OpenCTI | Cyber Threat Intelligence Platform Installation Guide (2024)

OpenCTI is an open-source platform designed for cyber threat intelligence (CTI) analysis and management. The platform provides a suite of tools and functionalities that enable users to collect, analyze, and share cybersecurity information.

OpenCTI is built on a graph database architecture, which allows users to model and visualize complex relationships between different entities, such as threat actors, campaigns, and incidents. The platform also includes a flexible data model that can be customized to fit the specific needs of different organizations.

Overall, OpenCTI is a powerful platform for managing and analyzing CTI data, providing users with the tools and functionalities they need to better understand and respond to cybersecurity threats.

Now we will walk through the steps on how to Install the OpenCTI platform.

Follow the below steps to install OpenCTI.

1. Installation Requirements.

Set up a Ubuntu Server 20.04 LTS VM with 4 vCPUs, 16GB of memory, and 150–200GB Hard disk.

2. Set a static IP in the network section.

3. Update the repositories.

sudo apt-get update

4. Install Prerequisites : (Some of these will already be installed most likely, just a second check to verify).

sudo apt-get install apt-transport-https
sudo apt-get install ca-certificates
sudo apt-get install curl
sudo apt-get install gnupg-agent
sudo apt-get install software-properties-common

5. Add the GPG Key.

sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -

6. Add Repo.

sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"

7. Install Docker and Docker Compose.

sudo apt-get update
sudo apt-get install docker-ce docker-ce-cli containerd.io docker-compose

8. Manage docker as a non-root user.

sudo usermod -aG docker $USER

Logoff and back on to make docker user changes effective

9. Docker Swarm Initialization.

docker swarm init - advertise-addr <YOURSTATICIP>

10. Install Portainer: The graphical GUI to manage Docker.

sudo mkdir -p /opt/portainer && cd /opt/portainer
sudo curl -L https://downloads.portainer.io/portainer-agent-stack.yml -o portainer-agent-stack.yml

11. Change ports before starting up Portainer (Required to eliminate conflicts in ports).

sudo nano ./portainer-agent-stack.yml

Change ports from what is shown first to what is shown second
ports:
- "9000:9000"
- "8000:8000"
TO
ports:
- "NEWPORTOFYOURCHOICE:9000"
- "NEWPORTOFYOURCHOICE:8000

Note:
You can place a 2 or 1 in front of 9000 and 8000 respectively to make it easier. Just make note of these ports, as this will be how you access Web
Admin Interface for Portainer.

12. Save Changes.

Hit CTRL-X to exit, “Y” to save changes, and drop back to the shell.

13. Start Portainer.

sudo docker stack deploy - compose-file=portainer-agent-stack.yml portainer

14. Accessing Portainer WebUI.

You can now log in to Portainer by using the http://YOURSTATICIP:29000 or 19000 etc. and setting your initial credentials and password.

15. Now go to the OpenCTI docker page on GitHub using the below link.

Open the docker.compose.yml file in raw format, and copy it.

16. Adding OpenCTI stack.

Now go to Portainer and add a new stack, name it OpenCTI, and paste the copied docker.compose.yml data into the web editor.

