building-ioc-enrichment-pipeline-with-opencti

What problem does it solve?

This skill automates the collection and integration of external threat intelligence data to augment indicators with context, scores, and relationships inside an OpenCTI deployment.

Core Features & Use Cases

• Multi-source enrichment: gather data from VirusTotal, Shodan, AbuseIPDB, GreyNoise, and other connectors to enrich IPs, domains, and file hashes.
• OpenCTI integration: generate STIX bundles, update observables, and maintain confidence scores within an OpenCTI deployment.
• Use Case: security operations teams automatically enrich new indicators to prioritize investigations and drive incident response.

Quick Start

Deploy OpenCTI, set up API keys for enrichment sources, and run the enrichment workflow to automatically attach context to new observables.