Skip to main content

AdversaryGraph vs OpenCTI

OpenCTI is a full cyber threat intelligence platform built around a knowledge graph, entities, relationships, observables, indicators, reports, connectors, and operational CTI workflows. AdversaryGraph is a smaller self-hosted analyst workbench focused on CTI-to-detection conversion and evidence review.

Official reference: https://docs.opencti.io/

Fit Comparison

NeedOpenCTIAdversaryGraph
CTI system of recordStrong fitNot the primary goal
Knowledge graph and entity lifecycleStrong fitFocused local evidence graph and correlation views
Connector ecosystemStrong fitSelected feeds, enrichment, OpenCTI sync, STIX/TAXII/MISP imports
AI-assisted report-to-ATT&CK mappingDepends on integrationsCore workflow
TTP overlap against ATT&CK groups/campaigns/reportsPossible with modelingCore workflow
Detection backlog and telemetry readinessRequires local processBuilt into review workflow
Attack Simulation and SIEM validationNot primary roleCore v5 workflow

Use Together

Recommended operating model:

  1. Use OpenCTI as the CTI system of record.
  2. Pull selected reports, indicators, labels, or observables into AdversaryGraph.
  3. Run AI-assisted ATT&CK extraction, IOC/CVE enrichment, actor comparison, and detection-gap review.
  4. Export reviewed results back to OpenCTI or to detection engineering workflows.

Boundary

AdversaryGraph should not be described as an OpenCTI replacement. It is better described as an analysis and detection-handoff layer that can sit beside OpenCTI.