OpenCTI - Cortex XSOAR
Detection & Response Enablement
概要
This integration connects Cortex XSOAR with OpenCTI's cyber threat intelligence database, enabling you to retrieve threat-linked indicators, enrich investigations, and contribute intelligence back to OpenCTI.
The OpenCTI - Cortex XSOAR integration allows you to leverage OpenCTI's cyber threat intelligence database directly within your XSOAR workflows. You can access lists of indicators associated with threats, complete with additional information to support your investigations. You can also contribute to the OpenCTI database by reporting new indicators or updating existing ones.
Key capabilities include:
- Retrieve Indicator Intelligence: Get information about indicators from the OpenCTI database, with the ability to fetch indicators by type and/or score
- Indicator Management: Report new indicators to OpenCTI, delete indicators from the database, and update indicator fields such as score and description. You can also add or remove marking definitions and labels from existing indicators
- Automated Indicator Creation: Use the included "OpenCTI Create Indicator" playbook to create indicators based on provided inputs like indicator type, score, label, external reference name and URL, and more (with only indicator type being mandatory)
基本情報
Filigran
Nino Rowlands
サードパーティとの統合
Orchestration (SOAR)
2026年7月07日
5.6.1
0