OpenCTI

Threat intelligence is about more than just collecting IPs and hashes, as it requires understanding the who, how, and why behind an attack. OpenCTI provides a framework for mapping these connections, turning reports into a comprehensive understanding of the threat landscape. This room introduces you to the platform's core features and shows you how to navigate and analyze threat intelligence.

Learning Objectives

• Understand what OpenCTI is and how it's used
• Explore where threat intel is sourced and how it is ingested
• Learn how to navigate the UI and make use of its features
• Cover the key functionalities when analyzing a threat
• Apply your knowledge in a practical investigation challenge

Prerequisites

• Cover Intro to Cyber Threat Intel for an overview of the core concepts and frameworks that drive the intelligence field
• Go over MITRE to become familiar with the TTPs and adversarial behaviors you will be visualizing within the OpenCTI platform

Machine Access

Click the Start Machine button below. Please give OpenCTI up to five minutes to start and access the dashboard with the following link and credentials: https://LAB_WEB_URL.p.thmlabs.com/ (opens in new tab)

• admin@opencti.thm
• TryHackMe!

Note: If you access the link immediately after starting the machine, you may encounter a 502 Bad Gateway error. Please wait 3 to 5 minutes and refresh your browser.

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting the Target Machine, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.

Lab machine

Status:Off

Start Lab Machine