Copy page

OpenCTI

Indicators

Ingests Indicators of Compromise (IOCs) from OpenCTI via GraphQL for threat intelligence integration and analysis.

Sync Type: Incremental

Description

The OpenCTI Indicators input connector retrieves threat indicator data from your OpenCTI instance. Indicators represent observations about suspicious activity or artifacts that may indicate compromise, such as file hashes, IP addresses, domain names, email addresses, and URLs. This input provides continuous visibility into threat intelligence data from your OpenCTI deployment.

Requirements

Before configuring this input, you need:

1. OpenCTI Instance: An operational OpenCTI instance with API access enabled

   • Cloud-hosted or on-premises deployment
   • GraphQL API endpoint accessible from Monad

2. API Credentials: An API key with proper permissions

   • API keys can be created by OpenCTI users with appropriate roles
   • The API key is used as a Bearer token for authentication

3. Network Access: The connector makes an outbound HTTPS call from Monad to your OpenCTI GraphQL endpoint ({base_url}/graphql). Both sides can be cloud-hosted or on-premises, so open the path for your specific combination:

   • Monad SaaS → OpenCTI cloud-hosted (public endpoint): ensure your OpenCTI instance (and any WAF/firewall in front of it) allows inbound HTTPS from Monad's egress IP ranges.
   • Monad SaaS → OpenCTI on-premises: a purely internal OpenCTI is not reachable from Monad SaaS. Publish the GraphQL endpoint so Monad can reach it — e.g. through your gateway/reverse proxy with Monad's egress IPs allowlisted, or over a VPN/tunnel Monad can use.
   • Self-hosted Monad → OpenCTI cloud-hosted (public endpoint): ensure your Monad cluster has outbound internet access, and that any egress firewall or proxy permits connections to the OpenCTI endpoint.
   • Self-hosted Monad → OpenCTI on-premises: ensure the Monad cluster can route to the OpenCTI endpoint on your network — DNS resolution, network policies/security groups, and any internal firewall between them.
   • In every case the endpoint must be HTTPS (HTTP endpoints are rejected). When Monad SaaS must reach OpenCTI through a firewall or IP allowlist, allow Monad's published egress IPs — see Monad Egress IP Addresses.

Setup Instructions

1. Generate an API Key:

   • Log in to your OpenCTI instance with administrator or privileged user account
   • Navigate to Profile > Settings > API access
   • Click Create a new token or Generate new API key
   • Copy the generated API key and store it securely (this is the secret for configuration)
   • Note the API key cannot be viewed again after generation

2. Obtain the Endpoint URL:

   • Identify your OpenCTI instance base URL (e.g., https://opencti.example.com or https://opencti-prod.mycompany.net)
   • The GraphQL endpoint will be at {base_url}/graphql

3. Configure the Connector:

   • Use the API key and base URL in the configuration settings

Configuration

The following configuration defines the input parameters. Each field's specifications, such as type, requirements, and descriptions, are detailed below.

Settings

Setting	Type	Required	Default	Description
Endpoint URL	string	Yes	-	Base URL of your OpenCTI instance (e.g., https://opencti.example.com)
Minimum Confidence	integer	No	50	Minimum value of the OpenCTI confidence field, 0-100. Only indicators with confidence >= this value are ingested. This filters on confidence, not x_opencti_score — see the note below the table.
Pattern Type	string	No	"stix"	Filters on the indicator's pattern language (stix, yara, sigma, snort, …), not a category. Indicators whose pattern_type differs are excluded. Set to an empty string to include all pattern types.
Filter Mode	string	Yes	"and"	Logical operator for combining filters: "and" or "or"
Backfill Start Time	string	No	-	Start time for initial data fetch in RFC3339 format (e.g., 2024-01-01T00:00:00Z). If not specified, the first sync starts from the current time; subsequent runs then fetch indicators created or modified since the last run (the connector checkpoints on updated_at).

Which field the confidence filter uses. OpenCTI stores two different numbers on an indicator:

• confidence — the credibility/quality of the information. This is the field Minimum Confidence filters on.
• x_opencti_score — how malicious the observable is. This is the large number shown on the indicator's page in the OpenCTI UI, and it is not used by this connector.

They often differ (in the sample record below, x_opencti_score is 85 while confidence is 90). If an indicator you expect is missing, check its confidence, not its score. The confidence number comes from OpenCTI's per-instance Confidence Level → value mapping (Settings > Customization > Indicators > Confidence), so a level such as "Good / Possibly True" can map to a value just under 50 and be excluded by the default threshold.

Filters are applied server-side and silently. Under the default and Filter Mode an indicator must satisfy every active filter (confidence, pattern type) to be ingested; one that fails any of them is simply not returned, with no per-record error. Set Filter Mode to or to include an indicator that matches any filter, or lower Minimum Confidence / clear Pattern Type, to widen what is ingested.

