Threat Actor Enrichment
Supported by community
Adversary & Campaign Insights
Overview
Enriches threat actor groups with computed last_seen dates from related indicators and reports.
Periodically enriches threat actor group entities by computing their real last_seen date from related indicators and reports. Fixes stale last_seen values that occur because OpenCTI does not automatically propagate activity dates from linked IOCs back to threat actor entities.