Rösti now plugs into OpenCTI
The Rösti connector is now part of the OpenCTI connectors repository. It imports Rösti reports into OpenCTI with their IOCs, YARA rules, ATT&CK links and CVEs, and keeps them up to date.
If you run OpenCTI, you can now bring Rösti’s threat reports straight into your platform. The Rösti connector was merged into OpenCTI’s connectors repository on 27 October 2026.
What it does
- Reports with everything in them. Each Rösti report becomes an OpenCTI report, together with its IOCs, YARA rules, MITRE ATT&CK links and CVEs, all as STIX 2.1.
- 19 IOC types. Domains, IPs, URLs, hashes, emails, file names, mutexes, user agents and wallets become indicators with linked observables.
- Grouped IOCs. The hashes and names of one file become one File, and the URL, domain and IP of one server become one indicator.
- YARA rules that work. Rules are compiled the way OpenCTI checks them, and helper rules from the same report are added automatically.
- Scores and filters. Rösti’s false-positive risk sets each indicator’s score. You can import only certain IOC types, only detection-ready IOCs, or only IOCs up to a risk level.
- Always up to date. Each run fetches only new and changed reports and updates them in place.
Getting started
You need OpenCTI 7.261023.1 or later and a Rösti API key. The README explains the configuration and deployment. The connector will be part of the next OpenCTI connectors release; until then, you can build it from the repository as the README describes.
I also recommend running the MITRE ATT&CK connector: it lets the Rösti connector link ATT&CK software (malware and tools) to its reports.
Thanks
Many thanks to the OpenCTI maintainers for their thorough review. If something doesn’t work as expected, or you’re missing a feature, let me know.