building-ioc-enrichment-pipeline-with-opencti

name	building-ioc-enrichment-pipeline-with-opencti
description	OpenCTI is an open-source platform for managing cyber threat intelligence knowledge, built on STIX 2.1 as its native data model. This skill covers building an automated IOC enrichment pipeline using O
domain	cybersecurity
subdomain	threat-intelligence
tags	["threat-intelligence","cti","ioc","mitre-attack","stix","opencti","enrichment","virustotal"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"]

Building IOC Enrichment Pipeline with OpenCTI

Overview

OpenCTI is an open-source platform for managing cyber threat intelligence knowledge, built on STIX 2.1 as its native data model. This skill covers building an automated IOC enrichment pipeline using OpenCTI's connector ecosystem to enrich indicators with context from VirusTotal, Shodan, AbuseIPDB, GreyNoise, and other sources. The pipeline automatically enriches newly ingested indicators, correlates them with known threat actors and campaigns, and scores them for analyst prioritization.

When to Use

• When deploying or configuring building ioc enrichment pipeline with opencti capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Common Misconfigurations & Verification

• Connector scope/TLP mismatches: an enrichment connector only fires on observable types in its CONNECTOR_SCOPE -- Shodan scoped to IPv4-Addr silently ignores domains, and VIRUSTOTAL_MAX_TLP=TLP:AMBER skips TLP:RED observables with no error. Verify scope covers every type you ingest and that max-TLP matches your data classification.
• CONNECTOR_AUTO off: with CONNECTOR_AUTO=false, enrichment never triggers on ingest and analysts assume IOCs are enriched when they are not.
• Token/ID collisions: reused CONNECTOR_ID UUIDs or a wrong OPENCTI_TOKEN let connectors register but never consume the RabbitMQ queue -- work piles up invisibly.
• Confidence & dedup: connectors that overwrite rather than merge clobber existing scores; STIX dedup keys on the observable value, so malformed IPv4-Addr values create duplicate nodes.

To verify: submit a known observable and confirm the connector log shows it consumed the message and posted a Note/labels back (check the RabbitMQ queue is not backing up); confirm GreyNoise/SecurityTrails 404s and timeouts are caught (the try/except logs an error rather than leaving the observable silently un-enriched). Validate that confidence updates land on the indicator and that a TLP:RED observable is correctly skipped by an AMBER-capped connector. Run an IPv4-Addr and a Domain-Name end-to-end and confirm each routed to the right connectors.

Prerequisites

• Docker and Docker Compose for OpenCTI deployment
• Python 3.9+ with pycti library