Security – DefenCTI

DefenCTI is an enterprise-grade Cyber Threat Intelligence (CTI) platform designed to manage the full threat intelligence lifecycle—from data ingestion and normalization to analysis, enrichment, and distribution. Built on open standards such as STIX 2.1 and TAXII, DefenCTI enables seamless integration with hundreds of external threat intelligence providers as well as internal security data sources.

 

The platform automatically collects and normalizes threat data into a centralized data lake and graph-based knowledge model, allowing security teams to correlate indicators, threat actors, malware, and attack techniques. Through automated enrichment and contextual analysis, DefenCTI assigns dynamic risk scores and maps threats to frameworks such as MITRE ATT&CK, enabling accurate prioritization and informed decision-making.

 

With native support for SIEM, SOAR, EDR, and XDR integrations, DefenCTI accelerates detection and response by delivering prioritized, actionable intelligence directly into security operations workflows. Its scalable architecture, extensible connector framework, and automation capabilities empower SOC teams, threat hunters, and security analysts to reduce investigation time, improve response accuracy, and strengthen organizational cyber defense.

 

DefenCTI Data Collection Module

 

The DefenCTI Data Collection Module is a core peripheral component of the DefenCTI platform responsible for ingesting cyber threat intelligence from external and internal sources. Implemented as containerized connectors (workers), the module enables scalable, flexible, and standards-based integration without modifying the DefenCTI Core.

 

Built around STIX 2.1 and TAXII, the module collects, normalizes, and transforms threat intelligence from diverse formats—including TAXII feeds, MISP, APIs, CSV, JSON, RSS, logs, and SIEM systems—into standardized STIX objects before storing them in the DefenCTI Datalake. This ensures data consistency, interoperability, and high intelligence quality.

 

The module supports three primary connector roles:

• Importers for ingesting and normalizing raw threat data
• Enrichers for adding contextual intelligence using external and internal services
• Exporters/Stream connectors for distributing prioritized intelligence to security tools such as SIEM, SOAR, EDR, and firewalls

 

Through automated deduplication, tagging, relationship creation, and metadata management, the Data Collection Module protects data integrity while enabling real-time intelligence flow. Its SDK-driven, extensible architecture allows rapid onboarding of new intelligence sources and automation of threat intelligence exchange across the cybersecurity ecosystem.

 

Information Security Risk Analysis Module

 

The Information Security Risk Analysis Module transforms large volumes of threat intelligence into prioritized, actionable insights. By correlating indicators, threat actors, malware, and attack techniques in a graph-based model, it provides clear context and real-world relevance for each threat.
Using automated enrichment, configurable risk scoring, and alignment with frameworks such as MITRE ATT&CK, the module helps security teams quickly identify high-risk threats, reduce alert fatigue, and make faster, more informed response decisions.

 

Integrated & Information Distribution Module

 

The Integrated & Information Distribution Module enables security teams to analyze, investigate, and share threat intelligence using interactive analytics and machine learning. Built on a notebook-based environment, it allows analysts to explore data step by step, apply pre-trained ML models, and document investigations in a transparent and repeatable manner.

 

The module integrates seamlessly with the DefenCTI Datalake and external systems such as SIEM, MISP, databases, and real-time data streams. It supports advanced log analysis, IOC extraction, anomaly detection, visualization, and automated reporting, helping SOC teams and threat hunters accelerate investigations and reduce response time.

 

By combining data access, analytics, visualization, and intelligence distribution in a single environment, the module improves collaboration, operational efficiency, and knowledge sharing across security teams.

 

Information Distribution & Analysis Portal

 

The DefenCTI Information Distribution & Analysis Portal provides a centralized interface for managing, analyzing, visualizing, and sharing cyber threat intelligence. It transforms collected intelligence into structured knowledge, enabling security teams to gain real-time visibility into threats, attack patterns, and adversary behavior.

 

The portal features powerful dashboards, knowledge graphs, and advanced search capabilities aligned with frameworks such as MITRE ATT&CK, helping analysts quickly understand relationships between threat actors, malware, indicators, and campaigns. Built-in collaboration, role-based access control, and intelligence-sharing capabilities support coordinated incident response and secure information exchange.

 

With automation features, playbooks, and integrations with SIEM and SOAR platforms, the Analysis Portal enables faster decision-making, improved collaboration, and effective threat intelligence operations across the organization.