Aperçu
Imports ~200K daily scored indicators (IP, Domain, URL, Hash) from RST Cloud threat feeds into OpenCTI, with relationships to malware, TTPs, threat groups, and CVEs. Supports hourly or daily ingestion with configurable score thresholds.
The RST Threat Feed Connector integrates RST Cloud threat intelligence feeds into OpenCTI. This connector imports Indicators (IP, Domain, URL, Hash) with their relationships to malware, TTPs, tools, threat groups, sectors, CVE, and other objects. This enhances the capability of OpenCTI by providing actionable threat intelligence data, allowing users to make informed decisions based on the latest information from (RST Threat Feed). The feed delivers approximately 200K indicators daily, with the ability to filter by score. Each indicator has an individual score, allowing OpenCTI to keep indicator scores updated when inactive indicators become active again (c2 went offline, a domain had no A DNS entry, a phishing website was not active, etc). Scoring is aligned with OpenCTI scoring algorithms and allows you to set a custom decay speed in your platform. RST Cloud and OpenCTI Scoring and Decay algorithms integration Data scored between 0 and 20 is typically considered noisy. Data with a score of 45+ is used in SIEMs for real-time detection, while data scored 55+ is used for active blocking. However, everyone can set their own thresholds to find the optimal balance for their needs. Data can be retrieved every hour or daily, depending on the use case. The feed includes multiple threat categories, such as: