From 474f06a5f107f53d7f773837a128534ad3663453 Mon Sep 17 00:00:00 2001 From: Samuel Hassine Date: Tue, 16 Sep 2025 09:27:55 +0200 Subject: [PATCH 1/4] [ti_opencti] Add filters --- .../indicator/agent/stream/cel.yml.hbs | 128 +++++++++++++++--- .../elasticsearch/ingest_pipeline/default.yml | 96 +++++++++++++ .../data_stream/indicator/manifest.yml | 114 ++++++++++++++++ packages/ti_opencti/docs/README.md | 92 +++++++++++++ packages/ti_opencti/img/opencti-logo.svg | 122 ++--------------- packages/ti_opencti/manifest.yml | 4 +- 6 files changed, 424 insertions(+), 132 deletions(-) diff --git a/packages/ti_opencti/data_stream/indicator/agent/stream/cel.yml.hbs b/packages/ti_opencti/data_stream/indicator/agent/stream/cel.yml.hbs index 13c211c0418..ee8d630c53c 100644 --- a/packages/ti_opencti/data_stream/indicator/agent/stream/cel.yml.hbs +++ b/packages/ti_opencti/data_stream/indicator/agent/stream/cel.yml.hbs @@ -37,25 +37,96 @@ fields: url: {{url}} program: | request( - "POST", - state.url.trim_suffix("graphql").trim_suffix("/") + "/graphql" - ).with({ - "Header": ({ - "Content-Type": ["application/json"] - }).with( - has(state.api_key) && size(state.api_key) > 0 ? - { "Authorization": ["Bearer " + state.api_key] } - : - {} - ) - }).with({ - "Body": { - "query": state.query, - "variables": { + "POST", + state.url.trim_suffix("graphql").trim_suffix("/") + "/graphql" + ).with({ + "Header": ({ + "Content-Type": ["application/json"] + }).with( + has(state.api_key) && size(state.api_key) > 0 ? + { "Authorization": ["Bearer " + state.api_key] } + : + {} + ) + }).with({ + "Body": { + "query": state.query, + "variables": { "after": has(state.cursor) && has(state.cursor.value) ? state.cursor.value : null, "first": state.page_size, "orderBy": "modified", "orderMode": "asc", + "filters": ( + // Build the FilterGroup object + ( + (has(state.pattern_types) && size(state.pattern_types) > 0) || + (has(state.indicator_types) && size(state.indicator_types) > 0) || + (has(state.revoked) && state.revoked != null) || + (has(state.valid_from_start) && state.valid_from_start != null) || + (has(state.valid_until_end) && state.valid_until_end != null) || + (has(state.label_ids) && size(state.label_ids) > 0) || + (has(state.confidence_min) && state.confidence_min != null) || + (has(state.author_ids) && size(state.author_ids) > 0) || + (has(state.creator_ids) && size(state.creator_ids) > 0) || + (has(state.created_after) && state.created_after != null) || + (has(state.modified_after) && state.modified_after != null) || + (has(state.last_modified) && state.last_modified != null) || + (has(state.marking_ids) && size(state.marking_ids) > 0) + ) ? + { + "mode": "and", + "filters": ( + // Always filter for Indicator entity type + [{"key": "entity_type", "values": ["Indicator"], "operator": "eq"}] + + (has(state.pattern_types) && size(state.pattern_types) > 0 ? + [{"key": "pattern_type", "values": state.pattern_types, "operator": "eq", "mode": "or"}] : [] + ) + + (has(state.indicator_types) && size(state.indicator_types) > 0 ? + [{"key": "indicator_types", "values": state.indicator_types, "operator": "eq", "mode": "or"}] : [] + ) + + (has(state.revoked) && state.revoked != null ? + [{"key": "revoked", "values": [state.revoked == "true"], "operator": "eq"}] : [] + ) + + (has(state.valid_from_start) && state.valid_from_start != null ? + [{"key": "valid_from", "values": [state.valid_from_start], "operator": "gte"}] : [] + ) + + (has(state.valid_until_end) && state.valid_until_end != null ? + [{"key": "valid_until", "values": [state.valid_until_end], "operator": "lte"}] : [] + ) + + (has(state.label_ids) && size(state.label_ids) > 0 ? + [{"key": "objectLabel", "values": state.label_ids, "operator": "eq", "mode": "or"}] : [] + ) + + (has(state.confidence_min) && state.confidence_min != null ? + [{"key": "confidence", "values": [string(state.confidence_min)], "operator": "gte"}] : [] + ) + + (has(state.author_ids) && size(state.author_ids) > 0 ? + [{"key": "createdBy", "values": state.author_ids, "operator": "eq", "mode": "or"}] : [] + ) + + (has(state.creator_ids) && size(state.creator_ids) > 0 ? + [{"key": "creator_id", "values": state.creator_ids, "operator": "eq", "mode": "or"}] : [] + ) + + (has(state.created_after) && state.created_after != null ? + [{"key": "created", "values": [state.created_after], "operator": "gt"}] : [] + ) + + (has(state.last_modified) && state.last_modified != null ? + [{"key": "updated_at", "values": [state.last_modified], "operator": "gt"}] : + (has(state.modified_after) && state.modified_after != null ? + [{"key": "updated_at", "values": [state.modified_after], "operator": "gt"}] : [] + ) + ) + + (has(state.marking_ids) && size(state.marking_ids) > 0 ? + [{"key": "objectMarking", "values": state.marking_ids, "operator": "eq", "mode": "or"}] : [] + ) + ), + "filterGroups": [] + } : + // Default filter: always filter for Indicator entity type + { + "mode": "and", + "filters": [{"key": "entity_type", "values": ["Indicator"], "operator": "eq"}], + "filterGroups": [] + } + ) } }.encode_json() }).do_request().as(resp, @@ -65,7 +136,8 @@ program: | "events": [{ "error": { "message": body.errors.map(e, e.message) }, "event": { "original": body.encode_json() } - }] + }], + "last_modified": state.?last_modified.orValue(null) }) : state.with({ @@ -77,23 +149,44 @@ program: | )), "want_more": body.data.indicators.pageInfo.hasNextPage, "cursor": { "value": body.data.indicators.pageInfo.endCursor }, + "last_modified": has(body.data.indicators.edges) && body.data.indicators.edges.size() > 0 ? + body.data.indicators.edges.map(e, e.node.modified).max() + : + state.?last_modified.orValue(null) }) + ) ) - ) redact: fields: - api_key state: + url: {{url}} api_key: {{api_key}} page_size: {{page_size}} preserve_original_event: {{preserve_original_event}} want_more: false + # Track last modified timestamp to avoid re-fetching + last_modified: null + # Filter configuration + pattern_types: {{#if pattern_types}}{{pattern_types}}{{else}}[]{{/if}} + indicator_types: {{#if indicator_types}}{{indicator_types}}{{else}}[]{{/if}} + revoked: {{#if revoked}}"{{revoked}}"{{else}}null{{/if}} + valid_from_start: {{#if valid_from_start}}"{{valid_from_start}}"{{else}}null{{/if}} + valid_until_end: {{#if valid_until_end}}"{{valid_until_end}}"{{else}}null{{/if}} + label_ids: {{#if label_ids}}{{label_ids}}{{else}}[]{{/if}} + confidence_min: {{#if confidence_min}}{{confidence_min}}{{else}}null{{/if}} + author_ids: {{#if author_ids}}{{author_ids}}{{else}}[]{{/if}} + creator_ids: {{#if creator_ids}}{{creator_ids}}{{else}}[]{{/if}} + created_after: {{#if created_after}}"{{created_after}}"{{else}}null{{/if}} + modified_after: {{#if modified_after}}"{{modified_after}}"{{else}}null{{/if}} + marking_ids: {{#if marking_ids}}{{marking_ids}}{{else}}[]{{/if}} # How to work with this API: https://docs.opencti.io/latest/deployment/integrations/#graphql-api # Relevant schema source: https://github.com/OpenCTI-Platform/opencti/blob/master/opencti-platform/opencti-graphql/config/schema/opencti.graphql query: | query IndicatorsLinesPaginationQuery( $search: String + $filters: FilterGroup $first: Int! $after: ID $orderBy: IndicatorsOrdering @@ -101,6 +194,7 @@ state: ) { indicators( search: $search + filters: $filters first: $first after: $after orderBy: $orderBy diff --git a/packages/ti_opencti/data_stream/indicator/elasticsearch/ingest_pipeline/default.yml b/packages/ti_opencti/data_stream/indicator/elasticsearch/ingest_pipeline/default.yml index 3e72aa8354c..43c27a5ef43 100644 --- a/packages/ti_opencti/data_stream/indicator/elasticsearch/ingest_pipeline/default.yml +++ b/packages/ti_opencti/data_stream/indicator/elasticsearch/ingest_pipeline/default.yml @@ -34,6 +34,22 @@ processors: field: id target_field: event.id + ################################### + # Deduplication using fingerprint # + ################################### + + # Generate a deterministic ID based on the standard_id + # This ensures the same indicator always gets the same document ID + - fingerprint: + tag: generate_document_id_for_deduplication + fields: + - standard_id + target_field: _id + method: SHA-256 + if: ctx.standard_id != null && ctx.standard_id != '' + description: Generate deterministic document ID from standard_id for deduplication + ignore_failure: false + ###################### # Threat feed fields # ###################### @@ -868,6 +884,86 @@ processors: ctx.threat.indicator.x509 = mergeListOfMaps(ctx.threat.indicator.x509); } + ################################### + # Fingerprint for deduplication # + ################################### + + # Generate a consistent document ID based on the indicator's unique STIX ID + # This prevents duplicates when multiple agents fetch the same data + - fingerprint: + fields: + - opencti.indicator.standard_id # STIX ID is globally unique and consistent + target_field: "_id" + ignore_missing: false + description: Generate consistent document ID for deduplication across multiple agents + + ########################################################### + # Tag indicators suitable for Security rule creation # + ########################################################### + + - set: + field: opencti.indicator.rule_compatible + value: true + if: | + ctx.opencti?.indicator?.pattern_type != null && ( + ctx.opencti.indicator.pattern_type == 'kql' || + ctx.opencti.indicator.pattern_type == 'lucene' || + ctx.opencti.indicator.pattern_type == 'eql' || + ctx.opencti.indicator.pattern_type == 'esql' + ) && ctx.opencti?.indicator?.revoked != true + description: Mark indicators that can be converted to detection rules + + - append: + field: tags + value: detection-rule-candidate + if: ctx.opencti?.indicator?.rule_compatible == true + allow_duplicates: false + + - set: + field: opencti.indicator.detection_rule.type + value: query + if: ctx.opencti?.indicator?.pattern_type == 'kql' || ctx.opencti?.indicator?.pattern_type == 'lucene' + + - set: + field: opencti.indicator.detection_rule.type + value: eql + if: ctx.opencti?.indicator?.pattern_type == 'eql' + + - set: + field: opencti.indicator.detection_rule.type + value: esql + if: ctx.opencti?.indicator?.pattern_type == 'esql' + + - set: + field: opencti.indicator.detection_rule.query + copy_from: opencti.indicator.pattern + if: ctx.opencti?.indicator?.rule_compatible == true + + - script: + description: Set detection rule severity based on confidence + lang: painless + if: ctx.opencti?.indicator?.rule_compatible == true + source: | + if (ctx.opencti?.indicator?.score != null) { + int score = ctx.opencti.indicator.score; + if (score >= 80) { + ctx.opencti.indicator.detection_rule.severity = 'critical'; + ctx.opencti.indicator.detection_rule.risk_score = 90; + } else if (score >= 60) { + ctx.opencti.indicator.detection_rule.severity = 'high'; + ctx.opencti.indicator.detection_rule.risk_score = 70; + } else if (score >= 40) { + ctx.opencti.indicator.detection_rule.severity = 'medium'; + ctx.opencti.indicator.detection_rule.risk_score = 50; + } else { + ctx.opencti.indicator.detection_rule.severity = 'low'; + ctx.opencti.indicator.detection_rule.risk_score = 30; + } + } else { + ctx.opencti.indicator.detection_rule.severity = 'medium'; + ctx.opencti.indicator.detection_rule.risk_score = 50; + } + ####################################################### # Tag to show if ECS indicator details were populated # ####################################################### diff --git a/packages/ti_opencti/data_stream/indicator/manifest.yml b/packages/ti_opencti/data_stream/indicator/manifest.yml index 53152551470..e5b951fb24c 100644 --- a/packages/ti_opencti/data_stream/indicator/manifest.yml +++ b/packages/ti_opencti/data_stream/indicator/manifest.yml @@ -55,6 +55,120 @@ streams: multi: false required: true show_user: false + - name: pattern_types + type: text + title: Pattern Types + description: >- + Filter by pattern type. Most of the time only stix is supported. + placeholder: "stix" + multi: true + required: false + show_user: true + - name: indicator_types + type: text + title: Indicator Types + description: >- + Customizable in OpenCTI. Common: malicious-activity, attribution, benign, anomalous-activity, compromised, unknown. + placeholder: "malicious-activity" + multi: true + required: false + show_user: true + - name: revoked + type: select + title: Revoked Status + description: Filter by revoked status. + options: + - text: "All Indicators (No Filter)" + value: "" + - text: "Active Only (Not Revoked)" + value: "false" + - text: "Revoked Only" + value: "true" + default: "" + multi: false + required: false + show_user: true + - name: valid_from_start + type: text + title: Valid From (Start Date) + description: >- + ISO 8601 (2024-01-01T00:00:00Z) or relative (now-30d). + placeholder: "now-30d" + multi: false + required: false + show_user: true + - name: valid_until_end + type: text + title: Valid Until (End Date) + description: >- + ISO 8601 (2024-12-31T23:59:59Z) or relative (now+30d). + placeholder: "now+30d" + multi: false + required: false + show_user: true + - name: label_ids + type: text + title: Label IDs (UUIDs) + description: >- + Must be UUIDs. Find in OpenCTI: Settings → Taxonomies → Labels. + placeholder: "a1b2c3d4-e5f6-7890-abcd-ef1234567890" + multi: true + required: false + show_user: true + - name: confidence_min + type: integer + title: Minimum Confidence Level + description: >- + Range: 0-100. + default: + multi: false + required: false + show_user: true + - name: author_ids + type: text + title: Author IDs (UUIDs) + description: >- + Must be UUIDs. Find by clicking on any author entity in OpenCTI. + placeholder: "identity--a1b2c3d4-e5f6-7890-abcd-ef1234567890" + multi: true + required: false + show_user: true + - name: creator_ids + type: text + title: Creator User IDs (UUIDs) + description: >- + Must be user UUIDs. Find in Settings → Security → Users. + placeholder: "user--a1b2c3d4-e5f6-7890-abcd-ef1234567890" + multi: true + required: false + show_user: true + - name: created_after + type: text + title: Created After + description: >- + ISO 8601 (2024-01-01T00:00:00Z) or relative (now-7d). + placeholder: "now-7d" + multi: false + required: false + show_user: true + - name: modified_after + type: text + title: Modified After + description: >- + ISO 8601 (2024-01-01T00:00:00Z) or relative (now-24h). + placeholder: "now-24h" + multi: false + required: false + show_user: true + - name: marking_ids + type: text + title: Marking Definition IDs (UUIDs) + description: >- + Filter by marking definitions (e.g., TLP levels). Must be UUIDs. Common markings: TLP:CLEAR, TLP:GREEN, TLP:AMBER, TLP:RED. + placeholder: "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" + multi: true + required: false + show_user: true - name: enable_request_tracer type: bool title: Enable request tracing diff --git a/packages/ti_opencti/docs/README.md b/packages/ti_opencti/docs/README.md index 9ea75d02f94..b53ebe8cc3b 100644 --- a/packages/ti_opencti/docs/README.md +++ b/packages/ti_opencti/docs/README.md @@ -25,6 +25,98 @@ When adding the OpenCTI integration, you will need to provide a base URL for the The simplest authentication method to use is an API key (bearer token). You can find a value for the API key on your profile page in the OpenCTI user interface. Advanced integration settings can be used to configure various OAuth2-based authentication arrangements, and to enter SSL settings for mTLS authentication and for other purposes. For information on setting up the OpenCTI side of an authentication strategy, please refer to [OpenCTI's authentication documentation](https://docs.opencti.io/latest/deployment/authentication/). +### Filtering + +The OpenCTI integration supports advanced filtering capabilities to help you control which indicators are ingested. This allows you to focus on specific types of indicators, confidence levels, authors, or time ranges that are most relevant to your security operations. + +#### Available Filters + +The following filters can be configured when setting up the integration (Note: The integration automatically filters for entity type 'Indicator' only): + +- **Pattern Types**: Filter indicators by pattern type (e.g., 'stix'). The values are customizable in OpenCTI, and any custom pattern types defined in your OpenCTI instance are supported (if an observable is associated). + +- **Indicator Types**: Filter indicators by type. Values are customizable in OpenCTI. Common defaults include: 'malicious-activity', 'attribution', 'benign', 'anomalous-activity', 'compromised', 'unknown'. Custom types defined in your OpenCTI instance are also supported. + +- **Revoked Status**: Filter by revoked status. Set to 'true' to get only revoked indicators, 'false' for only active (non-revoked) indicators, or leave empty to get all indicators regardless of revoked status. + +- **Valid From (Start Date)**: Filter indicators with valid_from date after this date. Use ISO 8601 format (e.g., '2024-01-01T00:00:00Z') or relative date expressions (e.g., 'now-30d', 'now-7d'). + +- **Valid Until (End Date)**: Filter indicators with valid_until date before this date. Use ISO 8601 format (e.g., '2024-12-31T23:59:59Z') or relative date expressions (e.g., 'now+30d', 'now+7d'). + +- **Label IDs**: Filter by label IDs. Enter the UUIDs of the labels to filter indicators that have these labels applied. **Important: You must use label IDs (UUIDs), not label names.** You can find label IDs in the OpenCTI interface by navigating to Settings > Taxonomies > Labels, or via the API. + +- **Minimum Confidence Level**: Filter indicators with confidence level greater than or equal to a specified value (0-100). + +- **Author IDs**: Filter by author IDs (createdBy relationship). Enter the UUIDs of the authors to filter indicators created by them. **Important: You must use author IDs (UUIDs), not author names.** You can find author IDs in the OpenCTI interface by clicking on an entity and checking its details, or via the API. + +- **Creator IDs**: Filter by technical creator IDs. Enter the UUIDs of the internal users who created the indicators in OpenCTI. + +- **Created After**: Filter indicators created after a specific date. Use ISO 8601 format (e.g., '2024-01-01T00:00:00Z') or relative date expressions (e.g., 'now-30d', 'now-7d', 'now-24h'). + +- **Modified After**: Filter indicators modified after a specific date. Use ISO 8601 format (e.g., '2024-01-01T00:00:00Z') or relative date expressions (e.g., 'now-30d', 'now-7d', 'now-24h'). + +- **Marking Definition IDs**: Filter by marking definitions (e.g., TLP levels). Enter the UUIDs of the marking definitions. **Important: You must use marking definition IDs (UUIDs), not names.