OpenCTI × AmbactiBring OpenCTI into
the flow of work.
A little less busywork with OpenCTI.
Gather contextDo the workReview & share
Threat indicators6 capabilities+
- List indicators
- Read an indicator
- Create an indicator
- Update an indicator field
- Link a cyber observable to an indicator
- Import an indicator from STIX2
Frequently asked
questions.
What could an Ambacti integration do with OpenCTI?
The documented operations include Threat indicators: List indicators; Threat indicators: Read an indicator; Threat indicators: Create an indicator; Threat indicators: Update an indicator field.
Could I keep a workflow read-only?
For a read-only workflow, limit account permissions to reading data and exclude actions that create, update, or delete records.
Will every action run automatically?
Choose which steps could run on their own and which should pause for review. Changes should follow the permissions and approval rules you set.
Do I need to review actions in OpenCTI?
Decide which work could run on its own and which steps need your review.