OpenCTI

Manages indicators from OpenCTI.
This integration was tested with version 5.12.17 of OpenCTI.

Configure OpenCTI on Cortex XSOAR

1. Navigate to Settings > Integrations > Servers & Services.
2. Search for OpenCTI.

3. Click Add instance to create and configure a new integration instance.

   Parameter	Required
   Base URL	True
   API Key (leave empty. Fill in the API key in the password field.)	False
   Trust any certificate (not secure)	False
   Use system proxy settings	False

4. Click Test to validate the URLs, token, and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

opencti-get-indicators

Get indicators in OpenCTI.

Base Command

opencti-get-indicators

Input

Context Output

opencti-indicator-delete

Delete indicator.

Base Command

opencti-indicator-delete

Input

Context Output

There is no context output for this command.

Command Example

!opencti-indicator-delete id=74faf2e8-bbab-4a1a-a548-58db202c5e57

Human Readable Output

Indicator deleted.

opencti-indicator-field-update

Update the indicator field. The fields that can be updated are: score, description.

Base Command

opencti-indicator-field-update

Input

Context Output

Command Example

!opencti-indicator-field-update field=score id=81d63245-9ba3-495d-8e78-03b037d71e01 value=100

Context Example

{
    "OpenCTI": {
        "Indicator": {
            "id": "81d63245-9ba3-495d-8e78-03b037d71e01"
        }
    }
}

Human Readable Output

Indicator 81d63245-9ba3-495d-8e78-03b037d71e01 updated successfully.

opencti-indicator-create

Create new indicator.

Base Command

opencti-indicator-create

Input

Context Output

Command Example

!opencti-indicator-create type=Domain created_by=0c7cb378-64c3-4809-b423-986ac7cecf91 description=test value="TestDomainDocs.com" score=70 label_id=fa57f98e-f2f5-45fd-97f2-bf2c53119044 marking_id=9128e411-c759-4af0-aeb0-b65f12082648

Context Example

{
    "OpenCTI": {
        "Indicator": {
            "id": "7ed5946a-81a2-4490-8be8-06d3633a41fb",
            "type": "Domain",
            "value": "TestDomainDocs.com"
        }
    }
}

Human Readable Output

Indicator created successfully. New Indicator id: 7ed5946a-81a2-4490-8be8-06d3633a41fb

opencti-indicator-field-add

Add a field to the indicator. Fields that can be added are marking definition and label.

Base Command

opencti-indicator-field-add

Input

Context Output

There is no context output for this command.

Command Example

!opencti-indicator-field-add id=33bd535b-fa1c-41e2-a6f9-80d82dd29a9b field=label value=07cfae2d-6cc9-42c5-9fd0-32eff8142404

Human Readable Output

Added label successfully.

opencti-indicator-field-remove

Remove indicator field value. Fields which values can be removed are marking definition and label.

Base Command

opencti-indicator-field-remove

Input

opencti-indicator-create

Create a new indicator in OpenCTI.

Base Command

opencti-indicator-create

Input

Context Output

                },
                {
                    "id": "11ddff08-8933-46d7-ab22-31f49496499f",
                    "name": "ExampleOrganization"
                }
            ]
        },
        {
            "organizationsLastRun": "YXJyYXljb25uZWN0aW9uOjI="
        }
    ]
} }

#### Human Readable Output

>### Organizations
>|Name|Id|
>|---|---|
>| Test_Organization | 1e12fe87-db3e-4838-8391-6910547bf60d |
>| ExampleOrganization | 11ddff08-8933-46d7-ab22-31f49496499f |


### opencti-organization-create
***
Create a new organization.


#### Base Command

`opencti-organization-create`
#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| name | Name of the organization to create. | Required | 
| description | Description of the organization. | Optional | 
| reliability | Reliability of the organization. Possible values are: A, B, C, D, E, F. | Optional | 


#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| OpenCTI.Organization.id | String | New organization ID. | 


#### Command Example
```!opencti-organization-create name=ExampleOrganization description="create organization" reliability="C"```

#### Context Example
```json
{
    "OpenCTI": {
        "Organization": {
            "id": "11ddff08-8933-46d7-ab22-31f49496499f"
        }
    }
}

Human Readable Output

Organization ExampleOrganization was created successfully with id: 11ddff08-8933-46d7-ab22-31f49496499f.

opencti-label-list

Get list of all labels.

