OpenCTI Stream

Subscribe to an OpenCTI live stream and forward each create/update event as a single STIX 2.1 bundle. Supports three output modes via the standard connector helper settings: RabbitMQ queue (default, for in-platform fan-out and applicant impersonation), local directory and S3 bucket. Directory and S3 modes pair naturally with the diode-import connector to replicate data between OpenCTI instances or air-gapped environments. The originating user (origin.user_id of each stream event) is propagated as the bundle applicant_id, so it can be remapped on the target instance via DIODE_IMPORT_APPLICANT_MAPPINGS.