概要
Imports the ORKL open-source threat intelligence library as STIX Reports, with tagged threat actors as Intrusion Sets and their tools, into OpenCTI.
ORKL (https://orkl.eu) is a free, community-driven library of publicly released Cyber Threat Intelligence reports, sponsored by Sunet. It aggregates PDF and web reports from major sources (MITRE, MISP Galaxy, ETDA, Secureworks, and others), extracting full text and tagging the threat actors and sources referenced in each report.
This connector periodically polls the ORKL REST API (no authentication required) and imports library entries into OpenCTI as STIX Reports. Threat actors tagged on each report are created as Intrusion Sets (or Threat Actors, depending on configuration) and referenced in the report's object_refs, and their associated tools can optionally be imported as STIX Tool objects.
With ORKL's ~29,000 report entries and ~1,900 tracked threat actors, this connector provides a broad, continuously updated, and freely accessible source of structured threat intelligence for OpenCTI.