OpenCTI for Elastic Security
Detection & Response Enablement
概要
The Elastic OpenCTI integration ingests threat intelligence from OpenCTI into Elastic, enriching security events with IOCs (indicators of compromise) and threat context so analysts can detect, investigate, and respond to attacks more effectively.
The Elastic OpenCTI integration enables the ingestion of threat intelligence indicators from an OpenCTI platform into Elastic.
It collects structured IOC data (such as IPs, domains, URLs, file hashes, and certificates) via the OpenCTI GraphQL API and maps them to ECS fields.
These indicators can then be searched, visualized, and used in detection rules to enrich security analysis and identify malicious activity in near real time.
基本情報
Filigran
Nino Rowlands
サードパーティとの統合
Endpoint Detection & Response
2026年8月19日
5.12.24
1