skills.rest
dapperdivers
dapperdiversCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

opencti-intel

Retrieve threat intelligence data from OpenCTI via GraphQL queries.

1|1|Updated Feb 8, 2026
Search Tags:#graphql#cybersecurity#threat intelligence#cve#ioc#stix#opencti
One-click install
npx skills add https://github.com/dapperdivers/roundtable-arsenal --skill opencti-intel
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: opencti-intel
Source: https://github.com/dapperdivers/roundtable-arsenal/tree/main/security/opencti-intel
Command: npx skills add https://github.com/dapperdivers/roundtable-arsenal --skill opencti-intel

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires curl, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill reduces the complexity of retrieving and analyzing OpenCTI threat intelligence data by providing structured access to STIX 2.1 entities, vulnerabilities, indicators, and security insights.

Core Features & Use Cases

  • Threat Intelligence Queries: Retrieve indicators, vulnerabilities, malware, reports, threat actors, campaigns, and attack patterns from OpenCTI.
  • Security Investigation Support: Search IOCs, analyze CVEs, review threat activity, and generate intelligence briefings from platform data.
  • Use Case: Security analysts can investigate a suspicious IP address, review related indicators and threats, and collect context for an incident response briefing.

Quick Start

Use the opencti-intel skill to find recent critical vulnerabilities and threat intelligence from the OpenCTI platform.

Frequently Asked Questions about opencti-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I query threat intelligence data from OpenCTI using GraphQL?▼

You can query threat intelligence from OpenCTI by executing GraphQL scripts that retrieve STIX 2.1 entities, indicators, and vulnerabilities. This requires authenticated access to an OpenCTI platform to resolve security investigation workflows.

What's the best way to search for IOCs and CVEs for an incident response briefing?▼

The best way to search IOCs and CVEs is to query an OpenCTI platform for related indicators, vulnerabilities, and threat actors. This aggregates the necessary intelligence context to generate comprehensive security briefings.

Do I need curl to retrieve STIX entities and malware reports from OpenCTI?▼

Yes, curl is required to run the query scripts that retrieve STIX entities, malware, and threat reports from OpenCTI. The dependency facilitates executing GraphQL queries against your authenticated platform endpoint.

Can I analyze threat actors and campaigns using OpenCTI intelligence data?▼

Yes, you can analyze threat actors and campaigns by retrieving intelligence data from OpenCTI. The structured queries return STIX 2.1 entities and attack patterns needed to support security investigations and threat monitoring.

What types of security insights can I retrieve when investigating a suspicious IP address?▼

When investigating a suspicious IP address, you can retrieve related indicators, vulnerabilities, and associated threats from OpenCTI. This intelligence provides the necessary context to review threat activity for incident response.

Does this approach work for monitoring recent critical vulnerabilities in cybersecurity?▼

Yes, querying OpenCTI works for monitoring recent critical vulnerabilities. You retrieve CVE data and intelligence reports via GraphQL to review threat activity and support ongoing vulnerability monitoring workflows.

Related Skills

Explore More Legal & Compliance Skills→
AcurioustractorAcurioustractor

enrich-project

Aggregates ACT project intelligence from multiple sources into unified profiles.

Community
Advanced
dapperdiversdapperdivers
1

daily-security-report

Generate daily security briefings from OpenCTI, RSS, and CVE intelligence inputs.

Community
Advanced
ensingm2ensingm2
12

threat-modeler

Apply STRIDE, MITRE ATT&CK, and Kill Chain frameworks to identify and model security threats.

Community
Advanced
dapperdiversdapperdivers
1

threat-intel-aggregator

Aggregate threat intelligence feeds and vulnerability data into daily security briefings.

Community
Advanced