Other
Aperçu
This connector extracts threat intelligence from documents (PDF, DOCX, TXT, HTML, Markdown, CSV), matching text against OpenCTI entities and extracting observables such as IPs, domains, URLs, and hashes.
This connector allows organizations to extract threat intelligence from documents and feed it into OpenCTI. It parses document files (PDF, DOCX, TXT, HTML, Markdown, CSV) and extracts:
- Entities: matches text against existing entities in the OpenCTI knowledge base (threat actors, malware, campaigns, etc.)
- Observables: extracts IOCs using regex patterns and the ioc_finder library (IP addresses, domains, URLs, hashes, etc.)
The connector can operate in two modes: file import (parse uploaded files and create/update entities) and internal analysis (analyze files or entity fields and return structured analysis results).