LoginSign Up
← Back to all sparks
O

OpenCTI

ANALYTICS
Velocity5.0

Open cyber threat intelligence platform

filigran.io/solutions/open-cti ↗

OpenCTI lets analysts run enrichment connectors straight from the investigation graph.

threat-intelligencecase-managementenrichmentingestionlts
◆Current state
OpenCTI 7.261106.0 added custom fields and templates to Cases and Incidents, and LTS lines received matching security backports the same week. 7.261109.0 adds a right-click option to run an enrichment connector from the investigation graph, prepares ingestion health reporting, exports and imports labels in config presets, and fixes a cache race that could stop a started playbook from running. 7.261109.3 is a bare backend release tag.
◆Where it's heading
Filigran keeps a near-weekly cadence that mixes small analyst workflow additions with platform reliability: playbook triggers, cache consistency, stream compatibility and ingestion health. Two LTS branches are maintained alongside the main line.
◆Prediction
Expect ingestion health to surface as a visible feature in an upcoming release, given this one calls the work 'preparation', plus further LTS backports.

◆Recent moves

  1. 4d ago

    OpenCTI 7.261109.0: run enrichment from the investigation graph

    Analysts can trigger an enrichment connector from the graph's right-click menu instead of leaving the investigation view. The release also fixes a cache race that could drop playbook triggers and a stream break caused by new relationship types.

    View source ↗
  2. 4d ago

    OpenCTI 7.261109.3 backend and worker release tag

    A release tag for the backend and worker with no notes. Nothing user-visible is described.

    View source ↗
  3. 7d ago

    OpenCTI 7.261106.0: custom fields and templates for cases

    Cases and Incidents get custom fields and templates, sightings get a configurable de-duplication window, and view-only users can create through form intake. It extends the configurability added to views and dashboards in October.

    View source ↗
  4. 7d ago

    OpenCTI LTS 7.260811.0-lts.2 backports draft-access fix

    Backports the main line's security fixes to the August LTS: draft-context checks on TAXII and HTTP routes, a timeout for JSONPath scripts and a cap on artifact import size. Patch upkeep for long-term-support users.

    View source ↗
  5. 8d ago

    OpenCTI LTS 7.260309.0-lts.9 backports draft-access fix

    The same security backports for the older March LTS line. It shows Filigran maintaining two LTS branches alongside the main line.

    View source ↗
  6. 10d ago

    OpenCTI 7.261103.0: Filigran license install, draft access checks

    A fix-heavy release with one licensing change: a Filigran license can now serve as the platform license, which fits the steady pull of features toward Enterprise Edition. The draft-context checks on TAXII and HTTP routes close an access gap, continuing last week's PIR restriction fixes.

    View source ↗