suspicious-activity	Yes	Specify context for the grouping (e.g. suspicious-activity, malware-analysis).
Labels	String	N/A	No	Specify entity's labels.
Marking	DDL	TLP:AMBER	No	Specify marking for the grouping. Possible values: TLP:CLEAR, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, TLP:RED.

Action results

Script result name	Value options	Example
is_success	True or False	is_success:True

---

Create Request for Information

Create a Request for Information (RFI) case in OpenCTI.

Parameters

Parameter name	Type	Default value	Is mandatory	Description
Name	String	N/A	Yes	Specify the name of the Request for Information.
Description	String	N/A	No	Specify the description of the Request for Information.
Created At	String	N/A	No	Specify the creation date of the Request for Information (ISO 8601 format).
Severity	String	N/A	No	Specify the severity of the Request for Information.
Type	String	N/A	No	Specify the type of the Request for Information.
Labels	String	N/A	No	Specify labels to apply, comma-separated (e.g. label1, label2).
Marking	DDL	TLP:AMBER	No	Specify the marking. Possible values: TLP:CLEAR, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, TLP:RED.

Action results

Script result name	Value options	Example
is_success	True or False	is_success:True

---

Create Request for Takedown

Create a Request for Takedown case in OpenCTI.

Parameters

Parameter name	Type	Default value	Is mandatory	Description
Name	String	N/A	Yes	Specify the name of the Request for Takedown.
Description	String	N/A	No	Specify the description of the Request for Takedown.
Created At	String	N/A	No	Specify the creation date of the Request for Takedown (ISO 8601 format).
Severity	String	N/A	No	Specify the severity of the Request for Takedown.
Type	String	N/A	No	Specify the type of the Request for Takedown.
Labels	String	N/A	No	Specify labels to apply, comma-separated (e.g. label1, label2).
Marking	DDL	TLP:AMBER	No	Specify the marking. Possible values: TLP:CLEAR, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, TLP:RED.

Action results

Script result name	Value options	Example
is_success	True or False	is_success:True

---

Add Object to Container

Add an existing object to a container (Report, Incident Response Case, Request for Takedown, Request for Information, or Grouping) in OpenCTI.

Parameters

Parameter name	Type	Default value	Is mandatory	Description
Container Type	DDL	Report	Yes	Type of container where the object will be added. Possible values: Report, Incident Response Case, Request for Takedown, Request for Information, Grouping.
Container Id	String	N/A	Yes	Identifier of the target container.
Object Id	String	N/A	Yes	Identifier of the object to add.

Action results

Script result name	Value options	Example
is_success	True or False	is_success:True