pycti.connector.opencti_connector

OpenCTI Connector module.

This module defines the connector types and the main OpenCTIConnector class used to register and configure connectors with the OpenCTI platform.

class pycti.connector.opencti_connector.ConnectorType(*values)[source]

Enumeration of OpenCTI connector types.

Each connector type defines a specific data flow pattern:

  • EXTERNAL_IMPORT: Imports data from remote sources into OpenCTI as STIX2

  • INTERNAL_IMPORT_FILE: Converts files from OpenCTI file system to STIX2

  • INTERNAL_ENRICHMENT: Enriches existing STIX2 data with additional information

  • INTERNAL_ANALYSIS: Analyzes files or STIX2 data and produces file output

  • INTERNAL_EXPORT_FILE: Exports STIX2 data to files in OpenCTI file system

  • STREAM: Reads the event stream and performs custom actions

Scope definition varies by type:

  • EXTERNAL_IMPORT: None (imports everything)

  • INTERNAL_IMPORT_FILE: MIME types to support (e.g., application/json)

  • INTERNAL_ENRICHMENT: Entity types to support (e.g., Report, Hash)

  • INTERNAL_EXPORT_FILE: MIME types to generate (e.g., application/pdf)

class pycti.connector.opencti_connector.OpenCTIConnector(connector_id, connector_name, connector_type, scope, auto, only_contextual, playbook_compatible, auto_update, enrichment_resolution, listen_callback_uri=None, xtm_one_intent=None)[source]

Main class for OpenCTI connector registration and configuration.

This class represents a connector instance that can be registered with the OpenCTI platform. It holds all configuration parameters needed for the connector to operate.

Parameters:

  • connector_id (str) – Unique identifier for the connector (valid UUID4)

  • connector_name (str) – Human-readable name for the connector

  • connector_type (str) – Type of connector (see ConnectorType)

  • scope (str) – Connector scope as a comma-separated string (e.g., “Report,Indicator”)

  • auto (bool) – Whether the connector runs automatically on matching entities

  • only_contextual (bool) – Whether the connector only processes contextual data

  • playbook_compatible (bool) – Whether the connector can be used in playbooks

  • auto_update (bool) – Whether to automatically update existing entities

  • enrichment_resolution (str) – Strategy for resolving enrichment conflicts

  • listen_callback_uri (str or None) – Optional callback URI for API-based listening

Raises:

ValueError – If the connector type is not a valid ConnectorType value

Example

>>> connector = OpenCTIConnector(
...     connector_id="550e8400-e29b-41d4-a716-446655440000",
...     connector_name="My Connector",
...     connector_type="EXTERNAL_IMPORT",
...     scope="Report,Indicator",
...     auto=False,
...     only_contextual=False,
...     playbook_compatible=True,
...     auto_update=False,
...     enrichment_resolution="none"
... )
__init__(connector_id, connector_name, connector_type, scope, auto, only_contextual, playbook_compatible, auto_update, enrichment_resolution, listen_callback_uri=None, xtm_one_intent=None)[source]

Initialize the OpenCTIConnector instance.

Parameters:

  • connector_id (str) – Unique identifier for the connector (valid UUID4)

  • connector_name (str) – Human-readable name for the connector

  • connector_type (str) – Type of connector (see ConnectorType)

  • scope (str) – Connector scope as a comma-separated string

  • auto (bool) – Whether the connector runs automatically

  • only_contextual (bool) – Whether to process only contextual data

  • playbook_compatible (bool) – Whether the connector works with playbooks

  • auto_update (bool) – Whether to auto-update existing entities

  • enrichment_resolution (str) – Enrichment conflict resolution strategy

  • listen_callback_uri (str or None) – Optional callback URI for API listening

Raises:

ValueError – If connector_type is not a valid ConnectorType

to_input()[source]

Convert connector configuration to API input format.

Generates a dictionary structure suitable for use in GraphQL API queries to register or update the connector.

Returns:

Dictionary containing connector data wrapped in an “input” key

Return type:

dict

Example

>>> connector.to_input()
{'input': {'id': '...', 'name': 'My Connector', ...}}