OpenCTI

Bring CTIF indicators into OpenCTI as observables, either in bulk from CSV or as STIX 2.1 bundles per address.

Plan needed: SMB, SOC or an active trial (API access)
Written against: OpenCTI 5.x/6.x. There is no packaged CTIF connector yet.

Honest starting point

We do not publish an OpenCTI connector, and we are not going to claim one exists. Two supported paths work today; both are things we use ourselves.

Path 1: bulk CSV

Fetch the CSV, then import it with a CSV mapper that reads the first column as an IPv4-Addr observable and the second as the score. This is the fastest way to get a large set of addresses in.

curl -fsS -H "X-CTIF-Key: $CTIF_API_KEY" \
  "https://ctif.orvteam.com/api/blocklist?format=csv&min_score=70&first_party_only=true" \
  -o ctif-first-party.csv

Path 2: STIX 2.1 per address

For enrichment during an investigation, request a STIX 2.1 bundle for a single address and submit it to your OpenCTI worker. The bundle carries the indicator, the observable and the ATT&CK context we mapped from the behaviour we observed.

curl -fsS -H "X-CTIF-Key: $CTIF_API_KEY" \
  "https://ctif.orvteam.com/api/stix/185.220.101.4" -o bundle.json

Notes

If you want a real connector, say so: we would rather build the one people actually deploy than five nobody asked for.

If it does not work

Send the exact URL with the key redacted, the UTC time and the response you got to support@orvteam.com. Response targets are on the support page, and current service health is on the status page.