Configuration

The connector needs to be configured before you can use it. At the very least, you need to specify URLs, usernames, passwords and tokens. It is expected that most users of this connector is running the connector, with or without the rest of OpenCTI, in docker, using docker-compose. Configuring the connector in docker-compose can be done in one of two ways:

• Environment variables specified as key–value entries as key=value on individual lines in an .env file (in the same directory as docker-compose.yml). The file may be named differently, depending on the setting env_file in docker-compose.yml.

• Directly specified in environment in the docker-compose.yml file, for the connector service.

If you need to run the connector without using docker, you may also use a YAML or JSON configuration file. See YAML configuration for an example.

• Environment variables configuration
  • Syntax
• YAML configuration
• Required settings
• Important settings
  • TLS verification
  • Searching
  • Event creation
  • When to run
• Other considerations
  • Rules engine
  • Playbooks
• Configuration reference
  • Main configuration
  • OpenCTI configuration
  • OpenSearch configuration
  • Search configuration
  • Enrichment configuration