OpenCTI is an open-source platform for managing cyber threat intelligence, developed by Filigran. Security teams use it to gather threat data from commercial feeds, open sources and internal tools and to store it in a knowledge graph based on the STIX 2.1 standard. It offers dashboards, MITRE ATT&CK mappings, case management and role-based access control, plus connectors to SIEM, SOAR and ticketing tools, and a GraphQL API.
Filigran is a French company headquartered in Paris. The Community Edition is released under the Apache 2.0 licence and its source code is public on GitHub, so organisations can install it on their own infrastructure, for example with Docker. The Enterprise Edition can be self-hosted, including in air-gapped environments, or used as a managed service run by Filigran. Self-hosting keeps the data under the organisation's own control and jurisdiction; for the managed service, the hosting region should be confirmed with the vendor.