pycti.connector.opencti_connector

OpenCTI Connector module.

This module defines the connector types and the main OpenCTIConnector class used to register and configure connectors with the OpenCTI platform.

Classes

ConnectorType	Enumeration of OpenCTI connector types.
OpenCTIConnector	Main class for OpenCTI connector registration and configuration.

Module Contents

class pycti.connector.opencti_connector.ConnectorType(*args, **kwds)

Bases: enum.Enum

Enumeration of OpenCTI connector types.

Each connector type defines a specific data flow pattern:

• EXTERNAL_IMPORT: Imports data from remote sources into OpenCTI as STIX2

• INTERNAL_IMPORT_FILE: Converts files from OpenCTI file system to STIX2

• INTERNAL_ENRICHMENT: Enriches existing STIX2 data with additional information

• INTERNAL_ANALYSIS: Analyzes files or STIX2 data and produces file output

• INTERNAL_EXPORT_FILE: Exports STIX2 data to files in OpenCTI file system

• STREAM: Reads the event stream and performs custom actions

Scope definition varies by type:

• EXTERNAL_IMPORT: None (imports everything)

• INTERNAL_IMPORT_FILE: MIME types to support (e.g., application/json)

• INTERNAL_ENRICHMENT: Entity types to support (e.g., Report, Hash)

• INTERNAL_EXPORT_FILE: MIME types to generate (e.g., application/pdf)

EXTERNAL_IMPORT = 'EXTERNAL_IMPORT'

INTERNAL_IMPORT_FILE = 'INTERNAL_IMPORT_FILE'

INTERNAL_ENRICHMENT = 'INTERNAL_ENRICHMENT'

INTERNAL_ANALYSIS = 'INTERNAL_ANALYSIS'

INTERNAL_EXPORT_FILE = 'INTERNAL_EXPORT_FILE'

STREAM = 'STREAM'

class pycti.connector.opencti_connector.OpenCTIConnector(connector_id: str, connector_name: str, connector_type: str, scope: str, auto: bool, only_contextual: bool, playbook_compatible: bool, auto_update: bool, enrichment_resolution: str, listen_callback_uri=None, xtm_one_intent=None)

Main class for OpenCTI connector registration and configuration.

This class represents a connector instance that can be registered with the OpenCTI platform. It holds all configuration parameters needed for the connector to operate.

Parameters:

• connector_id (str) – Unique identifier for the connector (valid UUID4)

• connector_name (str) – Human-readable name for the connector

• connector_type (str) – Type of connector (see ConnectorType)

• scope (str) – Connector scope as a comma-separated string (e.g., “Report,Indicator”)

• auto (bool) – Whether the connector runs automatically on matching entities

• only_contextual (bool) – Whether the connector only processes contextual data

• playbook_compatible (bool) – Whether the connector can be used in playbooks

• auto_update (bool) – Whether to automatically update existing entities

• enrichment_resolution (str) – Strategy for resolving enrichment conflicts

• listen_callback_uri (str or None) – Optional callback URI for API-based listening

Raises:

ValueError – If the connector type is not a valid ConnectorType value

Example

>>> connector = OpenCTIConnector(
...     connector_id="550e8400-e29b-41d4-a716-446655440000",
...     connector_name="My Connector",
...     connector_type="EXTERNAL_IMPORT",
...     scope="Report,Indicator",
...     auto=False,
...     only_contextual=False,
...     playbook_compatible=True,
...     auto_update=False,
...     enrichment_resolution="none"
... )

Initialize the OpenCTIConnector instance.

Parameters:

• connector_id (str) – Unique identifier for the connector (valid UUID4)

• connector_name (str) – Human-readable name for the connector

• connector_type (str) – Type of connector (see ConnectorType)

• scope (str) – Connector scope as a comma-separated string

• auto (bool) – Whether the connector runs automatically

• only_contextual (bool) – Whether to process only contextual data

• playbook_compatible (bool) – Whether the connector works with playbooks

• auto_update (bool) – Whether to auto-update existing entities

• enrichment_resolution (str) – Enrichment conflict resolution strategy

• listen_callback_uri (str or None) – Optional callback URI for API listening

Raises:

ValueError – If connector_type is not a valid ConnectorType

id

name

type

auto

auto_update

enrichment_resolution

only_contextual

playbook_compatible

listen_callback_uri = None

xtm_one_intent = None

to_input() → dict

Convert connector configuration to API input format.

Generates a dictionary structure suitable for use in GraphQL API queries to register or update the connector.

Returns:

Dictionary containing connector data wrapped in an “input” key

Return type:

dict

Example

>>> connector.to_input()
{'input': {'id': '...', 'name': 'My Connector', ...}}