<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-threat-intelligence-platform
description: >-
  Design, deploy, and integrate a threat intelligence platform using OpenCTI,
  MISP, and TAXII infrastructure. Covers data ingestion pipelines, connector
  configuration, STIX 2.1 data modeling, correlation engine tuning, and
  multi-source feed orchestration for operationalized intelligence.
domain: cybersecurity
subdomain: threat-intelligence
tags:
  - opencti
  - misp
  - taxii
  - stix
  - threat-intelligence-platform
  - data-pipeline
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566.001"]
---
# Building a Threat Intelligence Platform

## Overview

A threat intelligence platform (TIP) centralizes collection, enrichment, analysis,
and dissemination of threat data. This skill covers deploying OpenCTI and MISP as
core platforms, configuring TAXII 2.1 ingestion, building STIX 2.1 data models,
tuning correlation engines, and integrating feeds into detection pipelines.

## Prerequisites

- Docker and Docker Compose for platform deployment
- Python 3.10+ with `pycti`, `pymisp`, `stix2`, `taxii2-client` libraries
- Elasticsearch or OpenSearch for backend storage
- RabbitMQ or Redis for connector message bus
- Network access to upstream TAXII feeds and enrichment APIs

```bash
pip install pycti pymisp stix2 taxii2-client requests
```

## Key Concepts

### Platform Architecture

A production TIP deployment consists of:
- **Ingestion layer**: TAXII 2.1 polling, MISP feed sync, CSV/JSON importers
- **Normalization layer**: Raw data → STIX 2.1 objects with deterministic IDs
- **Storage layer**: Elasticsearch indices for entities, relationships, observables
- **Correlation engine**: Entity resolution, relationship inference, deduplication
- **Dissemination layer**: TAXII server, SIEM export, API endpoints, dashboards

### OpenCTI Connector Types

| Type | Purpose | Example |
|------|---------|---------|
| EXTERNAL_IMPORT | Pull data from external sources | MITRE ATT&CK, AlienVault OTX |
| INTERNAL_IMPORT_FILE | Parse uploaded files | PDF, CSV, STIX bundle |
| INTERNAL_ENRICHMENT | Enrich existing entities | VirusTotal, Shodan, AbuseIPDB |
| STREAM | Real-time event processing | SIEM export, Slack notifications |

### STIX 2.1 Data Model

Core objects for TIP data modeling:
- **SDO**: Threat Actor, Malware, Attack Pattern, Campaign, Indicator, Vulnerability
- **SRO**: Relationship (uses, targets, indicates), Sighting
- **SCO**: IPv4-Addr, Domain-Name, File (hashes), URL, Email-Addr

## Workflow

### Step 1: Deploy OpenCTI Stack

```yaml
# docker-compose.yml (simplified)
services:
  opencti:
    image: opencti/platform:6.4.4
    environment:
      - APP__PORT=8080
      - APP__ADMIN__EMAIL=admin@local.dev
      - APP__ADMIN__PASSWORD=${OPENCTI_ADMIN_PASSWORD}
      - APP__ADMIN__TOKEN=${OPENCTI_ADMIN_TOKEN}
      - ELASTICSEARCH__URL=http://elasticsearch:9200
      - MINIO__ENDPOINT=minio
      - RABBITMQ__HOSTNAME=rabbitmq
    ports:
      - "8080:8080"
    depends_on:
      - elasticsearch
      - minio
      - rabbitmq
```

### Step 2: Configure TAXII Ingestion

```python
from taxii2client.v21 import Server, Collection

server = Server(
    "https://cti-taxii.mitre.org/taxii2/",
    user=None,
    password=None,
)

api_root = server.api_roots[0]
for collection in api_root.collections:
    print(f"Collection: {collection.title} | ID: {collection.id}")

# Poll Enterprise ATT&CK collection
enterprise = Collection(
    "https://cti-taxii.mitre.org/stix/collections/enterprise-attack/",
)
bundle = enterprise.get_objects()
print(f"Objects retrieved: {len(bundle.get('objects', []))}")
```