version: '3'
services:
 redis:
 image: redis:7.0.8
 restart: always
 volumes:
 - redisdata:/data
 elasticsearch:
 image: docker.elastic.co/elasticsearch/elasticsearch:8.6.1
 volumes:
 - esdata:/usr/share/elasticsearch/data
 environment:
 # Comment out the line below for single-node
 - discovery.type=single-node
 # Uncomment line below below for a cluster of multiple nodes
 # - cluster.name=docker-cluster
 - xpack.ml.enabled=false
 - xpack.security.enabled=false
 - "ES_JAVA_OPTS=-Xms${ELASTIC_MEMORY_SIZE} -Xmx${ELASTIC_MEMORY_SIZE}"
 restart: always
 ulimits:
 memlock:
 soft: -1
 hard: -1
 nofile:
 soft: 65536
 hard: 65536
 minio:
 image: minio/minio:RELEASE.2023-01-31T02-24-19Z
 volumes:
 - s3data:/data
 ports:
 - "9000:9000"
 environment:
 MINIO_ROOT_USER: ${MINIO_ROOT_USER}
 MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD} 
 command: server /data
 healthcheck:
 test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
 interval: 30s
 timeout: 20s
 retries: 3
 restart: always
 rabbitmq:
 image: rabbitmq:3.11-management
 environment:
 - RABBITMQ_DEFAULT_USER=${RABBITMQ_DEFAULT_USER}
 - RABBITMQ_DEFAULT_PASS=${RABBITMQ_DEFAULT_PASS}
 volumes:
 - amqpdata:/var/lib/rabbitmq
 restart: always
 opencti:
 image: opencti/platform:5.5.4
 environment:
 - NODE_OPTIONS=--max-old-space-size=8096
 - APP__PORT=8080
 - APP__BASE_URL=${OPENCTI_BASE_URL}
 - APP__ADMIN__EMAIL=${OPENCTI_ADMIN_EMAIL}
 - APP__ADMIN__PASSWORD=${OPENCTI_ADMIN_PASSWORD}
 - APP__ADMIN__TOKEN=${OPENCTI_ADMIN_TOKEN}
 - APP__APP_LOGS__LOGS_LEVEL=error
 - REDIS__HOSTNAME=redis
 - REDIS__PORT=6379
 - ELASTICSEARCH__URL=http://elasticsearch:9200
 - MINIO__ENDPOINT=minio
 - MINIO__PORT=9000
 - MINIO__USE_SSL=false
 - MINIO__ACCESS_KEY=${MINIO_ROOT_USER}
 - MINIO__SECRET_KEY=${MINIO_ROOT_PASSWORD}
 - RABBITMQ__HOSTNAME=rabbitmq
 - RABBITMQ__PORT=5672
 - RABBITMQ__PORT_MANAGEMENT=15672
 - RABBITMQ__MANAGEMENT_SSL=false
 - RABBITMQ__USERNAME=${RABBITMQ_DEFAULT_USER}
 - RABBITMQ__PASSWORD=${RABBITMQ_DEFAULT_PASS}
 - SMTP__HOSTNAME=${SMTP_HOSTNAME}
 - SMTP__PORT=25
 - PROVIDERS__LOCAL__STRATEGY=LocalStrategy
 ports:
 - "8080:8080"
 depends_on:
 - redis
 - elasticsearch
 - minio
 - rabbitmq
 restart: always
 worker:
 image: opencti/worker:5.5.4
 environment:
 - OPENCTI_URL=http://opencti:8080
 - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
 - WORKER_LOG_LEVEL=info
 depends_on:
 - opencti
 deploy:
 mode: replicated
 replicas: 3
 restart: always
 connector-export-file-stix:
 image: opencti/connector-export-file-stix:5.5.4
 environment:
 - OPENCTI_URL=http://opencti:8080
 - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
 - CONNECTOR_ID=${CONNECTOR_EXPORT_FILE_STIX_ID} # Valid UUIDv4
 - CONNECTOR_TYPE=INTERNAL_EXPORT_FILE
 - CONNECTOR_NAME=ExportFileStix2
 - CONNECTOR_SCOPE=application/json
 - CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted)
 - CONNECTOR_LOG_LEVEL=info
 restart: always
 depends_on:
 - opencti
 connector-export-file-csv:
 image: opencti/connector-export-file-csv:5.5.4
 environment:
 - OPENCTI_URL=http://opencti:8080
 - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
 - CONNECTOR_ID=${CONNECTOR_EXPORT_FILE_CSV_ID} # Valid UUIDv4
 - CONNECTOR_TYPE=INTERNAL_EXPORT_FILE
 - CONNECTOR_NAME=ExportFileCsv
 - CONNECTOR_SCOPE=text/csv
 - CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted)
 - CONNECTOR_LOG_LEVEL=info
 restart: always
 depends_on:
 - opencti
 connector-export-file-txt:
 image: opencti/connector-export-file-txt:5.5.4
 environment:
 - OPENCTI_URL=http://opencti:8080
 - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
 - CONNECTOR_ID=${CONNECTOR_EXPORT_FILE_TXT_ID} # Valid UUIDv4
 - CONNECTOR_TYPE=INTERNAL_EXPORT_FILE
 - CONNECTOR_NAME=ExportFileTxt
 - CONNECTOR_SCOPE=text/plain
 - CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted)
 - CONNECTOR_LOG_LEVEL=info
 restart: always
 depends_on:
 - opencti
 connector-import-file-stix:
 image: opencti/connector-import-file-stix:5.5.4
 environment:
 - OPENCTI_URL=http://opencti:8080
 - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
 - CONNECTOR_ID=${CONNECTOR_IMPORT_FILE_STIX_ID} # Valid UUIDv4
 - CONNECTOR_TYPE=INTERNAL_IMPORT_FILE
 - CONNECTOR_NAME=ImportFileStix
 - CONNECTOR_VALIDATE_BEFORE_IMPORT=true # Validate any bundle before import
 - CONNECTOR_SCOPE=application/json,text/xml
 - CONNECTOR_AUTO=true # Enable/disable auto-import of file
 - CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted)
 - CONNECTOR_LOG_LEVEL=info
 restart: always
 depends_on:
 - opencti
 connector-import-document:
 image: opencti/connector-import-document:5.5.4
 environment:
 - OPENCTI_URL=http://opencti:8080
 - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
 - CONNECTOR_ID=${CONNECTOR_IMPORT_DOCUMENT_ID} # Valid UUIDv4
 - CONNECTOR_TYPE=INTERNAL_IMPORT_FILE
 - CONNECTOR_NAME=ImportDocument
 - CONNECTOR_VALIDATE_BEFORE_IMPORT=true # Validate any bundle before import
 - CONNECTOR_SCOPE=application/pdf,text/plain,text/html
 - CONNECTOR_AUTO=true # Enable/disable auto-import of file
 - CONNECTOR_ONLY_CONTEXTUAL=false # Only extract data related to an entity (a report, a threat actor, etc.)
 - CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted)
 - CONNECTOR_LOG_LEVEL=info
 - IMPORT_DOCUMENT_CREATE_INDICATOR=true
 restart: always
 depends_on:
 - opencti
volumes:
 esdata:
 s3data:
 redisdata:
 amqpdata:

