pycti

What it is and what it does

Pycti is the official Python client for OpenCTI, a threat intelligence platform developed by Filigran. It abstracts the OpenCTI REST API into Python methods and utilities, allowing developers to query, create, and manage threat intelligence objects (indicators, malware, campaigns, etc.) programmatically. The client is used both by external integrations and by OpenCTI's own internal components.

The package brings together a substantial dependency graph—including boto3 for cloud storage, pika for message queuing, fastapi and uvicorn for async web operations, stix2 for standards-based threat data, and observability tools like prometheus-client and opentelemetry—suggesting it is designed for production environments where threat data flows through multiple systems. It requires Python 3.7 or later and is actively maintained, with its last release 3 days old.

Use it for:

• Automate threat intelligence ingestion by querying OpenCTI for indicators, malware profiles, or campaigns and feeding them into your security tools.
• Build custom connectors or enrichment workflows that read from OpenCTI and write results back, leveraging the client's standardized API methods.
• Integrate OpenCTI threat data into SOAR platforms or incident response systems via programmatic API calls rather than manual exports.
• Develop monitoring dashboards or reporting scripts that pull live threat statistics and entity relationships from an OpenCTI instance.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Provides a Python client library for the OpenCTI API, enabling developers to programmatically interact with OpenCTI threat intelligence platform instances through standardized methods and utilities.

Yes. The package is actively maintained, permissively licensed, has no known vulnerabilities, and is widely used (top 5000 PyPI). Install it if you need to integrate with OpenCTI; the main consideration is ensuring your OpenCTI instance is accessible and that the 18 runtime dependencies align with your environment's constraints.

Install

pycti on PyPI

pip install pycti

uv add pycti

poetry add pycti

Installing pycti

Before you install

Low friction installation with a pure-Python wheel distribution. The package is actively maintained with a recent release and 9810 repository stars, indicating stable community adoption.

License in practice

Licensed under Apache (permissive), allowing commercial and private use with minimal restrictions—suitable for most deployment scenarios.

Quickstart

pip install pycti

from pycti import OpenCTIApiClient

client = OpenCTIApiClient(
    url="http://opencti-instance:4000",
    token="your-api-token"
)

# Query indicators
indicators = client.indicator.list()

An accessible OpenCTI API instance (URL and valid authentication token) is required; the client cannot function without a running OpenCTI server to connect to.

Verify before relying

• Whether the package's 18 runtime dependencies (including boto3, fastapi, stix2) are all required for basic usage or if some are optional for specific features.
• Whether OpenCTI API server availability is a hard requirement or if the client can operate in offline/mock modes for testing.

Package facts

Evidence: pycti-7.260811.0-py3-none-any.whl

Tags

More Python Modules packages