Opencti

🚀 OpenCTI MCP Server

The OpenCTI MCP Server is an interface for collaborating with OpenCTI, enabling you to query and manipulate security data such as threat intelligence and vulnerabilities.

🚀 Quick Start

Before You Begin

The OpenCTI MCP Server is an interface for collaborating with OpenCTI. It allows you to query and manipulate security data, such as threat intelligence, vulnerabilities, etc.

📑 Table of Contents

1. Overview
2. Features
3. Prerequisites
4. Installation
5. Configuration
6. Security Considerations
7. Available Tools
8. Contribution
9. License

🌟 Overview

The OpenCTI MCP Server is an interface for collaborating with OpenCTI. It allows you to query and manipulate security data, such as threat intelligence, vulnerabilities, etc.

✨ Features

The following are the main features of the MCP Server:

1. Retrieve and Search Threat Intelligence Data
   • Get the latest reports.
   • Search for reports by ID.
   • Filter data by conditions.
2. List Users and Groups
   • List all users.
   • List all groups and their members.
3. Manage STIX Objects
   • List attack patterns.
   • Get campaigns by name.
4. System Management
   • List connectors.
   • List status templates.
5. File Operations
   • Get file information (by ID).
   • List all files.
6. Reference Data
   • List marking definitions.
   • List available labels.

📋 Prerequisites

To use the OpenCTI MCP Server, you need to meet the following requirements:

• Node.js version >= 12.x
• Access to OpenCTI

📦 Installation

You can install the OpenCTI MCP Server in the following two ways:

Install Using Smithereen

# Install smithereen via npm
npm install -g smithereen

# Start smithereen
smithereen

Manual Installation

1. Clone the repository:

git clone https://github.com/opencti/Documentation.git
cd Documentation

2. Install dependencies:

npm install

3. Start the server:

npm start

⚙️ Configuration

Environment Variables

You can configure the OpenCTI MCP Server through the following environment variables:

• OPENCTI_API_KEY: Specify the API key for accessing OpenCTI.
• OPENCTI_URL: Specify the URL of OpenCTI.

MCP Settings

You can configure the following in the config.json file:

{
    "api_key": "your_api_key",
    "url": "https://opencti.example.com"
}

🔒 Security Considerations

• Do not expose your API key in the version control system.
• Ensure the security of the config.json file to avoid unauthorized access.
• It is recommended to update the API key regularly to enhance security.

🛠️ Available Tools

The following are the available tools provided by the MCP Server:

Get a Report

• Get a report by ID:

{
    "name": "get_report_by_id",
    "arguments": {
        "id": "report-id" // Required
    }
}

List Users

• List all users:

{
    "name": "list_users",
    "arguments": {}
}

Manage Labels

• List all marking definitions:

{
    "name": "list_marking_definitions",
    "arguments": {}
}

🤝 Contribution

Contributions are welcome! Please feel free to submit pull requests.

📄 License

MIT License