17. Now go back to the below link.

Next open .env.sample file in raw format, copy it, paste it into a notepad file then Change the admin email, and admin password, generate a UUID token from the below UUID Generator link and paste it in the admin token, change the root user of minio to admin, change the minio password, change the rabbitmq default password, after making changes save the file.

.env.sample file:

OPENCTI_ADMIN_EMAIL=admin@opencti.io
OPENCTI_ADMIN_PASSWORD=changeme
OPENCTI_ADMIN_TOKEN=ChangeMe_UUIDv4
OPENCTI_BASE_URL=http://localhost:8080
MINIO_ROOT_USER=opencti
MINIO_ROOT_PASSWORD=changeme
RABBITMQ_DEFAULT_USER=opencti
RABBITMQ_DEFAULT_PASS=changeme
CONNECTOR_EXPORT_FILE_STIX_ID=dd817c8b-abae-460a-9ebc-97b1551e70e6
CONNECTOR_EXPORT_FILE_CSV_ID=7ba187fb-fde8–4063–92b5-c3da34060dd7
CONNECTOR_EXPORT_FILE_TXT_ID=ca715d9c-bd64–4351–91db-33a8d728a58b
CONNECTOR_IMPORT_FILE_STIX_ID=72327164–0b35–482b-b5d6-a5a3f76b845f
CONNECTOR_IMPORT_DOCUMENT_ID=c3970f8a-ce4b-4497-a381–20b7256f56f0
SMTP_HOSTNAME=localhost
ELASTIC_MEMORY_SIZE=4G

18. Upload the environment variables file.

Now we have to upload the .env.sample created in the previous step. Go to Portainer. scroll down and in the environment variables section click load variables from the .env file.

19. Deploy the Stack.

Now in Portainer just click deploy the stack.

20. Login to the OpenCTI platform.

Wait for some time let the deployment take place, then go to the browser and navigate OpenCTI via

<YOURSTATICIP>:8080

After some time OpenCTI login page will appear, enter your credentials to access OpenCTI.