OpenCTI CLI

pycti observable-create

Manage the OpenCTI threat intel platform with the Python client (pycti), creating and querying observables and graph entities.

Run it when you want to manage OpenCTI from code: pycti observable-create registers the observable (the IOC) in the platform, which integrates it into the intel graph (entities, indicators, relationships) with enrichment. It's the reference intel platform (from OpenCTI/Filigran): the threat graph (actors, campaigns, IOCs) with relationships. In the SOC and threat intel, OpenCTI is the knowledge platform: created observables and queried graph entities feed detections and cases.

Don't use it without the platform: pycti requires the OpenCTI server and token — the infrastructure is the requirement. And watch out: the OpenCTI graph is built with curation (relationships and entities are maintained): an unmaintained graph loses value. The pycti APIs (per-entity clients) have a learning curve: consult the documentation. For graph analysis, use the OpenCTI interface; pycti for programmatic operations (automations).