opencti-intel

Retrieve threat intelligence data from OpenCTI via GraphQL queries.

1|1|Updated Feb 8, 2026

Search Tags:#graphql #cybersecurity #threat intelligence #cve #ioc #stix #opencti

Ready to run

npx skills add https://github.com/dapperdivers/roundtable-arsenal --skill opencti-intel

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: opencti-intel
Source: https://github.com/dapperdivers/roundtable-arsenal/tree/main/security/opencti-intel
Command: npx skills add https://github.com/dapperdivers/roundtable-arsenal --skill opencti-intel

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires curl, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill reduces the complexity of retrieving and analyzing OpenCTI threat intelligence data by providing structured access to STIX 2.1 entities, vulnerabilities, indicators, and security insights.

Core Features & Use Cases

Threat Intelligence Queries: Retrieve indicators, vulnerabilities, malware, reports, threat actors, campaigns, and attack patterns from OpenCTI.
Security Investigation Support: Search IOCs, analyze CVEs, review threat activity, and generate intelligence briefings from platform data.
Use Case: Security analysts can investigate a suspicious IP address, review related indicators and threats, and collect context for an incident response briefing.

Quick Start

Use the opencti-intel skill to find recent critical vulnerabilities and threat intelligence from the OpenCTI platform.

Frequently Asked Questions about opencti-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I query threat intelligence data from OpenCTI using GraphQL?▼

You can query threat intelligence from OpenCTI by executing GraphQL scripts that retrieve STIX 2.1 entities, indicators, and vulnerabilities. This requires authenticated access to an OpenCTI platform to resolve security investigation workflows.

What's the best way to search for IOCs and CVEs for an incident response briefing?▼

The best way to search IOCs and CVEs is to query an OpenCTI platform for related indicators, vulnerabilities, and threat actors. This aggregates the necessary intelligence context to generate comprehensive security briefings.

Do I need curl to retrieve STIX entities and malware reports from OpenCTI?▼

Yes, curl is required to run the query scripts that retrieve STIX entities, malware, and threat reports from OpenCTI. The dependency facilitates executing GraphQL queries against your authenticated platform endpoint.

Can I analyze threat actors and campaigns using OpenCTI intelligence data?▼

Yes, you can analyze threat actors and campaigns by retrieving intelligence data from OpenCTI. The structured queries return STIX 2.1 entities and attack patterns needed to support security investigations and threat monitoring.

What types of security insights can I retrieve when investigating a suspicious IP address?▼

When investigating a suspicious IP address, you can retrieve related indicators, vulnerabilities, and associated threats from OpenCTI. This intelligence provides the necessary context to review threat activity for incident response.

Does this approach work for monitoring recent critical vulnerabilities in cybersecurity?▼

Yes, querying OpenCTI works for monitoring recent critical vulnerabilities. You retrieve CVE data and intelligence reports via GraphQL to review threat activity and support ongoing vulnerability monitoring workflows.