OpenCTI Stream
Supported by Filigran
Other
Overview
Forward events from an OpenCTI live stream to a queue, directory or S3 bucket as STIX 2.1 bundles.
Subscribe to an OpenCTI live stream and forward each create/update event as a single STIX 2.1 bundle. Supports three output modes via the standard connector helper settings: RabbitMQ queue (default, for in-platform fan-out and applicant impersonation), local directory and S3 bucket. Directory and S3 modes pair naturally with the diode-import connector to replicate data between OpenCTI instances or air-gapped environments. The originating user (origin.user_id of each stream event) is propagated as the bundle applicant_id, so it can be remapped on the target instance via DIODE_IMPORT_APPLICANT_MAPPINGS.