opencti-bq-connector

Bidirectional connector between OpenCTI and BigQuery.

Automatically maps pentest findings → STIX 2.1 objects in OpenCTI, and pulls threat intel enrichment back into BigQuery.

Quick start

cd docker
cp .env.example .env
# edit .env — fill tokens, set SA_KEY_PATH
docker compose up -d

OpenCTI → http://localhost:8080

Structure

docker/
  docker-compose.yml    # Full OpenCTI stack + connector
  .env.example          # Config template

connector/
  Dockerfile
  requirements.txt
  src/
    main.py             # Poll loop
    bq_client.py        # BQ fetch + write
    stix_mapper.py      # pentest_events → STIX 2.1 bundles
    enrichment.py       # OpenCTI → BQ enrichment

Data flow

pentest_events (BQ)
       │
       ▼  fetch new rows
  stix_mapper.py
       │
       ▼  push STIX bundle
    OpenCTI  ──── UI at :8080
       │
       ▼  query linked intel
  enrichment.py
       │
       ▼  write back
pentest_events (call_type='opencti_enrichment')