## OpenCTI Platform\n\n### What is OpenCTI?\n\nOpenCTI is an open-source platform for managing cyber threat intelligence with advanced visualization and analysis capabilities.\n\n### Key Features\n\n**Native STIX 2.1 Support**:\n- All data stored as STIX objects\n- Full relationship modeling\n- Import/export STIX bundles\n\n**Knowledge Graph**:\n- Visual exploration of relationships\n- Connect indicators → malware → actors\n- Timeline analysis\n\n**Connectors**:\n- MISP import/export\n- VirusTotal enrichment\n- AbuseIPDB\n- Shodan\n- MITRE ATT&CK\n- RSS feeds\n\n### OpenCTI Entities\n\n| Entity Type | Examples |\n|-------------|----------|\n| **Threat Actors** | APT28, FIN7 |\n| **Intrusion Sets** | Named operations |\n| **Campaigns** | Specific attack waves |\n| **Malware** | Emotet, Cobalt Strike |\n| **Tools** | PsExec, Mimikatz |\n| **Vulnerabilities** | CVE-2024-XXXX |\n| **Indicators** | IOCs |\n| **Attack Patterns** | MITRE techniques |\n\n### OpenCTI vs MISP\n\n| Aspect | MISP | OpenCTI |\n|--------|------|--------|\n| **Focus** | IOC sharing | Knowledge management |\n| **Data Model** | Events/Attributes | STIX objects |\n| **Visualization** | Basic | Advanced graph |\n| **Sharing** | Strong community | Connector-based |\n| **Complexity** | Moderate | Higher |\n\n### When to Use Each\n\n**MISP**: IOC sharing with partners, feed management\n**OpenCTI**: Deep analysis, knowledge base, actor tracking\n**Both**: Many organizations use both together