OpenCTI Community Edition
Operator: Filigran SAS, France
Self-hosted platform for collecting, linking and searching your own cyber threat intelligence.
Technical Infrastructure
Product
Free OpenCTI Community Edition. Enterprise Edition and the hosted Filigran service are separate offerings.
Availability and source date
Active
As of: 16 October 2026.
No functionality test has been performed.
Use in OSINT research
Organises your own reports and technical indicators in a knowledge graph. Shows known connections and sources within the populated instance.
Queries
| Input | Result | Result type |
|---|---|---|
| IP address + Domain / website + URL + File hash | Matching indicators, reports and relationships already stored in your own OpenCTI instance. | Retrieved |
| Keyword / free text | Stored objects with matching names, aliases or descriptions, such as threat actors and reports. | Retrieved |
Features
- Imports reports and indicators from files, feeds and connectors.
- Links technical indicators, threat actors and reports in a knowledge graph.
- Searches your own data individually or using lists of indicators.
- Exports information as CSV or STIX2.
- Provides functions through its own GraphQL API.
- Connects AI agents through MCP using an additional XTM One instance.
Categories
- Technical Infrastructure
- Threat intelligence
Coverage
Dataset
Your own and imported threat intelligence in the STIX2 data model. Coverage depends on the instance and its connectors.
Access
Installation and deployment
Locally installable · Self-hosted
Self-hosted web platform. Docker or manual installation; requires components including a search index, Redis, RabbitMQ and object storage.
Requirements
Your own installation and a user account in that instance. The API requires a user key. External data sources may require their own access credentials.
Export
CSV and STIX2 bundles; data access through the GraphQL API.
Provider
Filigran SAS
Country of establishment
France
Interfaces
API
Available. The OpenCTI instance's own GraphQL API, using a user key and its access permissions.
MCP
Available. Official OpenCTI MCP integration through XTM One Community. Requires a running XTM One instance, registration of OpenCTI and suitable user accounts.
AI agents
Available. Through the documented MCP route, Claude Code, Cursor and your own AI agents, among others, can access the OpenCTI instance. XTM One is required.
Maintenance
Licence
Apache-2.0
Latest activity
Commit 10/2026
Stars
approx. 10,200 (as of 16 October 2026)
Legal note
Limitations
- Not a ready-made worldwide search database: results depend on imported and manually entered data.
- Full-text search within uploaded documents belongs to the Enterprise Edition.
- Self-hosting requires several server components; MCP additionally requires an XTM One instance.
Guides and practical reports
Official · OpenCTI Installation
Filigran · EN
Explains Docker, dependencies and manual installation.