Integrations
Put the feed where you already work
CTIF delivers over open formats rather than proprietary plumbing: a REST API, STIX 2.1 bundles, and a scored list served as plain text or CSV over an authenticated URL. That is all most SIEMs, firewalls and threat platforms need. Each guide below is written against a real product version and tested from our side.
Splunk
Pull the scored feed into a lookup and enrich firewall, VPN and authentication events with a hostility score at search time.
Needs: SMB, SOC or an active trial (API access)
FirewallPalo Alto NGFW
Point an External Dynamic List at the feed and block scored attacker IPs at the edge, with no agent and no scripting.
Needs: Base, SMB, SOC or an active trial
FirewallFortiGate
Register the feed as an external threat feed connector and use it as a source address in a firewall policy.
Needs: Base, SMB, SOC or an active trial
Threat platformMISP
Subscribe MISP to the feed so CTIF indicators appear alongside your other sources, with correlation against existing events.
Needs: SMB, SOC or an active trial (API access)
Threat platformOpenCTI
Bring CTIF indicators into OpenCTI as observables, either in bulk from CSV or as STIX 2.1 bundles per address.
Needs: SMB, SOC or an active trial (API access)
HostLinux host agent
Run the CTIF agent on a Linux server to sync the scored feed into nftables, with a list-only mode for evaluation.
Needs: Base, SMB, SOC or an active trial
Something else in your stack
Anything that can fetch a URL on a schedule can consume the blocklist, and anything that reads STIX 2.1 can consume the enrichment. If your tool is not listed, write to support@orvteam.com and tell us which one: we would rather publish a guide we have walked through with a real user than a long list of logos. The raw building blocks are in the API documentation.