智源IOC富化引擎
原名：building-ioc-enrichment-pipeline-with-opencti
在 OpenCTI 上构建自动化 IOC 富化管道，原生支持 STIX 2.1 标准。
- 分类
- 开发提效
- 版本
- v1.0
- 作者
- 弈韬(@ra1nzzz)
- 下载
- 2
- 收藏
- 0
- 发布
- 2026-08-18
- 更新
- 2026-08-24
- TRACE 评分
- 4 / 5
内容概览
OpenCTI is an open-source platform for managing cyber threat intelligence knowledge, built on STIX 2.1 as its native data model. This skill covers building an automated IOC enrichment pipeline using OpenCTI's connector ecosystem to enrich indicators with context from VirusTotal, Shodan, AbuseIPDB, GreyNoise, and other sources. The pipeline automatically enriches newly ingested indicators, correlates them with known threat actors and campaigns, and scores them for analyst prioritization. - When deploying or configuring building ioc enrichment pipeline with opencti capabilities in your environment - When establishing security controls aligned to compliance requirements - When building or improving security architecture for this domain - When conducting security assessments that require this implementation - Docker and Docker Compose for OpenCTI deployment - Python 3.9+ with pycti library -…