** Common TLP marking IDs: + - TLP:CLEAR (TLP:WHITE): `marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da` + - TLP:GREEN: `marking-definition--bab4a63c-aed9-4cf5-a766-dfca5abac2bb` + - TLP:AMBER: `marking-definition--55d920b0-5e8b-4f79-9ee9-91f868d9b421` + - TLP:RED: `marking-definition--e828b379-4e03-4974-9ac4-e53a884c97c1` + +#### Filter Examples + +Here are some practical examples of filter configurations: + +1. **High-confidence indicators only**: Set `Minimum Confidence Level` to 75 to ingest only indicators with high confidence. + +2. **Active threat indicators**: Set `Indicator Types` to ['malicious-activity', 'compromised'] and `Revoked Status` to 'false' to focus on active, non-revoked threats. + +3. **Currently valid indicators**: Set `Valid From (Start Date)` to 'now-365d' and `Valid Until (End Date)` to 'now+30d' to get indicators that are currently within their validity period. + +4. **Recent indicators**: Set `Created After` to 'now-7d' to collect only indicators created in the last 7 days. + +5. **Specific pattern types**: Set `Pattern Types` to ['stix'] to collect only STIX pattern indicators, or include your custom pattern types defined in OpenCTI. + +6. **Specific campaign tracking**: Use `Label IDs` filter with specific campaign label UUIDs (e.g., ['550e8400-e29b-41d4-a716-446655440000']) to track indicators related to particular threat campaigns. + +7. **Indicators from specific sources**: Use `Author IDs` with the UUIDs of specific threat intelligence sources (e.g., ['123e4567-e89b-12d3-a456-426655440000']) to filter indicators from trusted sources. + +8. **Recently modified high-value indicators**: Combine `Modified After` set to 'now-24h', `Minimum Confidence Level` to 80, and `Revoked Status` to 'false' to get recently updated, high-confidence active indicators. + +9. **TLP-restricted indicators**: Use `Marking Definition IDs` with TLP:CLEAR and TLP:GREEN UUIDs to only ingest indicators that are safe to share broadly: ['marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da', 'marking-definition--bab4a63c-aed9-4cf5-a766-dfca5abac2bb']. + +All filters work together using AND logic at the top level. Within each multi-value filter (like pattern types or label IDs), OR logic is applied between values. + +#### High Availability and Deduplication + +The OpenCTI integration supports running on multiple Elastic Agents for high availability. When multiple agents fetch the same indicators: + +- **Automatic Deduplication**: The integration uses a fingerprint-based document ID to prevent duplicates. Each indicator gets a consistent ID based on its `standard_id` and `modified` timestamp. +- **No Manual Configuration Needed**: Deduplication works automatically - just deploy the integration to multiple agents. +- **Update Handling**: When an indicator is updated in OpenCTI, the new version replaces the old one in Elasticsearch. + +#### Best Practices for HA Setup + +1. **Stagger Execution Times**: To avoid all agents hitting OpenCTI simultaneously, consider offsetting their schedules slightly (e.g., Agent 1 at :00, Agent 2 at :02). +2. **Use the Same Configuration**: Ensure all agents use identical filter settings to fetch the same dataset. +3. **Monitor Performance**: Check OpenCTI server load when multiple agents are polling. + +### Finding IDs in OpenCTI + +Since several filters require UUIDs rather than names, here are ways to find these IDs: + +1. **Label IDs**: + - In OpenCTI UI: Navigate to Settings → Taxonomies → Labels. Click on a label to see its ID in the URL or details. + - Via API: Query the `labels` endpoint to list all labels with their IDs. + +2. **Author IDs**: + - In OpenCTI UI: Click on any entity that has an author, then click on the author name to see its details including the ID. + - Via API: Query the `identities` endpoint to list all identities (organizations, individuals) with their IDs. + +3. **Creator IDs**: + - In OpenCTI UI: Navigate to Settings → Security → Users to see user IDs. + - Via API: Query the `users` endpoint (requires appropriate permissions). + +For more information about OpenCTI's filtering system, refer to the [OpenCTI filters documentation](https://docs.opencti.io/latest/reference/filters/). + ## Logs ### Indicator diff --git a/packages/ti_opencti/img/opencti-logo.svg b/packages/ti_opencti/img/opencti-logo.svg index df9223ec990..1c412bbdf3e 100644 --- a/packages/ti_opencti/img/opencti-logo.svg +++ b/packages/ti_opencti/img/opencti-logo.svg @@ -1,114 +1,10 @@ - - - - - - - - - - - - - - - + + + + + + + + + diff --git a/packages/ti_opencti/manifest.yml b/packages/ti_opencti/manifest.yml index 47c6fb850b0..1fe99f44485 100644 --- a/packages/ti_opencti/manifest.yml +++ b/packages/ti_opencti/manifest.yml @@ -1,7 +1,7 @@ format_version: "3.4.0" name: ti_opencti title: OpenCTI -version: "2.8.0" +version: "2.9.1" description: "Ingest threat intelligence indicators from OpenCTI with Elastic Agent." type: integration source: @@ -55,7 +55,7 @@ policy_templates: title: API Key description: API key from your profile page in OpenCTI, for bearer authentication. multi: false - required: false + required: true show_user: true secret: true - name: oauth2 From 6483f458b1356a813c3300e50e6f230f2b203866 Mon Sep 17 00:00:00 2001 From: Samuel Hassine Date: Tue, 16 Sep 2025 09:30:33 +0200 Subject: [PATCH 2/4] [ti_opencti] Add filters --- packages/ti_opencti/manifest.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/ti_opencti/manifest.yml b/packages/ti_opencti/manifest.yml index 1fe99f44485..c0e0053c718 100644 --- a/packages/ti_opencti/manifest.yml +++ b/packages/ti_opencti/manifest.yml @@ -1,7 +1,7 @@ format_version: "3.4.0" name: ti_opencti title: OpenCTI -version: "2.9.1" +version: "2.9.0" description: "Ingest threat intelligence indicators from OpenCTI with Elastic Agent." type: integration source: From 984e5509241babb19bdd918adf767539d9ff9dee Mon Sep 17 00:00:00 2001 From: Samuel Hassine Date: Tue, 16 Sep 2025 09:35:28 +0200 Subject: [PATCH 3/4] [ti_opencti] Add filters --- packages/ti_opencti/changelog.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/packages/ti_opencti/changelog.yml b/packages/ti_opencti/changelog.yml index e98a6b62f11..0047575c82d 100644 --- a/packages/ti_opencti/changelog.yml +++ b/packages/ti_opencti/changelog.yml @@ -1,4 +1,18 @@ # newer versions go on top +- version: "2.9.0" + changes: + - description: Add comprehensive filtering support for indicators including pattern types, confidence levels, labels, dates, authors, creators, and marking definitions. + type: enhancement + link: https://github.com/elastic/integrations/pull/15332 + - description: Implement deduplication mechanism using fingerprint processor to prevent duplicate indicators when running multiple agents. + type: enhancement + link: https://github.com/elastic/integrations/pull/15332 + - description: Add state management to track last modified timestamp and prevent re-fetching already processed indicators. + type: enhancement + link: https://github.com/elastic/integrations/pull/15332 + - description: Update OpenCTI logos for better visual consistency. + type: enhancement + link: https://github.com/elastic/integrations/pull/15332 - version: "2.8.0" changes: - description: Add script processor to drop all nulls / empty strings. From ae856380d7d243d8e4180d6ae9b27e11212ecacb Mon Sep 17 00:00:00 2001 From: Samuel Hassine Date: Tue, 16 Sep 2025 09:38:43 +0200 Subject: [PATCH 4/4] [ti_opencti] Add filters --- packages/ti_opencti/docs/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/ti_opencti/docs/README.md b/packages/ti_opencti/docs/README.md index b53ebe8cc3b..c3d0f66e5c8 100644 --- a/packages/ti_opencti/docs/README.md +++ b/packages/ti_opencti/docs/README.md @@ -15,7 +15,7 @@ Each event in the log data stream collected by the OpenCTI integration is an ind This integration requires Filebeat version 8.9.0, or later. -It has been updated for OpenCTI version 5.12.24 and requires that version or later. +It has been updated for OpenCTI version 6.1.0 and requires that version or later. ## Setup