Documentation
Feed Management

OpenCTI

Configure OpenCTI CSV feeds and ingest them as SandsBytes Feeds for indicator enrichment.

Introduction

OpenCTI is a threat intelligence platform (TIP) for storing and sharing indicators, observables, and related knowledge.

SandsBytes Feeds currently ingest CSV only (from a URL or an uploaded file). The recommended integration path is OpenCTI Data → Data sharing → CSV feeds: OpenCTI regenerates a CSV file on a schedule and exposes it at an HTTP URL that SandsBytes can poll.

OpenCTI also supports TAXII collections and live streams. Those deliver STIX or Server-Sent Events, not CSV, so they are not used for SandsBytes Feeds today. Prefer a CSV feed for this integration.

After the feed is collecting records, you can match them against case or pipeline data with a Feed Enricher.

Prerequisites

Before you start, confirm the following:

RequirementDetails
OpenCTI platformOpenCTI 5.x or 6.x+ with indicators and/or observables already populated
OpenCTI capabilitiesManage Data sharing to create CSV feeds; also Manage credentials if you need a public feed URL
Network pathSandsBytes must reach the OpenCTI CSV feed URL (HTTPS recommended)
SandsBytes accessPermission to create and edit feeds under Feeds
Auth decisionChoose a public CSV URL or a restricted URL that requires an OpenCTI API token in request headers

Auth recommendation

Prefer a restricted CSV feed and pass an OpenCTI Bearer token from SandsBytes request headers. Use a public feed only when the URL is protected by network controls and the data markings allow broader exposure.

Configure OpenCTI to export a CSV feed

Step 1: Open CSV feeds

  1. Sign in to OpenCTI with a user that can manage data sharing.
  2. Go to Data → Data sharing → CSV feeds.
  3. Create a new CSV feed.

Step 2: Name, interval, and filters

Configure the feed so it exports only the indicators you want in SandsBytes:

SettingGuidance
NameClear name, for example SandsBytes IoCs or High-score indicators
Refresh intervalHow often OpenCTI regenerates the CSV. Align this with how often SandsBytes should poll (see Run Every... later)
FiltersNarrow by entity type (Indicator / Observable), score, labels, markings, or other criteria your team uses for actionable IoCs

Step 3: Entity types and column mapping

Select the entity type(s) to include, then map CSV columns to attributes. For SandsBytes matching, include at least one column that holds the raw IoC string (hash, IP, domain, URL, and so on).

Recommended columns for indicator use:

CSV column (example header)Typical OpenCTI attributePurpose in SandsBytes
valueIndicator / Observable valueFeed Key — value used to match records
pattern_type or entity_typePattern or entity typeContext / dynamic tags
score or confidenceScore / confidenceContext / dynamic tags
created or modifiedTimestampsFreshness metadata
labelsLabelsContext / dynamic tags (d:labels)

Column names in the generated CSV become the field names SandsBytes stores. Use stable, simple headers (no spaces if possible) so Feed Key and tag references stay predictable.

Step 4: Access control

  • Restricted (default): only authorized OpenCTI users or tokens can download the CSV. In SandsBytes, add an Authorization request header with a valid OpenCTI token.
  • Public: the CSV URL is reachable without authentication. Requires the Manage credentials capability when enabling public sharing, and you must select a user whose markings and rights define what the feed can expose.

Step 5: Copy and verify the CSV URL

  1. After saving, copy the generated CSV feed URL from OpenCTI.
  2. Verify the response is CSV with a header row. For example:
curl -sS -H "Authorization: Bearer <OPENCTI_TOKEN>" "<CSV_FEED_URL>" | head

You should see a header line (for example value,score,labels,...) followed by data rows.

CSV feed size limit

OpenCTI CSV feeds default to a cap of about 5,000 entries (typically the most recent matching entities). If your filter set is larger, tighten filters, split feeds by type or label, or accept that only the newest matching rows are shared.

Add the OpenCTI export in SandsBytes

Step 1: Create a feed

  1. In SandsBytes, open Feeds from the sidebar.
  2. Click Create.

Create button on the Feeds List page

Step 2: Feed Information

Create Feed page showing Feed Information, Source Information, and Format Information sections

FieldSuggested value for OpenCTI
NameFor example OpenCTI Indicators
Overwrite Records Every TimeLeave disabled for large feeds so syncs add only new rows; enable only when you need a full replace each run
Run Every...Match or slightly exceed the OpenCTI CSV refresh interval
Feed KeyCSV column that holds the IoC string (commonly value)
TagsStatic tags such as OpenCTI, plus dynamic tags like d:score or d:labels when those columns exist
Zip Compressed File NameLeave empty for a normal OpenCTI CSV URL

Step 3: Source Information

Use Online (URL):

FieldValue
URLThe OpenCTI CSV feed URL
MethodGET
Request HeadersIf the feed is restricted: Authorization = Bearer <OPENCTI_TOKEN>. Optionally set Accept = text/csv
Request Body FormLeave empty for a simple GET download

Ensure the URL returns the CSV body directly (no interactive login page or HTML redirect).

Step 4: Format Information

OpenCTI CSV feeds include headers and use comma delimiters in typical setups:

FieldValue
Include headersEnabled
Add CSV columns headersOnly needed if the file has no header row
CSV Delimiter, (default)
Excluded Request Header NamesExclude columns you do not need stored
Ignore Lines Starting With# if the source ever emits comment lines
Trim CharactersUse if values are wrapped in quotes after split (for example trim ")

Step 5: Save and verify

  1. Click Create (or save). SandsBytes triggers a sync after create/edit.
  2. Open the Feeds Records tab and confirm rows appear.
  3. Search by indicator using a known OpenCTI value to validate the Feed Key mapping.

Feeds Records tab showing collected feed rows, search fields, and expanded record details

Note

Once you create or edit the feed, it triggers the sync operation to update the feed.

Optional: enrich records with the feed

To apply OpenCTI matches to processed records, create a FEEDS enricher:

  1. Follow Create Enricher.
  2. Set Enricher Type to FEEDS.
  3. Point key at the record field that holds the IoC (hash, IP, domain, and so on).
  4. Set meta to the destination metadata path (often used for alert context).

Matching against feeds is case insensitive.

Troubleshooting

SymptomWhat to check
HTTP 401 / 403Token missing or invalid; feed not public; user/token lacks access to the shared data or markings
Empty CSV or zero SandsBytes rowsOpenCTI filters too strict; no entities created/modified in the refresh window; markings hide data from the feed user
Sync fails or non-CSV bodyURL points to UI/login HTML; wrong path; TLS or network block from SandsBytes to OpenCTI
No matches in enricher / searchFeed Key column name does not match the CSV header; IoC lives in a different column than value
Header / parse errorsDelimiter mismatch; Include headers setting wrong; unexpected quote wrapping (use Trim Characters)
Missing older indicatorsOpenCTI ~5,000 entry cap — split or narrow the CSV feed

Feed Sources

Curated integrations that supply indicator data for SandsBytes Feeds.

Users and Roles Management

Manage users, roles, permissions, assignments, and account security in SandsBytes.

On this page

IntroductionPrerequisitesConfigure OpenCTI to export a CSV feedStep 1: Open CSV feedsStep 2: Name, interval, and filtersStep 3: Entity types and column mappingStep 4: Access controlStep 5: Copy and verify the CSV URLAdd the OpenCTI export in SandsBytesStep 1: Create a feedStep 2: Feed InformationStep 3: Source InformationStep 4: Format InformationStep 5: Save and verifyOptional: enrich records with the feedTroubleshootingRelated