FIMI & Disinformation
Aperçu
CheckFirst connector imports FIMI and disinformation campaign articles into OpenCTI, mapping influence operation infrastructure, channels, and media content as STIX 2.1 objects.
CheckFirst is a platform tracking Foreign Information Manipulation and Interference (FIMI) campaigns. This connector ingests CheckFirst articles from the CheckFirst API into OpenCTI as STIX 2.1 bundles, tracking influence operations such as the Portal-Kombat / Pravda Network Russian information campaign.
Key features:
- Initial infrastructure bundle with known Pravda network domains, subdomains, and hosting IPs
- Per-article ingestion mapped to STIX 2.1 objects (Intrusion Sets, Campaigns, Infrastructure, Channels, Media Content)
- Deterministic STIX IDs ensuring no duplicates on reruns
- Page-based progress tracking for resumable imports