PolySwarm Inside OpenCTI
Enrich file hashes in OpenCTI with PolySwarm detections and a PolyScore, detonate uploaded files in a cloud sandbox, and keep every result in the knowledge graph as STIX 2.1. Built by PolySwarm and published in the official OpenCTI connectors repository.
What the Connectors Do
Hash Enrichment
The enrichment connector looks up a file observable by its hash and adds PolySwarm's detections and PolyScore. The observable's score in OpenCTI is set from the PolyScore.
File Type and Family Labels
Results come back as a note on the observable, with labels for the file type and the malware family so analysts can filter on them.
Sandbox Detonation
The sandbox connector sends an uploaded file to the CAPE and Triage sandboxes, or to either one, and records what each one found.
Reports Attached
The sandbox report is attached to the artifact in OpenCTI, so the evidence travels with the file.
STIX 2.1 Written Back
Indicators and their relationships are created as STIX 2.1 objects, so PolySwarm results sit in the same graph as the rest of your intelligence.
Errors You Can See
If a lookup or a detonation fails, the reason is recorded as a note on the observable instead of disappearing into a log file.
See It in OpenCTI
Screens from OpenCTI with both PolySwarm connectors running. Select any image to see it full size.
How Teams Use It
Triage Incoming Files
Let new file hashes enrich themselves on arrival, so the ones PolySwarm already flags as malicious stand out in the queue.
Detonate the Unknown
When a hash has no verdict, upload the file as an artifact and run it in the sandbox from the same screen.
Keep It in the Graph
Every verdict and report is stored as STIX 2.1, so it can be searched, linked and shared like the rest of your OpenCTI data.
Get Started in Minutes
Add the Connector
Add polyswarm-enrichment, polyswarm-sandbox or both to your OpenCTI docker compose, using the examples in the official connectors repository
Set Your Keys
Set POLYSWARM_API_KEY, OPENCTI_URL, OPENCTI_TOKEN and a unique CONNECTOR_ID, then start the container
Enrich
Open a file observable or artifact in OpenCTI and run the PolySwarm enrichment
Bring PolySwarm Into OpenCTI
The connectors are open source in the official OpenCTI repository. Use them with your existing PolySwarm API key, or talk to us about a plan.