Docker-compose file to deploy OpenCTI with connectors
OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. It has been created in order to structure, store, organize and visualize technical and non-technical information about cyber threats.
- This Docker-compose file include the following OpenCTI connectors :
Name | Request a token/api key |
---|---|
Common Vulnerabilities and Exposures | โ |
VirusTotal | โ |
MITRE ATT&CK | โ |
OpenCTI | โ |
Cybercrime-Tracker | โ |
source ended in Nov '21 | |
AM!TT | โ |
AlienVault | โ |
AbuseIPDB | โ |
Abuse.ch URLhaus | โ |
Malbeacon | โ |
CryptoLaemus | โ |
Shodan | โ |
Malpedia | โ |
CISA | โ |
Tested on Ubuntu 20.04
git clone https://github.com/JMousqueton/OpenCTI-Docker/
cd OpenCTI-Docker
cp .env.sample .env
- Modify .env file with your variables
sudo apt update && sudo apt upgrade -y && sudo apt install docker-compose
sudo docker-compose --profile start up -d
- Wait a little and connect to http://<your_IP>:8080
Note:
- Use minio-keygen to generate minio keygen.
- use
uuid-gen
to generate TOKEN and connectors ID.
You can scale the number of worker up to X.
In the OpenCTI directory :
docker-compose scale worker=X
cd OpenCTI-Docker
git pull
docker-compose pull
docker-compose up -d
Note:
- To only update OpenCTI version, you can replace step 1 & 2 by editing the first line of .env with the targeted version.
- OpenCTI: https://www.opencti.io
- OpenCTI (sources): https://github.com/OpenCTI-Platform/opencti
- OpenCTI (Docker sources): https://github.com/OpenCTI-Platform/docker
- OpenCTI (Connectors sources): https://github.com/OpenCTI-Platform/connectors
๐ค Julien Mousqueton
- Website: https://julienm.io
- Twitter: @JMousqueton
- Github: @JMousqueton
- LinkedIn: Julien Mousqueton
- CV: https://jmousqueton.github.io
Give a โญ๏ธ if this project helped you!