$ show OpenCTI-Platform/opencti
OpenCTI is an open-source cyber threat intelligence platform that ingests, manages, and analyzes threat data using the STIX 2.0/2.1 standard. The system is a monorepo containing a Node.js/TypeScript GraphQL backend (opencti-graphql), a React/Relay frontend (opencti-front), a Python client library (client-python), and a Python worker service (opencti-worker). The backend uses Elasticsearch/OpenSearch as its primary data store, Redis for caching and pub/sub, RabbitMQ for connector queues, and PostgreSQL for migrations. The frontend provides full CRUD UIs, dashboards, workspaces, playbook automation, and workflow management. Key entry points include the GraphQL API (resolvers per entity type), the frontend React app with Relay data fetching, and the Python client for programmatic access. Data flows involve ingestion via CSV/JSON/TAXII/RSS feeds, manual creation, connector enrichment, and inference rules that automatically derive relationships. External dependencies include Elasticsearch, Redis, RabbitMQ, MinIO/S3 for file storage, and optional AI services. The platform supports enterprise features (playbooks, PIR, XTM Hub) gated by license checks.
The LLM identified 4 files worth highlighting for reuse:
A centralized, reusable dialog component that enforces design-system tokens, size presets, close-button behavior, and scrolling-content padding. It abstracts MUI Dialog with consistent styling and can be extracted into any React project using MUI and the Filigran design system.
A generic data table component that works without Relay fragments, using a shared DataTableContext for state management. It supports sorting, pagination, selection, and custom rendering. The pattern is isolated from business logic and can be reused in any React application needing a feature-rich table.
A sophisticated filter group UI component that allows users to build nested filter conditions (AND/OR groups) with various operators and value inputs. It is self-contained, uses a well-defined model (FiltersModel), and can be extracted for any application requiring advanced filtering capabilities.
Exemplifies the platform's module registration pattern: defines entity type, identifier, attributes, relations, representative function, and STIX 2.1 converter. This pattern allows adding new entity types with minimal boilerplate and is reusable across any STIX-based threat intelligence system.