Log In Sign Up
Celebrating 10'000 reports

Ready-to-use threat intelligence from public reports.

Rösti provides Repackaged Öpen Source Threat Intelligence gathered from public reports. The Indicators of Compromise (IOCs) are available in various formats, including MISP, STIX and ECS.

Explore Reports Get API Access
new

OpenCTI connector

Rösti now plugs into OpenCTI.

The Rösti connector is now part of OpenCTI's connectors repository. It brings every Rösti report into OpenCTI as STIX 2.1, with its IOCs, YARA rules, ATT&CK links and CVEs, and keeps it up to date. All you need is a free API key.

Set up the connector Get an API key
19 IOC types Domains, IPs, URLs, hashes, emails, file names, mutexes, user agents and wallets become STIX indicators with linked observables.
Grouped IOCs The hashes and names of one file become one File. The URL, domain and IP of one server become one indicator, with the domain resolving to the IP.
YARA rules Imported as YARA indicators and compiled the way OpenCTI checks them. Helper rules from the same report are added automatically.
ATT&CK and CVEs Techniques, groups, campaigns, mitigations and software are linked to OpenCTI's own ATT&CK data. CVEs become vulnerabilities.
Scores and filters Rösti's false-positive risk sets each indicator's score. Import only certain IOC types, detection-ready IOCs or IOCs up to a risk level.
Always up to date Each run fetches only new and changed reports, and updates reports in place. When your API quota runs out, it continues after the reset.
Loading stats

Collect, Enrich, Deliver

Aggregated from Trusted Sources

Rösti continuously collects IOCs from reputable threat intelligence providers, security researchers, and public feeds — all in one place.

Normalized & Enriched

Threat data is classified, standardized, and enriched into a consistent structure, making it easy to search, correlate, and automate.

Delivered How You Need It

Consume intelligence through APIs or ready-to-use feeds compatible with SIEMs, firewalls, IDS/IPS platforms, and custom tooling.

Unified sources

See What You Get

IOCs from public reports, delivered as ready-to-use-feeds and API data.

The public report

Illustrative example:

September 31, 2026

Inside a malware campaign

The STAC4924 campaign used openimagesworld.us as its command-and-control (C2) server, fronted by Cloudflare at IP address 172.67.187.164 .

Ready-to-use intelligence

Extracted, enriched and organized by Rösti

Type Indicator Comment Risk Tags Source
Domain openimagesworld.us C2 server in STAC4924 campaign - cnc Inside a malware campaign
IP 172.67.187.164 NO IDS Cloudflare front medium - 172.67.187.164 belongs to Cloudflare Tag1, Tag2 Inside a malware campaign
API

Use the API to retrieve structured threat intelligence.


{
  "indicators": [
    {
	  "category": "network_activity",
      "value": "openimagesworld.us",
      "date": "2026-10-01",
      "comment": "C2 server in STAC4924 campaign",
      "type": "domain",
      "ids": true,
      "report": "qTfKJpNx",
      "timestamp": "2026-10-01T11:19:02.808351534Z",
      "tags": [
        "cnc",
      ],
      "id": "mQ7vX2aRkL9pT4NcYz8HsW"
    },
    {
	  "category": "network_activity",
      "value": "172.67.187.164",
      "date": "2026-10-01",
      "comment": "Cloudflare front",
      "type": "ip",
      "ids": false,
      "report": "qTfKJpNx",
      "timestamp": "2026-10-01T11:19:02.808351534Z",
      "id": "mQ7vX2aRkL9pT4NcYz8HsW"
      "risk": { 
        "level": 3,
        "msg": "172.67.187.164 belongs to Cloudflare",
        "meaning": "medium",
        "disclaimer": "Risk indicates likelihood of false positives. Based on Rösti's imperfect enrichment and should be treated with caution."
      }
    }
  ]
}