building-threat-intelligence-platform

Deploy MISP, OpenCTI, TheHive, and Cortex together using Docker Compose with Elasticsearch, Redis, RabbitMQ, and MinIO as backing services. Then enable OSINT feeds in MISP, configure the OpenCTI MISP connector for sync, and attach Cortex analyzers for enrichment.

Pin one direction of authority and let the OpenCTI MISP connector deduplicate on the STIX id. Running both a push sync and the connector without stable STIX id or UUID mapping re-imports the same events as new indicators on every poll.

MISP focuses on IOC correlation, event sharing, and feed management, while OpenCTI provides knowledge graph analysis of threats, actors, and relationships. They are typically deployed together with bidirectional sync rather than as replacements.

Cortex silently skips observables whose TLP exceeds the analyzer's max_tlp setting, such as submitting a tlp:amber observable to a max_tlp:green analyzer. The job appears complete but no analysis actually ran, so check TLP levels against analyzer configuration.

OpenCTI 6.x expects STIX 2.1, while MISP may export 2.0 or 2.1 depending on version. A 2.0 bundle using labels instead of indicator_types imports with empty typing, so confirm both ends negotiate application/stix+json;version=2.1.