### Step 3: Create STIX 2.1 Objects

```python
import stix2

threat_actor = stix2.ThreatActor(
    name="APT-EXAMPLE",
    description="Example threat actor for platform testing",
    threat_actor_types=["nation-state"],
    aliases=["ExampleBear"],
    roles=["agent"],
    sophistication="expert",
    resource_level="government",
    primary_motivation="organizational-gain",
)

malware = stix2.Malware(
    name="ExampleRAT",
    description="Custom remote access trojan",
    malware_types=["remote-access-trojan"],
    is_family=True,
)

relationship = stix2.Relationship(
    relationship_type="uses",
    source_ref=threat_actor.id,
    target_ref=malware.id,
    description="APT-EXAMPLE deploys ExampleRAT in initial compromise",
)

bundle = stix2.Bundle(objects=[threat_actor, malware, relationship])
print(bundle.serialize(pretty=True))
```

### Step 4: Integrate with OpenCTI API

```python
from pycti import OpenCTIApiClient

api = OpenCTIApiClient(
    url="http://localhost:8080",
    token="YOUR_OPENCTI_TOKEN",
)

# Create a threat actor
actor = api.threat_actor.create(
    name="APT-EXAMPLE",
    description="Nation-state actor targeting energy sector",
    aliases=["ExampleBear"],
)

# Import STIX bundle
with open("bundle.json") as f:
    api.stix2.import_bundle_from_json(f.read())

# Query indicators
indicators = api.indicator.list(
    filters={
        "mode": "and",
        "filters": [{"key": "pattern_type", "values": ["stix"]}],
        "filterGroups": [],
    },
    first=50,
)
for ind in indicators:
    print(f"{ind['name']}: {ind['pattern']}")
```

### Step 5: MISP-OpenCTI Synchronization

```python
from pymisp import PyMISP

misp = PyMISP("https://misp.local", "MISP_API_KEY", ssl=False)

# Create MISP event for platform sync
event = misp.new_event(
    distribution=0,
    info="TIP Import - Campaign Alpha",
    analysis=2,
    threat_level_id=2,
)

# Add attributes that sync to OpenCTI
misp.add_attribute(event, {"type": "ip-dst", "value": "203.0.113.50", "to_ids": True})
misp.add_attribute(event, {"type": "domain", "value": "evil-c2.example.com", "to_ids": True})
misp.add_attribute(event, {"type": "sha256", "value": "a" * 64, "to_ids": True})

# Tag for OpenCTI connector pickup
misp.tag(event, "tlp:amber")
misp.tag(event, "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"")
```

## Detection

```yaml
title: Threat Intelligence Platform Detection
id: 5ce6d217-09c0-4975-8a8b-c355f56697a9
status: experimental
description: Detects suspicious activity related to building threat intelligence platform techniques in threat intelligence context
logsource:
  category: network_connection
  product: firewall
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1566.001
  - attack.reconnaissance
falsepositives:
  - Threat intelligence platform aggregating feeds from approved sources
```

## Verification

- [ ] OpenCTI stack deploys and admin dashboard accessible
- [ ] TAXII 2.1 polling retrieves ATT&CK objects successfully
- [ ] STIX 2.1 bundles validate and import without errors
- [ ] MISP↔OpenCTI sync produces matching entities in both platforms
- [ ] Enrichment connectors (VirusTotal, Shodan) populate observable data
- [ ] Indicators exportable to SIEM via API or TAXII server endpoint

## References

- [OpenCTI Documentation](https://docs.opencti.io/)
- [MISP Project](https://www.misp-project.org/)
- [STIX 2.1 Specification](https://docs.oasis-open.org/cti/stix/v2.1/stix-v2.1.html)
- [TAXII 2.1 Specification](https://docs.oasis-open.org/cti/taxii/v2.1/taxii-v2.1.html)
- [pycti Library](https://github.com/OpenCTI-Platform/client-python)
