Lion Cipher Lab

Stand up OpenCTI and structure your first threat intelligence

• Threat Intel Analyst
• Intermediate
• ~75 min
• Free · no account required

Why it matters

As soon as you track more than a handful of threats, notes in a document stop scaling — you can't ask them questions like "which of the actors I follow use this technique?" A Threat Intelligence Platform stores intel as structured, linked objects so you can correlate, pivot and share it. OpenCTI is the leading open-source TIP and speaks STIX, the industry-standard language for threat intel, so learning it teaches you both a real tool and the data model the whole field uses.

What you'll learn

• threat-intelligence platforms
• STIX 2.1 data model
• connectors/feeds
• structuring IOCs and TTPs
• Docker Compose

Steps in this lab

1. What a TIP is, and why prose notes stop scaling
2. STIX in one breath — the language OpenCTI speaks
3. Get the OpenCTI Docker Compose stack
4. Configure the required secrets
5. Launch the stack and log in
6. Add a connector and import MITRE ATT&CK
7. Make one relationship yourself — see the point
8. When NOT to run your own TIP, and how to shut it down cleanly

Open the full interactive lab →