OpenCTI Connectors: How to Integrate Threat Intelligence with OpenCTI

OpenCTI is the go-to platform for bringing threat intelligence from multiple sources into one place. If you run a commercial intelligence subscription, the official Threat Landscape OpenCTI connector makes the integration surprisingly straightforward.

The connector consumes STIX 2.1 threat intelligence bundles and imports reports, indicators, threat actors, malware, campaigns, vulnerabilities, attack patterns, identities, locations and their relationships directly into OpenCTI. No additional STIX conversion is required — the intelligence flows in as a ready-made knowledge graph.

Docker Compose Configuration

Here is a practical configuration for a larger historical import with more frequent polling. Drop it into your existing OpenCTI Docker Compose stack:

connector-threatlandscape:
  image: opencti/connector-threatlandscape:latest
  environment:
    - OPENCTI_URL=http://opencti:8080
    - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}

    # OpenCTI connector configuration
    - CONNECTOR_ID=f6e9f416-3c6b-46db-9179-a22920bbdbbb
    - CONNECTOR_NAME=ThreatLandscape
    - CONNECTOR_SCOPE=indicator,report,threat-actor,malware,campaign,intrusion-set,attack-pattern,vulnerability,identity,location
    - CONNECTOR_LOG_LEVEL=info

    # Polling interval
    - CONNECTOR_DURATION_PERIOD=PT10M

    # Threat Landscape configuration
    - THREATLANDSCAPE_API_KEY=xxxxxxxxxxxxxxxxxxxxxxx
    - THREATLANDSCAPE_FEED=intelligence

    # Historical import
    - THREATLANDSCAPE_IMPORT_SINCE=P3650D

  restart: always

  depends_on:
    opencti:
      condition: service_healthy

Understanding the Key Parameters

CONNECTOR_DURATION_PERIOD

This controls how frequently the connector checks for new intelligence. The default is PT1H — one hour. For a more responsive setup, I use PT10M — every 10 minutes.

The value uses ISO-8601 duration syntax:

PT5M   = 5 minutes
PT10M  = 10 minutes
PT30M  = 30 minutes
PT1H   = 1 hour

THREATLANDSCAPE_IMPORT_SINCE

This is particularly important when deploying the connector for the first time. The default is P30D, meaning the initial import looks back 30 days.

If you want a much larger historical dataset, increase this value. For example:

P30D    = 30 days
P365D   = 1 year
P3650D  = ~10 years

Importantly, this is primarily a first-run lookback setting. After the initial synchronization, the connector uses its seq_id cursor and retrieves only bundles newer than the last successfully processed sequence ID.

THREATLANDSCAPE_FEED

This selects which Threat Landscape data source the connector pulls from. The default is intelligence, which includes both sources:

intelligence           Both sources (OSINT + darknet)
intelligence-osint     Open-source intelligence only
intelligence-darknet   Darknet intelligence only
ioc                    Indicator objects only

The intelligence feeds map to the Threat Landscape Intelligence API — the full-breadth feed built for analysis and enrichment. It delivers the complete STIX 2.1 object graph: threat actors, groups and campaigns, malware families and tooling, victims and target sectors, CVEs and vulnerability intelligence, MITRE ATT&CK TTPs, reports and intelligence products, relationships and full source provenance.

Pick intelligence-osint when you only want open-source coverage, or intelligence-darknet to focus on darknet-sourced intelligence. Use intelligence for both.

The ioc option is different. It maps to the lean Threat Landscape IOC API and delivers only STIX indicator objects — IPv4/IPv6 addresses, domains and subdomains, URLs and URI patterns, and file hashes (MD5, SHA-1, SHA-256). No rich contextual objects. That makes it ideal for automated indicator ingestion, where you want to pipe fresh, high-fidelity IOCs straight into your SIEM, EDR, firewall or blocklist without wading through the full knowledge graph.

What Happens During a Large Import?

Suppose your subscription contains 40,000–80,000 events. With THREATLANDSCAPE_IMPORT_SINCE=P3650D, the connector initially walks through the historical data and imports the available bundles.

Once the historical import catches up, the behavior changes. Instead of repeatedly downloading the entire dataset, the connector remembers the highest seq_id it has processed and requests only newer bundles:

seq_id > last_seq_id

Recommended Production Configuration

For a reasonably powerful OpenCTI deployment, start with:

CONNECTOR_DURATION_PERIOD=PT10M
THREATLANDSCAPE_FEED=intelligence
THREATLANDSCAPE_IMPORT_SINCE=P3650D

Then monitor OpenCTI, RabbitMQ, Elasticsearch/OpenSearch and the connector container while the historical import is running. If the system is under heavy load, increase the polling interval again. During the initial historical import, the polling interval isn't particularly important — the connector already has a large backlog to process. It becomes much more useful once the connector has caught up.

One Important Warning

The connector persists its highest seq_id in OpenCTI. Once that state exists, subsequent runs are incremental. So if you've already imported the last 30 days and want to go back several years, plan the historical backfill separately rather than simply changing the environment variable and assuming the connector will rewind.

Final Configuration

For a use case where the goal is to ingest a large commercial feed while keeping OpenCTI reasonably fresh, this is the configuration we'd use:

connector-threatlandscape:
  image: opencti/connector-threatlandscape:latest
  environment:
    - OPENCTI_URL=http://opencti:8080
    - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}

    - CONNECTOR_ID=f6e9f416-3c6b-46db-9179-a22920bbdbbb
    - CONNECTOR_NAME=ThreatLandscape
    - CONNECTOR_SCOPE=indicator,report,threat-actor,malware,campaign,intrusion-set,attack-pattern,vulnerability,identity,location
    - CONNECTOR_LOG_LEVEL=info
    - CONNECTOR_DURATION_PERIOD=PT10M

    - THREATLANDSCAPE_API_KEY=xxxxxxxxxxxxxxxxxxxxxxx
    - THREATLANDSCAPE_FEED=intelligence
    - THREATLANDSCAPE_IMPORT_SINCE=P3650D

  restart: always

  depends_on:
    opencti:
      condition: service_healthy

Next Steps

OpenCTI is a natural home for structured intelligence once it's in STIX 2.1. Prefer not to run a connector at all? You can wire the same intelligence in natively with the built-in OpenCTI TAXII feeds. From there, the same machine-readable bundles can feed your SIEM and SOAR workflows for automated detection and response.