Base Command

opencti-label-list

Input

Context Output

Command Example

!opencti-label-list limit=2

Context Example

{
    "OpenCTI": {
        "Labels": {
            "LabelsList": [
                {
                    "id": "7ba41668-1594-4a09-9be5-3640f2c2d253",
                    "value": "demisto_lablel"
                },
                {
                    "id": "fa57f98e-f2f5-45fd-97f2-bf2c53119044",
                    "value": "devdemisto"
                }
            ],
            "labelsLastRun": "YXJyYXljb25uZWN0aW9uOjI="
        }
    }
}

Human Readable Output

Labels

Value	Id
demisto_lablel	7ba41668-1594-4a09-9be5-3640f2c2d253
devdemisto	fa57f98e-f2f5-45fd-97f2-bf2c53119044

opencti-label-create

Create a new label.

Base Command

opencti-label-create

Input

Context Output

Command Example

!opencti-label-create name=docsTest

Context Example

{
    "OpenCTI": {
        "Label": {
            "id": "beb5159a-e162-4352-b7d7-6e355db7f057"
        }
    }
}

Human Readable Output

Label docsTest was created successfully with id: beb5159a-e162-4352-b7d7-6e355db7f057.

opencti-external-reference-create

Create external reference.

Base Command

opencti-external-reference-create

Input

Context Output

Command Example

!opencti-external-reference-create source_name=source_name url=www.url.com

Context Example

{
    "OpenCTI": {
        "externalReference": {
            "id": "8339d023-ada2-4b32-8a29-0a3897fc096d"
        }
    }
}

Human Readable Output

Reference source_name was created successfully with id: 8339d023-ada2-4b32-8a29-0a3897fc096d.

opencti-marking-definition-list

Get a list of all marking definitions.

Base Command

opencti-marking-definition-list

Input

Context Output

Command Example

!opencti-marking-definition-list limit=2

Context Example

{
    "OpenCTI": {
        "MarkingDefinitions": {
            "MarkingDefinitionsList": [
                {
                    "id": "dc911977-796a-4d96-95e4-615bd1c41263",
                    "value": "TLP:GREEN"
                },
                {
                    "id": "9128e411-c759-4af0-aeb0-b65f12082648",
                    "value": "TLP:AMBER"
                }
            ],
            "markingsLastRun": "YXJyYXljb25uZWN0aW9uOjI="
        }
    }
}

Human Readable Output

Markings

Value	Id
TLP:GREEN	dc911977-796a-4d96-95e4-615bd1c41263
TLP:AMBER	9128e411-c759-4af0-aeb0-b65f12082648

opencti-relationship-create

Create new relationship.

Base Command

opencti-relationship-create

Input

Context Output

opencti-incident-delete

Delete incident.

Base Command

opencti-incident-delete

Input

Context Output

There is no context output for this command.

opencti-incident-create

Create new incident.

Base Command

opencti-incident-create

Input

Context Output

opencti-observable-field-add

Add a field to the observable. Fields that can be added are marking definition and label.

Base Command

opencti-observable-field-add

Input

Context Output

There is no context output for this command.

opencti-indicator-update

Update a indicator in OpenCTI.

Base Command

opencti-indicator-update

Input

Context Output

opencti-relationship-list

Get a list of all relationships in OpenCTI.

Base Command

opencti-relationship-list

Input

Context Output

opencti-observable-create

Create new observable.

Base Command

opencti-observable-create

Input

Context Output

opencti-get-observables

Gets observables from OpenCTI.

Base Command

opencti-get-observables

Input

Context Output

opencti-relationship-delete

Delete relationship.

Base Command

opencti-relationship-delete

Input

Context Output

There is no context output for this command.

opencti-observable-delete

Delete observable.

Base Command

opencti-observable-delete

Input

Context Output

There is no context output for this command.

opencti-observable-field-remove

Remove observable field value. Fields which values can be removed are marking definition and label.

Base Command

opencti-observable-field-remove

Input

Context Output

There is no context output for this command.

opencti-observable-field-update

Update the observable field. The fields that can be updated are: score, description.

Base Command

opencti-observable-field-update

Input

Context Output

opencti-indicator-types-list

Get a list of all indicator types.

Base Command

opencti-indicator-types-list

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

opencti-incident-types-list

Get a list of all incident types.

Base Command

opencti-incident-types-list

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

opencti-get-incidents

Get incidents in OpenCTI.

Base Command

opencti-get-incidents

Input

Context Output