Secrets

Secret	Type	Required	Description
API Key	string	Yes	API key used as a Bearer token for authentication against the OpenCTI instance.

Troubleshooting

Common Issues

1. Authentication Errors:

   • Verify the API key is correct and has not expired or been revoked
   • Confirm the API key was created for the correct OpenCTI user/role
   • Check that the API key still has access permissions in OpenCTI
   • Regenerate the API key if needed and update the configuration

2. Connection Issues:

   • Verify the Endpoint URL is correct and accessible from your network
   • Check for firewall or network restrictions blocking access to the OpenCTI instance
   • Ensure the URL uses HTTPS (HTTP endpoints are rejected for security)
   • For on-premises instances, verify DNS resolution and routing

3. Invalid Confidence Score:

   • Confidence must be a number between 0 and 100
   • Default is 50 if not specified
   • Common values: 0 (all indicators), 50 (medium and above), 75 (high and above), 100 (only highest confidence)

4. Filter Mode Errors:

   • Filter mode must be either "and" or "or" (case-sensitive, lowercase only)
   • Default is "and" if not specified
   • "and" means all filters must be satisfied; "or" means any filter can be satisfied

5. No Data Retrieved:

   • Check if indicators exist in your OpenCTI instance with the configured confidence level
   • Verify the pattern type filter matches indicators in your instance (empty string includes all types)
   • Check the backfill start time; if set to a future date, no data will be retrieved
   • Review connector logs for detailed error messages

6. Invalid Backfill Start Time:

   • Backfill start time must be in RFC3339 format (e.g., 2024-01-01T00:00:00Z)
   • The timestamp cannot be in the future
   • Backfill time affects only the initial sync; subsequent syncs use the saved cursor timestamp

7. Some indicators are missing while others from the same time period appear:

   • This is almost always a filter excluding the specific indicator server-side — not a sync gap. On the missing indicator in OpenCTI, check:
     • Confidence — is its confidence field (not x_opencti_score) below your Minimum Confidence? A value just under the threshold (e.g. 49 against the default of 50) is the most common cause.
     • Pattern type — does its pattern_type differ from your Pattern Type setting (e.g. a yara/sigma indicator when the filter is stix)?
   • To include it going forward: lower Minimum Confidence, widen or clear Pattern Type, or set Filter Mode to or. Alternatively, correct the value at the source (e.g. OpenCTI's Confidence Level mapping).
   • Because the connector checkpoints on updated_at, editing the indicator in OpenCTI (which updates its modified time) makes it eligible for re-ingestion on the next sync — so a confidence raised past the threshold later will be picked up.

Related Articles

• OpenCTI GraphQL API Documentation
• OpenCTI Indicators Overview
• Monad Egress IP Addresses — allowlisting when Monad SaaS reaches your OpenCTI instance

Sample Record

Code
{
  "id": "indicator--f61078c4-e59f-404e-8b5e-8f7f2f5e4a3d",
  "standard_id": "indicator--f61078c4-e59f-404e-8b5e-8f7f2f5e4a3d",
  "entity_type": "Indicator",
  "name": "example.com",
  "description": "Malicious domain associated with Emotet botnet",
  "pattern": "[domain-name:value = 'example.com']",
  "pattern_type": "stix",
  "valid_from": "2024-01-15T10:30:00Z",
  "valid_until": "2025-01-15T10:30:00Z",
  "x_opencti_score": 85,
  "confidence": 90,
  "created_at": "2024-01-15T10:30:00Z",
  "updated_at": "2024-01-16T14:22:15Z",
  "created": "2024-01-15T10:30:00Z",
  "modified": "2024-01-16T14:22:15Z",
  "objectMarking": [
    {
      "id": "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da",
      "standard_id": "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da",
      "entity_type": "Marking-Definition",
      "definition_type": "tlp",
      "definition": "tlp:amber",
      "x_opencti_order": 2,
      "x_opencti_color": "#FBB917"
    }
  ],
  "objectLabel": [
    {
      "id": "label--f1c1de4d-60cd-4e13-8e67-399788629775",
      "value": "malware",
      "color": "#d90e18"
    },
    {
      "id": "label--36218b84-3861-514a-8360-29160fbee5a9",
      "value": "emotet",
      "color": "#ff5500"
    }
  ],
  "killChainPhases": [
    {
      "id": "kill-chain-phase--b6e30425-13c7-40eb-8bfc-e1da1527367d",
      "kill_chain_name": "mitre-attack",
      "phase_name": "command-and-control",
      "x_opencti_order": 6
    }
  ]
}

Sync frequency

By default this input polls approximately every 10 seconds, with each sync beginning after the previous one completes. A cron schedule configured on the pipeline overrides this cadence. See Input Sync Frequency for details.